Last updated: 2026-09-23 · v2.0 (replaces v1.0 of 2026-06-17, which described a studio that ran locally) · 2026-09-23: added the prompt check (TypeSafe AI)
Plain-English summary
Nixie.Studio is a hosted studio. It runs on a server the founder operates
(on Fly.io), and what you make in it — your prompts, generations, productions,
songs, costs and profile — is stored on that server, not on your machine. This
notice says what is stored, who can see it, which outside services touch it, and
how to get it corrected or deleted. It describes what is true today.
What we store on the studio's server
- Your account. Your sign-in name (usually an email address), display name,
role, team, and whether the account is enabled — kept in the studio's member
roster, which the founder manages.
- Your profile. What you enter on your profile page: display name,
city / region / country, social links, avatar, and your email preferences.
- Your provider keys. If you add your own provider keys on the Profile
keychain (fal, kie, Luma, CometAPI, OpenAI, Anthropic, Higgsfield, YouTube),
they are written to the server's disk in plain form. The studio does not
encrypt them itself; they are readable by the founder, who operates the server.
The keychain page shows you only the last characters. The keychain file is saved
with up to 24 rotated backup copies, so a key you remove can persist in a backup on
the server's disk for a time. If you would rather not
hold a key on the server, the founder can set you up on a studio allowance
instead.
- Nixie API keys. A key you mint for an outside tool (an MCP client, a
script) is shown to you once and stored only as a hash. If you connect an outside
tool through the studio's OAuth flow instead, the studio stores that tool's
registration and a hashed refresh token so it can act as you until you revoke
it.
- Your work. Every generation's prompt, settings, model, cost and output
file; your productions (intake, briefs, shot books, storyboards, renders); the
songs you upload or fetch; your Cadence interview transcripts; and a per-member
ledger of what each render cost.
- Activity. The days you were active (used for the newcomer window and
the leaderboard), and a per-request line in the server's log — your sign-in
name, the method and the path — which the founder reads in the hosting
provider's log stream to see when members are active. The log also records failed
sign-in attempts (the name tried), Google sign-ins from an account not on the
roster (that email address), and when a Nixie API key is created or revoked.
- Sign-in alerts. When the founder has mail configured, the first request
your browser makes after four quiet hours, or after the server restarts (the founder
can change that window; it counts whether or not you signed in again) makes the server email the
founder your sign-in name, display name, IP address, browser user-agent
string, the time and the first path you requested.
- Page-error reports. If a studio page hits a script error, the browser
reports it to the server, which appends the report with your sign-in name (or
"anonymous") and IP address to an error log.
- Anonymous device pings. Once per browser session the studio home
records viewport and screen size, pixel ratio, browser user-agent string, page,
locale, studio version and density mode — with no sign-in name and no IP
address — into a log file on the server. The first time you open the studio
home, a notice offers Opt out; the opt-out is kept in your browser and
no ping leaves it afterwards. See Telemetry.
- Deleted records. A record you delete goes to Trash for 48 hours (the
founder can change that window), where you can restore or purge it; after that
it is removed. Purge is permanent.
Who can see your work
- Other members. Catalog records are visible to every signed-in member
unless they are marked private or as depicting a real person; those stay
between you and the founder. Productions are visible to their owner, the owner's
teammates, and the founder and curator. Elements are visible to every member
unless set private; logos and fonts default to private, every other element
type defaults to cooperative. The Community page shows every member's display
name, role, contribution count and last-seen date, and their portrait, city /
region / country, bio and time zone only when that member's own privacy toggles
allow it (region and city are off unless you turn them on); the member directory
it reads also carries each member's sign-in name (email address) and join date.
- The founder. As the server's operator, the founder can see everything
stored on it, including the logs above and your provider keys.
- Anyone with an unlisted link. If you share a production, the studio
mints an unlisted page at
/share/… that needs no sign-in. Anyone
holding that link can view it; it is marked not-for-search-engines. You can
turn sharing off on the production.
- The public. Nothing else is public. The signed-in studio is behind a
session; the pages that need no sign-in are the landing, the sign-in and
signed-out pages, this notice, the terms, the contribution warranty, the mission
page (the founder's dated essays), the API documentation and workbench, the site files for crawlers (robots, sitemap,
llms.txt), the brand art, the developer endpoints (the MCP endpoint and the
OAuth flow), the studio's liveness check (version and uptime) and the
concierge's first name; none of these shows member data.
Sessions and sign-in
Signing in sets one cookie, nixie_session, for 30 days. It is
HTTP-only, same-site, and sent only over HTTPS on the hosted studio. Sign out
clears the cookie from your browser; the server cannot end a session early today,
so a copy of the cookie stays valid until it expires (disabling the account does
end it). If you sign in with Google, the studio reads only your
email address (and that Google has verified it) from Google's sign-in response,
matches it against the member roster, and keeps no Google token.
Outside services that process your data
The studio sends data to an outside service only when you use the feature that
needs it:
- Hosting. The server and its disk run on Fly.io. Your generation
outputs, uploads, thumbnails and their metadata sidecars (prompt, settings,
provenance) are stored in Cloudflare R2 object storage, and a nightly backup of
the studio's state (catalog index, productions, member roster, profiles,
elements, kits — never provider keys) is copied there too.
- Generation providers. When you generate with your own key, your
prompt and inputs (images, audio, reference elements) go to that provider under
your own account and their terms — fal.ai, kie.ai, Luma, CometAPI, OpenAI,
Anthropic, Higgsfield. Images you upload as generation inputs are staged in the
studio's R2 storage under a time-limited link for the provider to fetch; if
that fails the studio falls back to public image hosts (imgbb, catbox). When you
generate on the studio's shared key or a studio
allowance, they go to the same providers under the founder's account. A member
on a team who holds no key of their own generates on their team leader's key:
the prompt and inputs go out under the leader's provider account, which is
billed for it.
- Prompt check. After a shot book is written or a video brief arrives, the text of
each shot's prompts (the picture prompt, the motion prompt and its lyric or narration line)
is sent to TypeSafe AI under the studio's account to check it against the studio's prompt
rules. Only text goes; no images, audio or keys. TypeSafe states it does not train models
on it; it keeps it under its own retention policy.
- Cadence. The studio's interview and help assistant runs on a language
model provider (Anthropic, or OpenAI when the founder configures it); what you
type in that conversation is sent to it.
- Suno. If you paste a Suno share link, the studio fetches that page
and its song on your behalf.
- Google. Sign-in (above) and, if you use it, posting to YouTube (below).
- Script and font hosts. The Help and Mission pages, and the help drawer
on every studio page when you open it, load a markdown renderer from
cdnjs.cloudflare.com, and the Productions page loads
web fonts from Google Fonts; like any web request, those hosts see your
browser's address and user-agent string. Opening a production's shot book loads a page-flip script from
jsdelivr.net; the Community map data is fetched once by the server
from the same host and cached, so your browser does not contact it for that. No analytics or advertising trackers are loaded.
Posting to YouTube (Google user data)
The studio includes an optional “Post to YouTube” feature that lets
a signed-in member upload one of their own finished video renders directly to
their own YouTube channel. This is the only feature that touches Google user
data beyond sign-in, and it does so under a strict per-upload model.
- Scope. We request only
https://www.googleapis.com/auth/youtube.upload — permission
to upload a video to the member’s channel. We request no read access and
no other YouTube or Google data.
- Per-upload consent. Every post opens its own Google consent window.
Authorization is granted for one upload at a time; there is no persistent
connection to your Google account.
- No credentials stored. The short-lived access token Google returns
lives only in the server’s memory for the few minutes the upload takes and
is discarded the moment it finishes. We do not store access tokens or refresh
tokens, and we never write any Google credential to disk.
- What is sent to YouTube. Only the video file the member selected and
the title, description, tags, and visibility they entered — uploaded to
their own channel via the YouTube Data API.
- Revoking access. Members can revoke the studio’s access at any
time from their Google Account security settings; the next post simply prompts
for consent again.
Limited Use. Nixie.Studio’s use of information received from Google
APIs adheres to the
Google
API Services User Data Policy, including its Limited Use requirements. Data
obtained through the youtube.upload scope is used solely to perform
the upload the member explicitly requested; it is never transferred or sold to
third parties, never used for advertising, and never used for any purpose other
than completing that upload.
Email and communications
The studio does not yet send the preference-category emails below. It does send
transactional mail when the founder has mail configured: team invitations to the
address invited (with a one-time password), release requests on media you own and
the answer back to the requester, a question you send the founder from the publish
flow or an @founder note in a Cadence interview (your name and what you wrote),
progress mail to the founder on a film run through the pipeline, and the sign-in
alerts described above. Your profile
already holds the preferences for the categories when they land: transactional notices (outcomes on your own submissions,
account/security notices) are always sent; cooperative updates, curator
notifications and publication activity default on and can be turned off;
marketing is off unless you turn it on. Every cooperative email will carry a
one-click unsubscribe link.
Cookies and browser storage
The studio sets the session cookie above and, during a Google sign-in, a
short-lived state cookie. It sets no third-party tracking cookies. Your browser
keeps a few preferences locally (interface language, whether you have seen the
welcome, dismissed notices, the density mode, the telemetry opt-out); these never
leave your browser, except that the anonymous device ping above carries the
interface language and the density mode.
Your rights
- Access. Your profile, your catalog, your productions and your ledger
are visible to you in the studio.
- Correct. Edit your profile anytime; edit or regenerate your work.
- Delete. Delete any catalog record yourself (Trash, then purge). Remove
a provider key from your keychain anytime. To delete your account and
everything stored under it, email the founder
(taburley@gmail.com);
honored within 30 days.
- Portability. Download your assets from the Catalog (per item or in a
batch); a full export can be provided on request.
- Withdraw consent. Opt out of the device pings from the notice on the
studio home; turn off any email category on your profile.
EU/EEA and UK members have the rights GDPR provides and California members those
CCPA provides; the founder is the contact for exercising them until the
cooperative appoints a data-protection contact.
Where to ask
Email the founder:
taburley@gmail.com.
About this notice
Version 2.0. Version 1.0 described a local-first studio that kept a member's
work on their own computer; the hosted studio at nixie.studio does not, and this
version says so. It is a working document while the cooperative is small; when the
cooperative formalizes its legal structure, this notice will be reviewed through
cooperative governance, with substantive changes notified to members in advance.