This Privacy Policy explains how Crushvertise LLC, a Texas limited liability company ("Crushvertise," "ReelDrive," "we," "us," or "our"), collects, uses, and shares information when you use ReelDrive, including reeldrive.co, app.reeldrive.co, and share links (the "Service"). It is a notice about our information practices. It is not part of the Terms of Service contract. Capitalized terms not defined here have the meanings in the Terms of Service.
The short version: we collect what we need to run a file library for your team. We don't sell your information, we don't use it for targeted advertising, we don't run third-party analytics or ad trackers, and we don't use your files to train AI models. During beta the Service is U.S.-only.
Information you give us
Information created when you use the Service
Cookies and similar technologies
We use only cookies that are needed to run the Service. We do not use advertising or third-party analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
rd_s, rd_auth |
Keep you signed in (session) | Up to about 7 days, or until you log out |
rd_dev |
Recognize a browser you've signed in from before, for sign-in security | Up to 90 days |
rd_ws |
Remember which workspace you last opened | Up to 1 year |
rd_sh_…, rd_v_… |
Remember that you unlocked a password-protected share link, and count share views | About 1 day (unlock) / about 4 hours (view count) |
rd_gc_… |
Remember a guest commenter's identity and display name on a share link | Up to 180 days |
App cookies are set only for the app's own host (app.reeldrive.co) and are marked secure and HTTP-only. Because these cookies are strictly necessary, the Service won't work properly if you block them. You can see and delete cookies in your browser settings; deleting them signs you out. Our hosting or payment providers may set their own strictly necessary cookies (for example, a Cloudflare security challenge cookie or cookies on Stripe-hosted checkout pages); those are controlled by those providers.
The app also uses your browser's local storage and session storage to remember interface preferences on your device (such as sort order, theme, sidebar state, and favorite boards), to resume interrupted uploads, and to remember a guest commenter's display name. This information stays in your browser and is not used for tracking. You can clear it through your browser settings.
If you don't give us information. We need an email address and password to create an account, and a payment method for paid plans. Without them we can't provide those parts of the Service.
We use information to:
We do not use Your Content for advertising, and we do not sell it. We do not use Your Content or AI results to train AI models. We do not send marketing or promotional email unless you separately opt in. Service emails needed to run your account cannot be turned off while you have an account.
Aggregated and de-identified information. We may combine information into aggregated or de-identified statistics that can't reasonably be linked to you or your workspace (for example, total storage used across the Service, or how often a feature is used) and use them to run, plan, and improve the Service. We don't build these statistics from the contents of your files, and we won't try to re-identify de-identified data.
AI Features are enabled. They run for a workspace only after AI Features have been switched on for that workspace, and only workspace owners and admins can start AI processing. Until then, none of your files are sent to an AI provider. When AI Features are on, we use two Google services, both as paid services, to process files on your behalf:
Restricted or prohibited files are never sent to Gemini. Content our Terms prohibit, including sexually explicit content, and content we have restricted are not sent to Gemini.
How Google handles this data. Under the Gemini API Additional Terms of Service, for paid services Google says it does not use prompts or responses (including uploaded images, videos, and other files) to improve its products, and processes them under its data processing terms. Google logs prompts and responses for a limited period solely to detect and prevent violations of its Prohibited Use Policy and for required legal or regulatory disclosures; its abuse monitoring page says this data is kept for 55 days and that authorized Google staff may review flagged content. Google may store or cache this data in any country where it or its agents have facilities. We have turned off request logging for our Gemini project in Google AI Studio, so Google does not keep our requests or the copies in them as logs or datasets for us; the abuse-monitoring logging described above is Google's own and still applies. For Cloud Vision, Google's data usage FAQ says Google does not use the content sent to train or improve Cloud Vision or for any purpose other than providing the service, that images sent for immediate analysis (the kind we use) are processed in memory and not stored, and that Google temporarily logs some request metadata (such as the time and size of a request) to improve the service and combat abuse.
Your choice. AI Features are optional. If you don't want your files processed by Google, don't turn on or use AI Features for your workspace, or ask us at [email protected] to keep them off. Uploading, organizing, sharing, and searching by file name and tags all work without them.
Google appears in the subprocessor table below as in use.
Only Crushvertise LLC handles ReelDrive data. We have no parent companies, subsidiaries, or affiliates that receive it. Apart from the service providers listed below, who process it on our behalf, we share information only as described here:
Subprocessors
| Provider | Status | What it does | Data involved |
|---|---|---|---|
| Cloudflare, Inc. (Pages, Workers, R2) | In use | Website and app hosting, network delivery and security, and storage of uploaded files, thumbnails, and previews | All Service traffic, Your Content, request logs |
| Supabase, Inc. | In use | User authentication, including triggering authentication emails (which Resend delivers), and our main database | Account data, workspace data, file metadata, logs of security actions |
| Resend (Plus Five Five, Inc.) | In use | Transactional email delivery for authentication and other service emails we send through it | Email address, message content |
| Backblaze, Inc. (B2) | In use | Encrypted backups of the database and of stored files (object copies) | Encrypted database dumps and file-object backup copies |
| Stripe, Inc. | When paid plans are active | Payment processing and subscription billing | Billing contact, payment details, subscription records |
| Google LLC (Gemini API, Cloud Vision API) | In use | Cloud Vision: automated check for sexually explicit content before AI processing. Gemini: AI tagging, descriptions, and transcription for eligible files only | Images, sampled video frames, and (Gemini only) video or audio of files sent for processing; screening scores; AI results |
We also process files (for example, to create thumbnails and video previews) on computers that we own and control in the United States. We will update this list when we add or change subprocessors.
We do not use third-party analytics, advertising networks, or tracking pixels.
This section describes what we do today, so it stays accurate until automated retention jobs are approved and turned on.
When automated retention that matches a shorter period is approved and verified, we will update this Policy before relying on the shorter period.
We use reasonable technical and organizational measures designed to protect information, including encryption in transit (HTTPS), access controls that separate each workspace's data, hashed passwords and share-link passwords, short-lived signed links for file access, rate limiting, encrypted backups, and disk encryption on company computers that process media. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password safe and for choosing who you share links with. If we learn of a security breach affecting your personal information, we will notify you as required by law.
To make a privacy request, email [email protected]. If you have an account, write from the email address on it when you can; if you do not have an account (for example, you are depicted in someone's content), tell us enough for us to verify your request in proportion to the risk. We will respond within the time required by applicable law (and in any case within 45 days, unless a shorter period applies). If you are a member of a workspace, some requests (for example, deleting content that belongs to the workspace) may need to go through the workspace owner. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision, and where applicable you may contact your state attorney general. Urgent abuse reports are handled under the Terms' reporting process and are not limited to the privacy-request timeline.
Some U.S. state privacy laws (such as the California Consumer Privacy Act, as amended) give residents rights to know, access, correct, and delete personal information, and to opt out of its sale, sharing for cross-context behavioral advertising, or certain profiling. Where these laws apply to us, you can use the request process in Section 8.
In the last 12 months we collected these categories of personal information, for the purposes in Section 3, from you, your workspace, and your devices: identifiers (such as email address and IP address); commercial information (plan and billing records); internet or other electronic network activity (logs and usage data); and content you upload, which may contain other categories such as images, audio, or video of people, and may include embedded location or other EXIF data inside files (and, if you upload it, sensitive information). We disclose these categories for business purposes to the service providers listed in Section 5. Stripe processes payment data largely as an independent controller under its own terms when you pay.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that would give a right to limit its use. We have no actual knowledge of selling or sharing personal information of consumers under 16.
Because we don't sell personal information, don't share it for targeted advertising, and don't track you across other websites, there is nothing for a "Do Not Track" or Global Privacy Control (GPC) signal to switch off on ReelDrive. If that ever changes, we will honor GPC signals as opt-out requests where the law requires it and update this Policy first.
The Service is for business use by adults. It is not directed to children, and you must be at least 18 to create an account or to comment as a guest. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, or that an account holder is under 18, we will close the account and delete its personal account information, except for workspace content that belongs under the workspace owner's administrative control and anything we must preserve under law (including CSAM preservation). If you believe a child has given us information, contact [email protected]. Workspaces are responsible for having appropriate consents for any content they upload that shows minors. Adults uploading lawful images of children (for example, family or brand photos with parental consent) is different from collecting personal information from a child under COPPA; the latter is not allowed.
Crushvertise is based in the United States. We and our providers process and store information in the United States and, for some providers, in other countries where they operate. During beta, ReelDrive is offered only to U.S. account holders and workspace members (see the Terms). We do not currently offer EU/UK Standard Contractual Clauses or a separate international data processing addendum for beta customers. Do not use the Service to process personal data that requires those terms until we publish them. If you access share links from outside the United States, your information may still be processed in the United States.
The Service may contain links to websites or services we don't operate, for example links in board descriptions or comments, or the pages of our payment provider. Their own privacy policies apply, and we aren't responsible for how they handle information.
We may update this Policy from time to time. For material changes, we will email account holders (and may also show an in-app notice). Updates take effect on the date we state in that notice (or when posted, for non-material clarifications), and the "Last updated" date shows when this Policy last changed. This Policy is a notice; continuing to use the Service after an update is how you stay informed of our practices, not a separate contractual acceptance of the Policy.
Crushvertise LLC (ReelDrive)
[email protected]