Privacy Policy
Last updated: August 10, 2026
This policy explains what the Montaj app and the Montaj website at www.trymontaj.com do with data, in concrete terms. It is written to be accurate rather than reassuring — where something does leave your device, it is named below.
The short version
- There is no account. No sign-up, no email, no password, no profile.
- Your video and audio files never leave your device. Editing, transcription, subtitles and audio cleanup all run locally.
- No advertising, no advertising identifier, no cross-app or cross-site tracking. We do not sell or share personal information.
- One feature does send something. When you tap the AI edit button, the text of your transcript is sent to an AI provider so it can suggest an edit plan. Never the video, never the audio. Details in section 3.
- The app also downloads its speech-recognition model and optional fonts from the internet, like any app that fetches a file.
1. Who is responsible
The Montaj app and this website are operated by Appbiz Studio, LLC, which is the data controller for the limited processing described here. Contact: hey@abdoul.dev.
2. The app: how it works
Montaj is built to process your media on your own hardware. Your clips are imported from your device, edited on your device, and exported back to your device. Transcription runs through a speech-recognition model that executes locally; silence detection and audio denoising run locally too. None of that involves sending your footage anywhere, and we never receive it.
We have no server that stores your projects. If you delete the app, the projects go with it, and we have no copy.
3. What the app sends over the internet
These are all of them.
a. AI edit suggestions — transcript text only
Montaj has a feature that proposes an edit plan (for example, where illustrative shots could go). It runs in the cloud, because the model is too large to run on a phone. It only runs when you explicitly tap the AI button.
What is sent, at that moment:
- the text of your transcript, split into segments, with their start and end timings;
- the total duration of your video.
What is not sent: your video file, your audio, any image, your name, your email, any device or advertising identifier, or your location.
The request goes to OpenRouter, which routes it to a large language model. Depending on the feature, the model that runs it is operated by DeepSeek or by Anthropic. The response — a suggested plan — comes back to your device and is applied there. If you never tap that button, nothing about your content ever leaves your device.
Please keep this in mind for sensitive footage: if your transcript contains confidential or personal information, do not use the AI suggestion feature on it.
b. Speech-recognition model download
The first time you generate subtitles, the app downloads the speech-recognition model weights from Hugging Face, the public repository that hosts them. This is a plain file download: no content of yours is included. Once downloaded, the model is cached on your device and transcription works offline.
c. Noise-reduction model download
The first time you use audio cleanup, the app downloads the noise-reduction model (DeepFilterNet, about 8 MB) from its public release page on GitHub. Again, a plain file download with none of your content attached, cached afterwards.
d. Fonts
When you browse text fonts, the app requests the font catalogue from the Google FontsAPI and downloads the font files you use. Again, only a file request — none of your content is attached.
e. Sound and asset files
Sound effects and similar assets used by the editor are downloaded from our own content server as you need them, and cached on your device. These are plain file downloads: no content of yours is attached, and we keep no record of who fetched what.
f. Apple
Downloading and updating the app goes through the App Store, so Apple processes that according to its own privacy policy. Apple may also give us aggregated, anonymous statistics (downloads, crash counts, and similar) through App Store Connect. Those are aggregate figures; they do not identify you.
As with any request over the internet, the providers above necessarily see the IP address your request comes from. That is how the internet works; we do not receive it and we do not log it.
4. What the app stores on your device
- your imported media, projects and exports, in the app’s own storage;
- the downloaded speech-recognition model and any downloaded fonts, cached so they work offline;
- your settings and preferences;
- diagnostic logs written locally to help debug performance.
All of it stays on the device. We have no remote access to it, and we do not back it up to any cloud of ours.
5. Permissions the app asks for
| Permission | Why it is asked |
|---|---|
| Photo library | To let you import the videos and images you want to edit. |
| Add to photo library | To save your exported video back to your library. |
| Camera | To let you film a clip directly into a project, if you choose to. |
| Microphone | To record sound with the clip you film, so it can be captioned. |
| Speech recognition | Required by the operating system for transcription features. |
Every one of these is optional in the sense that you may decline it; the related feature then will not work. Media accessed through these permissions is processed on your device.
6. What the app does not do
- No account, no login, no password, no email address collected.
- No advertising, no ad SDK, and no advertising identifier (IDFA). The app never shows the App Tracking Transparency prompt because it has nothing to ask for.
- No tracking of you across other apps or websites, and no data broker.
- No selling or sharing of personal information, under any definition, including the CCPA/CPRA meaning of “sell” and “share”.
- No training of any AI model on your content by us.
- No location collection.
- No in-app purchase and no payment: the app is free today and does not ask for money.
7. Analytics
The app contains a product-analytics component intended to measure how the first-run experience is used. It is currently switched off: no analytics key is configured in the released build, so the events stay on the device as local log lines and nothing is transmitted.
If we do switch it on, it will record product events only — which screens were reached, which steps completed — against a random identifier generated on your device, deliberately not your device’s vendor identifier, not your advertising identifier, and nothing that names you. The provider would be PostHog, on its European infrastructure. We will update this page and this date before that happens.
8. The website
a. Hosting and server logs
The site is hosted on Vercel. Like any web host, Vercel processes the technical data needed to serve a page — IP address, user agent, requested URL, timestamp — and keeps short-lived operational logs for security and reliability. We do not build profiles from them.
b. Cookies
The site may set a single, strictly functional cookie: NEXT_LOCALE (SameSite=Lax), which records which language version to serve. It holds nothing but a language code, contains no identifier, and is used for neither analytics nor advertising — which is why it is exempt from prior consent and why you are not shown a cookie banner. There is no analytics cookie, no advertising cookie and no third-party tracking cookie on this site.
c. Third-party resources loaded by your browser
Pages load web fonts from Google Fonts and an icon script from Iconify. The home page additionally loads an embed script from Tally, left over from an earlier design and no longer used by anything on the page. Your browser fetches these files directly from those providers, which means they see your IP address and browser details. They are used for display only, and we receive nothing back from them.
d. The free browser tools
Most of the video tools on this site run entirely inside your browser. The video-processing engine is served from our own domain, and your file is read, processed and downloaded locally — it is never uploaded to us.
The in-browser transcription tool works the same way for your audio, with one caveat: the speech-recognition model it uses is downloaded by your browser from Hugging Face, so Hugging Face sees the request for those model files. Your audio itself stays in the browser.
e. Tools that take a link
Some tools accept a link to a video instead of a file. Here is exactly what happens to that link. It is sent to our server, which forwards it to a third-party resolver service, RapidAPI, to find the direct video address. Your browser is then redirected straight to that address, which is hosted by the platform the video came from — so that platform sees your IP address at that point, as it would if you had opened the video there yourself.
The video file never passes through our server and is never stored by us. The link you pasted is not written to any log or database, and we build no history of what you looked up. Your IP address is held briefly in memory to enforce rate limits, then discarded.
f. No forms, no newsletter
There is no account on this site, no newsletter, and no contact form that reaches us. The home page displays an email field left over from an earlier design; it submits nowhere — anything typed into it stays in your browser and is never transmitted to us or to anyone else. The only way to reach us is by writing to hey@abdoul.dev.
9. Why we are allowed to do this (GDPR legal bases)
| Processing | Legal basis |
|---|---|
| Sending transcript text for an AI edit suggestion | Performance of a contract (art. 6(1)(b)) — you asked for the feature by tapping the button. |
| Downloading models and fonts | Performance of a contract (art. 6(1)(b)) — the app cannot work without them. |
| Serving the website, server logs, rate limiting | Legitimate interest (art. 6(1)(f)) — delivering the site and keeping it available and secure. |
| The NEXT_LOCALE cookie | Strictly necessary — exempt from consent under the ePrivacy Directive. |
10. How long anything is kept
- By us: nothing. We operate no database and no user store, so there is no record of you to keep or delete.
- On your device: for as long as you keep the app. Deleting the app removes it.
- By our host: short-lived operational logs, per Vercel’s own retention.
- By the AI provider: according to its own retention policy, for the request you triggered.
- Email you send us: kept as long as needed to answer you and to keep a record of the exchange.
11. The third parties involved
| Provider | Role | What it receives |
|---|---|---|
| OpenRouter, routing to DeepSeek or Anthropic | Generates the AI edit suggestion | Transcript text and timings, only when you tap the AI button |
| Hugging Face | Hosts the speech-recognition model files | A file download request (IP address, no content) |
| GitHub | Hosts the noise-reduction model file | A file download request (IP address, no content) |
| RapidAPI | Resolves a pasted link to a direct video address, on the website | The link you pasted (sent by our server, not your browser) |
| Tally | Unused embed script still loaded by the home page | A file request (IP address, no content) |
| Google (Fonts) | Font catalogue and font files, in the app and on the site | A file request (IP address, no content) |
| Iconify | Icon script on the website | A file request (IP address, no content) |
| Vercel | Hosts the website | Standard request data and server logs |
| Apple | Distributes the app | Whatever the App Store processes for a download; aggregate statistics to us |
That is the complete list. There is no analytics provider, no advertising network, no crash-reporting service and no data broker in it.
12. International transfers
The providers above are mostly established in the United States, so a request you trigger may be processed there. Where personal data is transferred out of the EEA or the UK, we rely on the Standard Contractual Clauses or an equivalent safeguard offered by the provider. In practice the volume is very small: we hold no user database, and the only content that can cross a border is transcript text you deliberately send for an AI suggestion.
13. Your rights
Depending on where you live, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing relies on it (GDPR, UK GDPR, CCPA/CPRA and comparable laws).
Because we hold no account and no user database, most of these rights are already satisfied by design: we have nothing about you to hand over, correct or erase. You can delete everything the app holds by deleting the app, and you can clear the NEXT_LOCALE cookie in your browser at any time.
If you believe we nonetheless hold something about you, write to hey@abdoul.dev and we will answer within 30 days. California residents: we do not sell or share personal information and have not done so in the past twelve months, so there is no opt-out to exercise, and we will not discriminate against you for making a request. If you are in the EEA or the UK, you may also complain to your local data protection authority.
14. Children
Montaj is not directed at children under 13, or under the minimum age of digital consent in your country if that age is higher, and we do not knowingly collect personal information from them. Since the app has no account and collects no personal information, there is no children’s data for us to hold. If you believe a child has sent us something through an email to us, contact us and we will delete it.
15. Security
Keeping your media on your device is itself the main security measure here: footage that is never uploaded cannot be leaked by us. The requests the app does make travel over encrypted HTTPS connections, and the website is served over HTTPS. No system is perfectly secure, but there is no user database of ours to breach.
16. Changes to this policy
We will update this page whenever what the app does changes — in particular if analytics is switched on, or if a new service starts receiving anything. The “last updated” date at the top always reflects the current version.
17. Contact
For any question about this policy or about your data, write to hey@abdoul.dev. See also our Terms of Service.