privacy at oraku

01Who we are

Oraku is a studio for making short AI videos from a photo or a few words. It is made by Joyolabs Inc ("we", "us"). This policy covers Oraku at oraku.com: what we collect, why, who helps us run it, and the choices you have.

02What we get from Google

You sign in to Oraku with your Google account, or with your e-mail address and a link we mail to it. If you sign in with a link, we get only your e-mail address. If you use Google, Google shares three things with us, and we use each of them only to know which account is yours and to show you who is signed in, and your name also to make your user name:

• Your name, shown next to your account in the app.
• Your e-mail address, which identifies your account and tells us whether you are on the list of people who may use Oraku while it opens to a small group. We also give it to our payment processor when you buy, and use it to answer you when you write to us. We also use it to keep each person to one account: addresses that reach the same inbox count as one, and we turn away throwaway addresses.
• Your profile picture, shown next to your account in the app.

We do not ask Google for anything else: not your contacts, your files, your calendar or your mail. We do not sell what Google shares with us, use it for advertising, or use it to train AI models. Oraku's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

If we turn a sign-in away, for example while Oraku is not open to you yet, our sign-in service still keeps a record of your e-mail address from that try, and your name and picture if you used Google. Our own logs keep the sign-in service's id for you and the part of your e-mail address after the @.

03What you give us

• Your prompts: the words you type to describe a video.
• Pictures and videos you upload to guide a video.
• The videos Oraku makes for you.
• A user name. Every account is given one when it signs in, made from your first name, or from a random word when we cannot use your name. It is public: it is shown on the templates you publish, on the creators board and in your invite link, so the people who see those can see it.
• Clips you publish as templates, if you choose to. Once we approve one, everyone on Oraku can see the clip, the video it was made from, its prompt and your user name.
• Your answers to a few questions when you first sign in, such as what you want to make and how you heard about us.

We use these to make your videos, to keep them in your library so you can watch and download them, and to make Oraku better.

04What we record as you use Oraku

• Each video you make: the prompt, the settings you chose, when it ran, and whether it worked.
• Your credits: what you bought, what each video used, and any refunds.
• Your yes to our upload rules: the day you agreed and which version of the rules it was.
• Server logs: each request to our servers, with its time, the address it came from (your IP address) and your browser type. Our own log lines name your account by an id, not by your name or e-mail address.
• Usage events: which pages you open and which buttons you press, such as Generate, the address they came from (your IP address) and your browser and device type. When you are signed in they carry your account's id, never your name or e-mail address. Our server also sends one event when you make an account and one each time you pay, with what you bought and its price, by your account's id. If an ad brought you to Oraku, the sign-up event also carries that ad's campaign tags, so we can tell which ads work.
• Session recordings: a recording of how you use our pages: what the screen shows, where you click and scroll, and the page's console messages, so we can find what goes wrong and fix it. Anything you type, such as a prompt or your e-mail address, is hidden before it leaves your browser. When you are signed in, a recording carries your account's id. We keep recordings for 30 days.

05Trying Oraku without an account

On our try page you can see Oraku work before you have an account: you upload one photo of yourself (a selfie), and Oraku makes four short videos from it. To run that, we keep a few things even though you are not signed in:

• Your selfie and the four videos. They live in our private file storage, like every upload. Nothing on the open web links to them: only your browser can open them, through the try cookie described under Cookies.
• Your network address (your IP address), kept with that try. The try page makes one set of free videos per connection a day, and the address is how we count that.

If you do not sign up, the selfie and its videos are deleted after 7 days. If you sign up from the try page, they join your account and your library and stay like everything else you make; asking us to delete your data (below) removes them too.

06Payments

When you buy credits or a plan, you pay on a page run by our payment processor. Your card details go to the processor, not to us: we never see or store your card number. We keep what you bought, the price and currency, and the processor's reference numbers for the payment and for you as a customer.

07Who helps us run Oraku

Other companies run parts of Oraku for us. Each gets only what it needs for its job:

• Cloud hosting runs our servers and database and keeps our server logs.
• Sign-in checks your Google account or your e-mail link, and keeps the sign-in record described above.
• E-mail sends the sign-in links you ask for.
• Bot check (Cloudflare Turnstile) checks that a request for a sign-in link, or an upload on the try page, comes from a person and not a program. It runs small checks in your browser and sees your network address and browser details, not what you type. Cloudflare's Turnstile privacy addendum says what it keeps.
• File storage keeps the pictures and videos you upload and the videos made for you.
• Video generation receives your prompt and the pictures and videos you add, makes the video and sends it back to us.
• Prompt writing, when you use a template, receives the template, your pictures and your prompt, and an AI model writes the instructions for the video from them.
• Payments takes your payment, as described above.
• Logs and monitoring receive our server logs so we can spot errors and keep Oraku working.
• Analytics (PostHog, a US service) receives the usage events and session recordings described above.
• Consent (Cookiebot, a Usercentrics service) shows the cookie dialog and keeps a record of your choice.
• Advertising measurement (Google, and the other tools named in the cookie declaration) receives page views and the steps described above, through Google Tag Manager, so we can tell which ads work. Where your consent is required, nothing is sent until you give it.

We do not sell your personal data. Apart from these providers, we share it only when the law requires it, to protect someone's safety, or if Joyolabs Inc or Oraku becomes part of another company.

08Cookies

Oraku sets a few cookies of its own, and measurement tools set theirs as described below. The cookie declaration on this page lists each cookie, and "Cookie settings" in the footer reopens your choices at any time. Each cookie, set only in the case described:

• Sign-in: keeps you signed in, for up to 5 days.
• Theme: remembers whether you picked the light or the dark look, for up to a year, if you change it.
• Invite: if you arrive from someone's invite link, remembers who invited you, for up to 30 days.
• Consent: the cookie dialog (Cookiebot) remembers your cookie choices, for up to a year.
• Attribution: if an ad or a tagged link brought you here, remembers which one, for up to 30 days, so we can connect a sign-up to the ad that led to it. When you ask for a sign-in link, the link in the e-mail carries the same information (the ad's campaign tags and click id), so a sign-in you finish in another browser is still connected to that ad. Not set in the European Economic Area.
• Device: a random id so a test of a page shows you the same version before and after you sign in. One year. In the EEA only with your consent.
• Try: on the try page, a random id that connects your browser to the selfie you upload and the videos made from it, for up to 7 days. Signing up links them to your account.

Our own analytics (PostHog) sets no cookie. It keeps an id and your current visit in your browser's storage (local storage, and session storage for the open tab), so we can count visits and sessions. The id is anonymous until you sign in, then it is your account's id. When you sign out, it forgets them and starts a new anonymous id. In the European Economic Area it stays off until you allow statistics in the cookie dialog, and declining turns it off.

Advertising and analytics cookies (Google, and the other tools named in the cookie declaration) are set through Google Tag Manager. In the European Economic Area they are set only after you say yes in the cookie dialog; elsewhere you can turn them off at any time through "Cookie settings".

While you sign in or pay, your browser also keeps the prompt you were writing in that tab, so it is still there when you come back. It is gone when you close the tab. When you ask for a sign-in link, your browser keeps the e-mail address you typed (in local storage) until the link signs you in.

09How long we keep it

We keep your account, your prompts, your pictures, your videos and your credit records until you ask us to delete them. We may keep payment records for longer when the law requires it.

10A copy, or deletion

To get a copy of your data, to fix something in it, or to have it deleted, write to support@oraku.com from the e-mail address you sign in with. Deleting your data closes your account, and its videos and credits are lost.

11Children

Oraku is only for people 18 or older. We do not knowingly collect data from anyone younger. If you believe someone under 18 has given us data, write to us and we will delete it.

12Changes to this policy

If we change this policy, we will post the new version on this page and change the date at the top.

13Contact

Joyolabs Inc
support@oraku.com

14Cookie declaration