Privacy Policy

1. At a Glance

This Privacy Policy explains how DooFox LTD, a company registered in England & Wales under company number 17193256 with its registered office at Office 15270, Initial Business Centre, Unit 7 Wilson Business Park, Manchester, M40 8WN, United Kingdom (“we”, “us”), collects, uses, and shares personal information when you use the Inscura desktop application, the inscura.app website, your account, and the optional Inscura Cloud service (collectively, the “Service”).

2. The Desktop Application

The Inscura desktop application is designed to be local-first. By default, it does not collect or transmit to us any of the following:

• the names, paths, sizes, durations, hashes, or contents of your media files;
• the contents of your library database, custom fields, ratings, or notes;
• analytics, crash telemetry, or usage events.

The desktop application makes network requests for the following purposes. Some checks run automatically after you enable or activate the relevant feature:

• License activation and periodic checks: When you activate a paid license, the application sends your license key and a device identifier to our service. After activation, it periodically contacts the service to check the license and device status. These requests allow us to validate your access and enforce the device limit for your plan.
• Update checks: When you (or, if you have enabled it, the application on your behalf) check for updates, the application asks our update server for the latest available version. We log the request only as part of standard, short-lived web-server access logs.
• Movie information and translation: When you enable online movie information or translation, the app sends the title, identifier, or text needed for the request to the source or service configured in the app. Artwork and other requested files are downloaded from those sources.
• Scene-search downloads: Preparing scene search requires downloading additional components. Once they are installed and your videos are prepared, scene searches run on your computer.
• Uploads you configure: If you configure a storage service and choose to upload resources, the selected files and the information needed to store them are sent to that service. Its own privacy terms apply to those uploads.

IP addresses. As with any network service, when the desktop application contacts our servers for one of the purposes above, your IP address is necessarily disclosed to our edge infrastructure as a basic part of the TCP/IP and TLS handshake — this happens at the network level rather than as deliberate collection by the application. Such IP addresses are recorded only in standard, short-lived web-server access logs (see Sections 3 and 8) for security, abuse prevention, and operational debugging, and are not associated with the contents of your library.

The built-in movie-information service runs on your computer, but it contacts online sources to retrieve the information and artwork you request. Any additional services you configure may process requests under their own privacy policies. These features do not require Inscura Cloud.

3. Website & Account

When you visit inscura.app or create an account to purchase a license or manage Inscura Cloud, we collect:

• Account data: your email address, the date your account was created, and any profile preferences you choose to set. You sign in using a time-limited link sent to your email address; you do not choose an account password.
• Order data: the products you purchased, the price paid, currency, transaction identifier, license keys issued, and the country reported by the payment processor for tax purposes. We do not store full payment-card numbers; payment is processed by our payment processor (see Section 7).
• Server logs: our web servers automatically record standard log lines — IP address, user agent, requested URL, response status, and timestamp — primarily for security, abuse prevention, and operational debugging.

We use this data to: provide and secure your account; deliver license keys; process refunds; comply with tax and accounting obligations; and respond to your support requests. The legal bases (where the GDPR or similar law applies) are the performance of our contract with you, our legitimate interests in operating and securing the Service, and our legal obligations.

4. Inscura Cloud

Inscura Cloud entitlements and subscriptions are linked to your account and license. To let you view and manage them, we process:

• the associated account and license identifiers;
• the entitlement or subscription status and expiry or renewal dates;
• payment-provider references for any separately purchased subscription;
• account-management request information, such as the request time and IP address.

The current desktop library, movie-information features, and local scene search do not require Inscura Cloud. Their use should not be understood as sending movie lookups or translation jobs through a Cloud subscription. We do not use Cloud records to build a profile of your viewing taste, and we do not sell or share them with advertisers, ad-tech vendors, or data brokers.

Any detailed Cloud request logs are retained for up to 90 days; aggregated, non-identifying counters (for example: total requests per day, error rate per endpoint) may be retained longer for capacity planning.

5. Contact Form & Support

When you submit the contact form on inscura.app, we receive the information you choose to provide — for example your name, email address, company (optional), reason for contacting us, and message — together with the submission timestamp, the IP address of the request, and the user agent of your browser. This data is used solely to respond to your inquiry and to keep the form free from automated abuse (we use Google reCAPTCHA v3; see Section 7).

6. Cookies & Similar Technologies

inscura.app uses the following categories of cookies and similar technologies:

• Strictly necessary: session and authentication cookies for logged-in users, and a CSRF token to protect form submissions. Where we store your language or theme preferences, we do so in your browser’s local storage rather than via tracking cookies, and these preferences are not transmitted to our servers.
• Anti-abuse: Google reCAPTCHA v3, used on the contact and sign-in forms, sets cookies on the google.com domain to score requests and detect bots.
• Website analytics: Google Analytics automatically measures visits to public website pages, scrolling, application download clicks, successful contact submissions, accepted sign-in email requests, and server-confirmed successful purchases shown on the payment result page. Website analytics is always enabled and is not controlled by the optional reCAPTCHA preference. It processes pseudonymous cookie identifiers, public page paths, referring sites, browser and device information, and approximate location. Google receives your IP address as part of network communication. Conversion events include the event type, a random or pseudonymous event identifier and, for purchases, a pseudonymous transaction identifier and product SKU. Sign-in and payment result URLs are reduced to their fixed paths without query parameters; they do not generate page-view events. We do not send email addresses, form content, license keys, URL query parameters, or sign-in and confirmation tokens to Analytics. Google Signals and advertising personalization are disabled.

Analytics cookies (_ga and _ga_*) expire after up to 180 days without extending their lifetime on each visit. We remember your optional reCAPTCHA choice in local storage for up to 180 days. To prevent repeated conversions on page refresh, we also keep up to 200 pseudonymous conversion identifiers in local storage, valid for up to 180 days. Cookie preferences in the footer lets you allow or decline reCAPTCHA; it does not disable website analytics. This site does not provide an analytics opt-out control. Your browser or content-blocking tools may restrict Analytics cookies or requests.

We do not use third-party advertising cookies, cross-site tracking pixels, or fingerprint-based analytics on inscura.app.

7. Service Providers & Sub-Processors

We rely on a limited number of trusted vendors to operate the Service. Providers processing personal data on our behalf follow our instructions and applicable agreements. Where a provider acts as an independent controller, including Waffo for its payment, tax, and legal obligations, its own privacy terms also apply. Current categories include:

• Payment processing: Waffo processes payments and handles applicable taxes when you purchase a license or Inscura Cloud.
• Hosting and content delivery: to serve the website, Inscura Cloud, and update files reliably around the world.
• Email delivery: to send transactional messages such as sign-in links, order receipts, license keys, and replies to your support requests.
• Anti-abuse: Google reCAPTCHA v3 on the contact and sign-in forms. Use of reCAPTCHA is also subject to the Google Privacy Policy and Terms of Service.
• Website analytics: Google Analytics helps us understand public website traffic and downloads. Google processes this information under its applicable terms and privacy policy, including on servers outside your country. This website measurement does not apply to your desktop media library.
• Upstream service providers: Online movie-information and translation features contact the sources or services configured in the desktop application. Those providers receive the request data needed for the feature and apply their own privacy policies.

We do not sell or rent your personal information.

Sub-processor list. We maintain a current, named list of service providers and sub-processors and their processing locations at inscura.app/privacy/sub-processors. We will provide reasonable advance notice through the website, and where required by applicable law also by email or in-app message, before adding or replacing a sub-processor that materially affects the processing of your personal information, so that you can object before the change takes effect.

8. Data Retention

• Account and order records — kept for as long as your account exists, plus the period required by tax and accounting law (typically up to seven years for invoices).
• Inscura Cloud detailed request logs — up to 90 days.
• Web-server access logs — up to 30 days, then deleted or aggregated.
• Google Analytics user-level and event-level data — two months, without resetting retention on new activity. Aggregated standard reports may be retained longer.
• Contact-form submissions — kept for as long as we reasonably need to respond and to defend any related claims, then deleted on request.

9. Security

We use industry-standard measures to protect personal information, including TLS in transit, encryption of secrets at rest, time-limited email sign-in links, principle-of-least-privilege access, and regular dependency updates. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

10. International Transfers

We are based in the United Kingdom and our primary infrastructure is operated through global content-delivery and edge providers with regional points of presence around the world. If you access the Service from outside the United Kingdom, your personal information may be transferred to, processed in, and stored in countries other than the one in which you reside, including jurisdictions where our sub-processors operate. Where required by applicable law (including the UK GDPR and the EU GDPR), we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable.

11. Your Rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete your information, subject to legal record-keeping obligations;
• export your information in a portable format;
• object to or restrict certain processing, including direct marketing;
• not be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects concerning you. We do not currently engage in such automated decision-making;
• withdraw a consent you previously gave, without affecting prior processing;
• lodge a complaint with your local data-protection authority.

If you are a California resident, the CCPA/CPRA gives you specific rights, including the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, submit a request through inscura.app/contact from the email address associated with your account, or contact our EU/UK representative as described in Section 14. We will respond within the timeframe required by applicable law and may need to verify your identity before acting on the request.

12. Children

The Service is not directed to children under 16 (or the age of digital consent in your jurisdiction, if higher), and we do not knowingly collect personal information from them. In the United States, we do not knowingly collect personal information from children under 13 within the meaning of the Children’s Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13 (in the United States) or under the applicable age of digital consent (in the European Economic Area, the United Kingdom, or other jurisdictions), we will delete it without undue delay. If you believe a child has provided us with personal information, please contact us through inscura.app/contact.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective” date at the top of this page. For material changes — for example, the introduction of a new category of data collection — we will provide reasonable advance notice through the website, by email, or in the application before the change takes effect.

14. EU Representative & UK Supervisory Authority

We are established in the United Kingdom. The UK Information Commissioner’s Office (ICO) is our lead supervisory authority for matters relating to the UK GDPR and the Data Protection Act 2018, and you may lodge a complaint with the ICO at ico.org.uk if you believe we have processed your personal information in a manner inconsistent with applicable law.

Where we offer goods or services to, or monitor the behaviour of, individuals located in the European Economic Area or Switzerland, applicable law (including Article 27 of the EU GDPR) may require us to designate a representative inside those territories. A designated representative will be appointed prior to the commencement of any material processing of personal data of EEA or Swiss data subjects requiring such designation, and the representative’s name and contact details will be published in this section before that processing begins.

Until an EU representative is published, EEA and Swiss data subjects may exercise their rights and contact us directly through inscura.app/contact, and may also lodge a complaint with their local data-protection authority.