The short version

Your media and drafts never reach us, because there is nowhere for them to go — there is no Contentbuilder server and no Contentbuilder account. Three things can leave your device, all of them optional or initiated by you, and all three are named below. This page covers the apps in §1–5 and this website in §6; they are different systems and mixing them produces claims that are true of neither.

1. Your work

Posts, media, captions, templates and hashtag groups live in a local store on your device. If you enable sync, they are mirrored through CloudKit into your own private iCloud database — your Apple account, not ours. We operate no service that receives them, so there is nothing on our side to breach, sell or be compelled to hand over.

2. Your social accounts

There is no login for Instagram, TikTok, Facebook, X, Snapchat or WhatsApp anywhere in the app, and no access token for any of them is requested or stored. Publishing copies your caption, saves your media, and opens the platform's own app — you paste and post. The app cannot post on your behalf, which is a limitation and a guarantee at the same time.

3. The AI

Automatic captions use Apple's speech recognition with on-device recognition explicitly required, and the code checks the device supports it before starting. There is no cloud path, so there is nothing to fall back to: a device that cannot do it reports the feature unavailable. Silence removal is audio analysis on the file itself. AI overlay text uses Apple Intelligence on-device, with a set of offline suggestions when the model is unavailable.

4. What does leave your device

Three things, and only these three. Each is either optional or something you started:

Spotify, if you connect it. Choosing a sound from Spotify signs you in through Spotify's own login page (OAuth with PKCE, no app secret). The resulting access and refresh token are stored in your device's Keychain and used to search Spotify's catalogue from your device. They never reach us; disconnecting deletes them.
A preview clip lookup. Spotify no longer serves preview audio, so the playable 30-second clip is found through Apple's public iTunes Search endpoint. That request carries the track and artist name and nothing about you.
The platform you are posting to. Finishing a hand-off opens that network's app or website. That is an ordinary link you chose to follow, and from that point their privacy policy applies, not ours.

On macOS there is a fourth, and it is off unless you switch it on: the subscription endpoint in Settings ▸ Subscription. It ships pointing at http://localhost:8090, which is nowhere. Once you fill in an endpoint and a billing email, the app asks it which plans exist and looks your subscription up by that email address, which travels in the request.

5. What we do not have

No analytics SDK, in either app. No crash reporting, no telemetry, no feature flags, no A/B tests.
No Contentbuilder account, and no password of yours anywhere.
No server holding your projects.
No registered company, no Chamber of Commerce number, no VAT number. One developer.
No App Store listing yet, and therefore no price, no reviews and no install base to quote.

6. This website

A different system, with different facts. It is a server-rendered site on hardware we control, with no third-party scripts, no fonts fetched from a CDN and no analytics.

The early-access form. Your email address, and a salted SHA-256 hash of your IP address kept as proof of consent — the hash, not the address. Every mail carries a one-click unsubscribe, and the unsubscribe page answers the same way for an address that was never on the list as for one that was, so it cannot be used to check whether someone signed up.
Server logs. Ordinary request logs for debugging and abuse handling, on hardware we control, shared with no one.
Response headers. HSTS, a Content-Security-Policy that allows no external origin at all, frame-ancestors 'none', nosniff, a strict referrer policy and a Permissions-Policy that denies camera, microphone, geolocation, payment and USB. You can check every one of these yourself in your browser's network panel.

Where this could be wrong

This page is written from the source at a point in time, and code moves. If you find something here that no longer matches the app, that is a bug in this page and worth telling me about — support reaches one person. The privacy policy is the binding document; where the two disagree, it wins.