Security and your data
Understand what stays in your browser, what reaches the server, and what becomes public.
In your browser
Guest drafts are temporary
Without an account, your draft stays in memory for the current editor page. Leaving or reloading clears that session. Export JSON if you want an editable copy. Browsing records and requesting media still contacts the relevant services.
Signed-in editing can keep local copies
Signed-in editing can keep project data and pending recovery copies in browser storage, separately from server saves. Server-side project encryption does not cover these browser copies. Use a trusted browser and device for private work.
Browser MP4 export runs on your machine
Your browser reads clip media directly from R2, encodes the video on your computer and writes the MP4 to the location you choose. The application handles metadata requests. Account saving is a separate operation.
On the server
Account and session records
Account information, password hashes, sessions and membership references are held in application-level databases, separately from private project content.
Separate database for each project
Each saved project has its own SQLite database. Your account also has a repository database that keeps its project index and wrapped encryption keys. Clips and bill provisions are parts of a project, not separate databases.
Private content is encrypted
Private project content and retained versions use AES-256-GCM encryption. The server can decrypt that content to provide the service. This is not end-to-end encryption.
Public government records stay separate
Source databases are independent of account and project storage.
Public records and transcripts are read through a separate SQLite source service. Source videos live in media storage. Adding an excerpt to a project does not make the original record private or change the source database.
How video moves
Original viewing, clip media and your exported file follow different paths.
YouTube viewing
Watch the original meeting with its synced transcript using the YouTube player.
R2 clip media
Clip previews and browser exports read MP4 media directly from Cloudflare R2.
Encode in your browser
Your computer processes the selected clips and encodes your MP4. Keep the page open until it finishes.
Download your MP4
You control the downloaded file. Downloading does not remove any saved project or existing server output.
Server exports use a persistent job queue. Unlike a browser export, an accepted server job can continue after you close the editor. The steps below explain acceptance, waiting, processing and delivery.
When you request a server export
A request becomes queued only after the server accepts it and returns a job identity. A busy or rejected request has not entered the queue.
Submit and validate
The server checks your verified account, membership, source timing and configured job limits. Busy or rejected requests show an error or retry state; your draft remains available.
Accepted into the queue
The accepted job stores a snapshot of the requested sequence in the persistent SQLite queue. Later draft edits do not change that job. Once acceptance is confirmed, you can leave the page.
Wait for an available worker
An authorized worker claims the job when capacity and queue policy allow. Queued means accepted and waiting, not actively encoding. The interface shows job status and progress when you return.
Render the accepted snapshot
The worker validates the selected sources, reads the required media and uses FFmpeg to produce the video. This processing uses server resources rather than your browser.
Store the private result
A completed output is stored in owner-private R2 storage and associated with the job. It is separate from the public archive originals and from your editable project.
Return to history and download
Open Render history to check the result. The app checks current access before issuing a time-limited download link. Downloading creates another copy; it does not remove the saved job or output.
You can request cancellation while a job is queued or running. A running worker must receive and finish handling that request; cancellation is not an immediate recall of an already downloaded result.
If a worker stops reporting progress, the job can become interrupted. Retries are explicit, not an automatic promise of completion. Check Render history before submitting another export, especially after a connection failure where acceptance is uncertain.
Sharing is your choice
Private account save
Saved projects start private. You choose what becomes public.
Public release by link
Sharing publishes a released snapshot. Anyone with its link can read that public version, including an unlisted release.
Optional discovery and reuse
Listing an artifact makes it discoverable in Browse. Permission to make an attributed editable copy is a separate choice.
Your private working draft, its public release and other people’s copies are separate. Withdrawal cannot recall copies already downloaded or reused, and previously issued media links can remain usable until they expire.
Services involved
| Service | Purpose and information involved |
|---|---|
| YouTube | Original playback and thumbnails send requests from your browser to YouTube and its video/image services. |
| Cloudflare R2 | Delivers source MP4 media to your browser. Public archive media is separate from owner-private server-rendered outputs, which use time-limited delivery links. |
| Stripe | When billing is enabled, Preview sends your account email and billing references to Stripe. Payment details are entered on Stripe’s hosted checkout pages. |
| Cloudflare email and VPS inboxes | Verification and password-reset messages are sent through Cloudflare’s authenticated SMTP service from accounts@preview.ontologyfeed.org. Cloudflare processes the recipient address and message. Replies go to the existing admin@ontologyfeed.org inbox on our VPS mail service. Disposable tests use a private local mailbox instead. |
| Self-hosted GoatCounter | GoatCounter is the selected self-hosted public-page analytics service. Selected counts can include a referrer hostname, browser user agent and screen width, not editor draft content. The sender honors Do Not Track and Global Privacy Control. Preview requires its own provisioned site and scoped credentials; the status below describes this installation. |
GoatCounter is enabled for public-page counts and anonymous editor activity (opens, first clip additions, export outcomes and download clicks). Editor events contain only the event type and browser/server method, never artifact content or identities. Do Not Track and Global Privacy Control are honored. Delivery is best effort.
Storage and encryption details
Private project content, retained evidence and protected index projections use authenticated AES-256-GCM envelopes with wrapped keys. The SQLite files are not encrypted in their entirety: identifiers, timestamps, indexes and account records are not all covered by project-content encryption. Browser recovery copies, public releases and downloaded files are separate from that protection.
Cookies, recovery and operational logs
Better Auth manages sign-in and password verification. Session cookies keep you signed in; hosted HTTPS uses secure cookies. Signed-in browser storage can retain editing and recovery data, which is not encrypted by the server’s project-content keys.
Request throttling temporarily uses client network addresses. Built-in metrics summarize request counts, latency and traffic; application diagnostics use identifiers and statuses. Hosting proxies and external services can keep their own access logs. Log retention depends on the deployed configuration.
Use the guides for editing and export, or open Account to manage sign-in and membership.