Last updated: 9 September 2026
The short version: Biboka is built to know as little about you as possible, everything it does store is scoped to what you explicitly save or share, and you can permanently delete all of it yourself, at any time, in one tap, no email to us, no waiting.
The business named in the contact block at the end of this page is the data controller for the personal data described below. For any privacy request or question, write to support@biboka.app. We respond to access, correction, deletion and objection requests within one month, as required by Article 12 GDPR.
By default, your scripts, cast and settings live only in your own browser and never reach our servers. The moment you tap Save or Share, the script text, character and contact names, and any photos you uploaded are stored on our server so the link works for whoever opens it, and so you can find the project again. An uploaded photo is resized to at most 250 by 250 pixels and compressed before upload, and nothing else in the photo, such as metadata or location, is kept beyond that resized copy. Saving also stores one still picture of the project as it looks on screen, so the project has a cover you can recognise in your list. If you put a video underneath, that still contains one frame of your video. The video file itself is never uploaded, and that cover picture is the only part of it that reaches our server. The cover is stored at an address built from the same random link code as the project, so it is reachable by anyone holding that exact address and by nobody else. A short link's content is readable by anyone who has the exact link. Links are not listed, searchable or discoverable, but they are not private in the way a password protected file is. Separately from anything you save, when the homepage wizard reads a clip or asks you a question we keep an anonymous research note: one short sentence about the scene, such as "kitchen, one person, handheld", and the answers you typed. Those notes are scrubbed of names and personal detail before they are written, and they carry no account, no session, no IP address and nothing else that points back at you. We use them to understand what people are making, never to build a profile of anyone.
A share link you create but never save to an account is automatically and permanently deleted after 90 days. A project you save to My Projects, with or without a Google account, is kept until you delete it or delete your account. We do not otherwise cap this, because it is content you have told us you want kept. Deleting a project, or your account, removes the underlying content immediately, not just its listing. If you sign in, you can also keep video and images you upload in cloud storage, so a project follows you to another device. On the free plan that storage is capped and each file is deleted automatically 30 days after you upload it; the current cap and window are shown on the pricing page and on your account. On a paid plan the cap is higher and files are kept until you delete them or delete your account. Where we have removed something following a report, we keep a minimal record of the report and our decision for as long as we need it to answer a regulator or a complaint.
Every visitor gets an anonymous, unnamed session automatically so Save and Share work with no signup. You can sign in with Google, or with a six digit code sent to your email address, and Sign in with Apple is planned. If you sign in with Google, that Google identity, meaning your name, email and profile photo, is linked to your existing anonymous session. If you sign in by email, only your email address is so your existing and future projects sync across your devices, and we show you what this means the first time you do it. We never post, message or share anything on your behalf, and we do not request any Google permission beyond basic profile and email. If you tick the box on the sign-in card, we may email you about the product, no more than once a month; we never sell or share your address, and you can turn this off at any time.
Two different things can leave your browser, and each only when you use the feature that needs it. First, text: when you use a feature that suggests or writes text for you, the text you typed for that request is sent to the AI provider named in section 8, which generates the draft and returns it. Second, your video clip: if you add a clip on the homepage so the app can suggest ideas from it, your browser takes up to five still frames from it, each no more than 768 pixels on its longest edge, and sends those frames to Google's Gemini API, which describes the scene and returns suggestions. When the optional audio feature is switched on, up to 30 seconds of the clip's sound is sent with them. If that call fails, the same frames are sent to OpenAI's vision API instead. The video file itself is never uploaded: it stays in your browser and in your own device's storage. We do not keep the frames or the audio after the answer comes back. In every case we send only what that request needs, never your saved projects or your account details, and we use paid API plans specifically so that our providers are not permitted to train their models on what we send. We keep a count of how many requests you have made, so that daily limits work. If you would rather nothing leaves your browser, do not add a clip and do not use the suggestion features. Everything else in the studio works without them.
Under GDPR you have the right to access, correct, export, restrict or delete your personal data, and to object to processing. Most of this is self service: open Settings, then "Delete my data", to permanently and immediately erase your account, every saved project's content, and every uploaded photo. This also invalidates any share links to those projects. For anything the interface does not cover, such as a copy of your data, write to support@biboka.app and we will respond within one month.
We use PostHog, configured to be as minimal as we can make it: no cookies, device local storage only, no cross site tracking, no automatic click or keystroke capture, only a small number of explicit product events such as "exported a video", and anonymous visitors are never assigned a tracked profile. We do record sessions, meaning a replay of what appears on your screen inside the app, so we can see where people get stuck. Every text box is masked, so nothing you type into a form is captured. The canvas is not a form, so the chat you compose, and the video showing behind it, do appear in that replay exactly as they appear on your screen. If you are signed in, your email address is attached to your analytics profile so we can connect a problem you report to what happened on screen. Analytics traffic is routed through our own domain rather than PostHog's directly, and the data is used only to understand and improve this service. We never share it with anyone for advertising or profiling. Storing anything on your device needs your agreement, so you can turn this off entirely in Settings, then Privacy, at any time. Turning it off takes effect immediately and does not affect anything else in the app.
We use a small number of providers to run the Service, each acting as our processor under a data processing agreement: Supabase for the database, file storage and authentication, Vercel for hosting, PostHog for product analytics as described above, Google for optional sign in and, separately, for the clip reading described in section 5 through its Gemini API, OpenAI for the text suggestion features and as the fallback for clip reading, DeepSeek as an alternative text provider, Cloudflare for the storage of any video or images you choose to keep in the cloud, and Polar for payments, which as merchant of record handles your billing details and tax. This list is the complete set of AI providers the Service can send anything to, and we update it here before a new one is switched on, never afterwards. We never see or store your card number. We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
Our providers may process data outside the UK and the EEA, for example in the United States, which is where the frames of any clip you add are read. Where that happens it is covered by Standard Contractual Clauses, the UK international data transfer addendum, or an equivalent safeguard under GDPR Chapter V, provided by that processor. DeepSeek, listed in section 8, processes in China, which has no UK adequacy decision; where a transfer of that kind is used we rely on Standard Contractual Clauses with the UK addendum and a transfer risk assessment, and only text you typed for that request is ever sent.
The site is served by our hosting provider, which processes standard technical data such as IP addresses in server logs, to deliver the site, apply rate limits and protect it against abuse.
The Service is not intended for children. You must be at least 13 to use it in the United Kingdom, and at least 16 in the European Union unless the law of your country sets a lower age and a parent or guardian agrees. We do not knowingly collect personal data from anyone below that age, and if we learn that we have, we delete it.
To exercise a right not covered by Settings, or for any other question about your data, write to support@biboka.app. If you believe we have not resolved your request properly, you have the right to complain to your local data protection authority. In the United Kingdom that is the Information Commissioner's Office at ico.org.uk.
BIBOKA LTD
Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
To report content, see Report content.