Privacy notice

FIRSTTAKE PRIVACY NOTICE

FirstTake runs on your Mac. Dilhan Geeth Amarasinghe, trading as FirstTake
("we"), runs no servers that receive your projects, prompts or media. The
app shares usage analytics only if you choose to help improve FirstTake
(see "Optional studio analytics"). The website measures page visits,
navigation and purchase steps (see "The website").

What stays on your Mac
Each project is a file saved where you choose. The app's settings and its
list of recent projects are kept in the FirstTake folder in your home
folder. Your provider API keys and your licence are stored encrypted with
your Mac's Keychain.

What goes to the providers you choose
When you generate video, stills, speech or use the director, FirstTake sends
your prompts, the reference images you attach and dialogue text to the
provider you selected (fal.ai, OpenRouter or Higgsfield), using your own
account. Those providers process that data under their own privacy
policies.

Licence checks
When you activate, check or deactivate a licence, FirstTake sends your
licence key and its activation ID to Dodo Payments (and your Mac's name
when activating), which sells FirstTake as
merchant of record and handles your purchase details under its privacy
policy. A licensed copy rechecks its key daily during the refund period,
then about once a week.

Updates
FirstTake checks firsttake.video for new versions, which sees your IP
address and the app version, as any download does.

Optional studio analytics
FirstTake asks whether you want to share usage data to help us find confusing
steps, improve performance and fix problems. Nothing is collected or sent for
this purpose until you choose "Share usage data". Choosing "Don't share"
does not affect any studio feature. You can change your choice in
Settings > General > Privacy.

With permission, the app sends OnRamp events through firsttake.video for app
launches, visits to fixed app screens (such as Scenes, Assets and Settings),
provider setup, project creation and opening, agent-message requests,
scene editing, generation and export attempts. Events record a fixed action
category, whether it started, completed, failed or was cancelled, elapsed time,
the app version and a limited error category. A random installation identifier
lets us measure return visits; a random session identifier groups activity
within one launch. These identifiers are not linked to your email, licence,
payment or website identity. The installation identifier and your choice are
saved in the app's own settings folder.

We do not include prompts, project names or contents, media, file paths,
API keys, licence keys, raw error messages or crash dumps. Our website host
sees your IP address as part of receiving a request and may keep standard
access logs. The app does not send your IP address as an analytics property.
Turning sharing off stops future events, cancels pending requests and deletes
the local analytics identifier. It does not delete events already received.
Enabling it again creates a new identifier. Unsent events are not saved or
replayed later.

The website
firsttake.video uses OnRamp (getonramp.dev) to measure page visits, scroll
depth, section and navigation clicks, and Buy clicks. The web SDK sets no
cookies and stores no analytics identifiers in your browser. OnRamp derives
a daily pseudonymous visitor identifier from the request and groups activity
into short-lived sessions. Requests include the page path, browser and device
information, and may include a referring page or campaign parameters. We do
not send names, email addresses, licence keys or payment details from the
browser.

Like any website, its host may keep standard access logs (such as IP
addresses) for security and reliability. The Buy button opens Dodo Payments's
checkout, which handles your purchase under its own privacy policy.
We use SendPanda (sendpanda.email) to send purchase welcome, licence-key and
refund emails. For licence delivery, our server verifies Dodo's webhook,
checks the associated payment, and sends your email address and licence key
to SendPanda to deliver the message. The key is not included in analytics.

To see how many people who start a checkout complete it, our server sends
OnRamp two additional events: that a checkout was started and that a payment
succeeded. Each checkout gets a random identifier, passed through Dodo's
checkout metadata, to connect those events and match Dodo revenue records.
After verifying Dodo's payment webhook signature, our server also sends an
identity event with the buyer's email address and stable Dodo customer ID.
This associates the checkout activity with the billing customer for revenue
matching. We do not send names, licence keys, card details or IP addresses
in these server events. Anonymous browser activity uses separate identifiers;
we do not send the browser's placeholder IDs to Dodo. Studio usage data is
controlled separately by the app's optional analytics choice.

Advertising measurement
If you choose "Accept optional cookies" on the website, we load Google's tag to
measure purchases from our Google and YouTube ads. Until you opt in, we do
not load that tag or send advertising measurement data to Google. You can
decline or withdraw permission using "Cookie settings" on the website. We honour
Global Privacy Control by keeping advertising measurement off.

With permission, Google may use advertising cookies (such as _gcl_aw) to
connect an ad click with a purchase. Google receives browser and device
information, IP address, the page address and ad campaign identifiers, and,
for a payment verified with Dodo, its transaction ID, actual amount and
currency. We do not send Google your email, name, licence key, card details,
projects or prompts. We disable personalised advertising signals and do not
enable enhanced conversions. Google's privacy policy is at
https://policies.google.com/privacy and cookie information is at
https://business.safety.google/adscookies/.

We remember your permission choice in a first-party cookie for six months.
For consenting visitors who start checkout, an HttpOnly first-party cookie
and a random checkout metadata value let our server verify that a returning
payment belongs to that browser. This binding lasts up to 30 days; a receipt
reference cookie lasts one hour. These are used for advertising measurement
only while you have given permission. Google's conversion cookies normally
last up to 90 days. Declining removes Google's first-party measurement
cookies on our website and stops future advertising measurement.

Contact
Questions: support@firsttake.video