Privacy policy

What FirstLook does

Originators create an account, upload a video announcement, and share a private link. Recipients open that link and may record a video or text reaction without creating an account. Originators can buy prepaid credits for extra video reactions; there is no subscription.

Information we collect

What we don’t collect

We don’t sell reaction videos or recipient data, we don’t use your content to train AI models, and we don’t use advertising or third-party tracking cookies. We don’t ask recipients for an account, password, or payment details. We never store full card numbers — payments go through Stripe.

Account data (originators)

When you sign up we store your email, password hash, optional display name, notification preferences, credit balance, and related account flags. If you verify a phone number we store it in E.164 form and a verification timestamp. We also keep a record of which Terms and Privacy versions you accepted at signup.

Videos, messages, and reaction metadata

We store announcement videos, reaction videos and text, thumbnails, optional names recipients provide, consent wording and timestamps for recordings, and (when face detection runs) face-position coordinates used only for reel cropping — see Face detection below.

Product analytics

We record first-party view and poll events (for example unique views on a shared link) so originators can see engagement on their moment. Those events are tied to a random device cookie, not to a name or email.

Payments

If you buy credits, Stripe processes the payment. We store Stripe customer and purchase records (amount, quantity, status) so we can grant credits and handle support. We never see or store your full card number.

Push notifications

If you turn notifications on, we store a browser push subscription endpoint and, on the mobile app, a device push token.

Marketing forms

If you join a waitlist or submit a partner inquiry, we store the email and any details you send so we can respond.

Security and reliability logs

Our servers keep short-lived access logs for security and debugging. When error tracking is enabled, crash reports may include technical details such as browser or device info and approximate IP — not your video content.

How we use information

We use this data to run FirstLook: host and deliver your announcements and reactions, generate reels you request, count unique views and poll votes, process credit purchases, send transactional email and optional push alerts, prevent abuse, and comply with law. We do not use your videos, messages, or account content to train AI models.

Who can see a reaction video

By default, a reaction video is only viewable by the person who sent the invitation (the “originator”). It is not public, not searchable, and not visible to other people on the platform.

The originator can choose to share a reaction afterward — including publishing it on a public celebration page for that moment. That page is only reachable by its link, but anyone with the link can open it without an account. Nothing is published on FirstLook unless the originator turns it on for that specific reaction. Recipients agree to this when they consent to being recorded. If your reaction has been published and you want it taken down, email contact@mail.firstlook.cloud and we will remove it.

How videos are protected

Videos are uploaded directly to encrypted cloud storage over an encrypted connection (HTTPS), and are encrypted at rest. Access to a stored video requires a signed, time-limited link that only the originator’s account can generate. Account passwords are hashed; we never store them in plain text.

Face detection

We use an automated tool that runs on our servers to find where a face sits in the frame of a reaction video, so reaction reels can be cropped without cutting people’s heads off. It measures a position in the frame (and a confidence score). It does not identify or recognize anyone — it is not facial recognition.

Those coordinates are stored with the reaction so we can crop reels later. They are deleted when the reaction is deleted. We do not use them for identification, advertising, or model training.

Cookies

We use first-party cookies only as needed to run the product — for example to keep you signed in, to avoid double-counting views or poll votes on a shared link, and for basic security on forms. We don’t use advertising or third-party tracking cookies. You can clear cookies in your browser settings; doing so may sign you out or reset unique-view counting.

Notifications

If you turn on push notifications in your account settings, we store a push subscription endpoint (and, when you use the mobile app, a device push token) so we can deliver alerts such as new reactions. Notifications are off until you enable them, and you can turn them off anytime in settings.

How long we keep things

• Announcements, reactions, videos, face-position data, and recording-consent records — kept while the originator’s account (and that content) exists; deleted when you delete the announcement, reaction, or account.
• Account data — until you delete the account; then removed with it.
• Purchase records — retained as needed for accounting, fraud prevention, and legal compliance.
• View / poll events — retained for product analytics while the related moment exists or until purged with it.
• Server access logs — typically about 30 days for security and debugging.
• Waitlist / partner leads — until you ask us to delete them or we no longer need them to follow up.

Your rights over your data

If you have an account: you can delete an individual announcement, an individual reaction, or your entire account at any time from your dashboard settings, which permanently removes the stored videos. You can also email contact@mail.firstlook.cloud to ask for a copy of the data we hold about you, or to correct it.

If you recorded a reaction and never signed up: you can delete your own recording yourself. On the page where you recorded, once your video finishes sending, there’s a “Delete my recording” link that removes the video, its thumbnail, and the row we stored — no account and no email needed. That link works from the same browser you recorded in; clearing your site data or switching devices loses it.

If you no longer have that link, email contact@mail.firstlook.cloud from any address, tell us roughly when you recorded it and whose announcement it was (the name of the person who sent you the link is enough), and we’ll find it and delete it. You can also just ask the person who sent you the link — they can delete it themselves from their dashboard.

We aim to answer these requests within 30 days.

Children

FirstLook accounts are for users 13+ (or 16+ in the EEA where that higher age applies). The product is not directed at children under those ages. Anyone recording a reaction is asked to confirm they are 18+ or that a parent or guardian is present and agreeing on their behalf. If you believe we have collected data from a child without required consent, email contact@mail.firstlook.cloud and we will delete it.

Service providers

We don’t run everything ourselves. To deliver the service we share the minimum necessary data with trusted providers acting only on our instructions, in these categories:

• Cloud storage & hosting — stores your videos and runs the app.
• Payments — processes card payments; we never see or store your full card number.
• Email delivery — password resets, receipts, and notifications.
• SMS one-time codes — phone verification.
• Bot protection — sign-up and waitlist forms.
• Push notifications — delivers alerts when you’ve enabled them.
• Error monitoring — crash reports when enabled (technical details only, not video content).

We don’t list provider names here. Email contact@mail.firstlook.cloud if you want the current list.

International transfers

FirstLook is operated from the United States. If you use the service from elsewhere, your information may be processed in the U.S. and other countries where our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or provider compliance programs. Data may also transit other regions as part of normal internet routing.

Legal basis & regional rights

If you’re in the EEA or UK, we process your data to provide the service you asked for (performing our agreement with you), to record reactions with your consent, and to keep the service secure and working (our legitimate interests). You can withdraw consent, or ask us to access, correct, delete, restrict, or port your data, or object to certain processing — see the section above or email contact@mail.firstlook.cloud. You may also lodge a complaint with your local supervisory authority.

If you’re in California, you have the right to know what we collect, to request deletion and correction, and to opt out of the sale or sharing of your information. We don’t sell or share your personal information for cross-context behavioral advertising, so there’s nothing to opt out of — but you can still exercise the other rights by emailing contact@mail.firstlook.cloud. We won’t discriminate against you for doing so.

Changes

We may update this Privacy policy from time to time. Material changes will be posted here with a new “Last updated” date. Continued use of FirstLook after changes are posted means you accept the revised policy. For significant changes we may also notify account holders by email or in-product notice when practical.

Contact

Questions about this policy, privacy requests, or anything else? Email contact@mail.firstlook.cloud. We aim to respond within 30 days.