Privacy policy

Who we are

Email us with questions about this notice.

Signing in

Everyone signs in with an email code, Google or Apple.

With Apple we receive an Apple account identifier and the email address you choose to share, which may be an Apple relay address, and we use them the same way as the Google information below.

Google

• When you choose Google sign-in, we receive your Google account identifier, name, email address, email verification status and profile picture URL.
• Our authentication system also receives and stores Google sign-in tokens, their expiry information and the permissions you granted. A refresh token is stored if Google supplies one.
• We request only basic identity permissions: openid, email and profile. We do not request access to Gmail messages, Google Drive files, contacts, calendars or YouTube data.

We use this information to create or identify your account, authenticate sign-in and maintain the connection to Google. The account and sign-in records are stored in Isotoon’s PostgreSQL database hosted by PlanetScale and processed by our application hosted on Vercel. Google processes the authorization and supplies the identity information. We do not use Google account data for advertising, sell it, put it in your videos or send it to the content-screening service.

You can remove Isotoon’s access in your Google Account’s third-party connections settings. This stops future access through that connection; it does not by itself delete the records already stored by Isotoon. To request deletion of your account and its Google sign-in records, use Settings → Delete account or email support@isotoon.com. We will verify that you control the account before carrying out the request.

Paying

On the website you subscribe through Stripe. The card number is typed into Stripe and never reaches Isotoon. We keep Stripe’s customer and subscription references and the plan’s status and end date. A free trial is one per card: Stripe marks the customer record of the first account to start a trial on a card, and a trial on the same card from another account is charged straight away. That marker is kept by Stripe, not by Isotoon. Stripe holds your payment details.

In the iPhone and iPad app, Basic and Pro are App Store subscriptions instead. Apple takes the payment on your Apple Account, under Apple’s terms, and Isotoon never sees your card. So that Apple’s receipt can be matched to your Isotoon account, we give Apple a random reference that means nothing outside Isotoon, and we keep Apple’s transaction references, the plan’s status and its renewal date. You manage or cancel the subscription in your Apple Account’s subscription settings.

Using Isotoon in ChatGPT or Claude

You can connect ChatGPT or Claude to your Isotoon account and make videos from the chat. You connect by signing in on isotoon.com, the same way as above, and approving the app on a screen that lists what it may do. The app never sees your password or sign-in code.

Approving gives the app a key that works only on your own video library: to make, change, list, show and delete your videos. It lasts one hour and the app renews it for up to 30 days at a time while it stays connected. If an app also asks to know your name or email address, the approval screen says so, and it receives them only if you approve; the Isotoon listing in ChatGPT does not ask for them. We keep a record of each connection: which app, the address it signs in through, what you approved and when, and its keys.

What the app sends us: what you ask for a video to explain, the choices for it (such as its length, drawing style and shape), and which video to show, change or delete. That question is screened and kept exactly like one typed on isotoon.com. We do not receive the rest of your conversation, or your ChatGPT or Claude account. ChatGPT also attaches anonymous references to you and the conversation, your language, a rough location (such as your city) and the kind of device to each request; we do not read, keep or use any of them.

What the app receives from us: the video’s question, its progress, the headline and narration of each scene, and links that play and download it. Anyone holding those links can watch the video for 24 hours, after which they stop working. OpenAI (ChatGPT) and Anthropic (Claude) are not our service providers: what reaches them in your conversation is handled under their own privacy policies.

For each request we also record which action it was, which video, which app, whether it worked and how long it took, never the question or the video, so we can find and fix what fails. The web app’s own requests are recorded the same way.

Videos made this way count toward your Isotoon plan as they do on the website. Nothing is bought in ChatGPT or Claude.

To disconnect, remove Isotoon in your ChatGPT or Claude settings. That stops the app from using your library; your videos stay in it. To have us cancel the connection on our side as well, email support@isotoon.com. Deleting your account deletes every connection with it.

The first video

Before anyone signs up for a plan, Isotoon shows one video so you can see what it does. It has no account behind it. Everyone picks one of a few questions we wrote, and sees a video we made for that question in advance, so nothing anyone types is sent anywhere and nothing is made or kept for you. Nothing from it is added to a library, a profile or an account. The browser keeps one cookie, for seven days, that says which of our questions was picked and that the first video has been used; it holds no name or email.

The waitlist

While Isotoon opens a few people at a time, anyone can leave an email address to be invited. We store that address and the date it was left, use it only to send the invite, and delete it after 90 days if you have not signed up. It is kept in the same database as accounts and is never sent to anyone else.

How your videos are watched

On your own account, we count how each of your videos is watched: how many times it was played, how many times to the end, and for each scene how many times you went back to it or skipped past it. These are counters on the video itself, with no times, no device and nothing you type. We use them only to learn which videos, and which parts of them, work, so we can make videos better. They are kept in the same database as your videos, never sent to anyone else, and deleted with the video.

What we collect

• Your email address, and the sign-in information above.
• A lab name you choose, shown on your notebook. It is made up, and we check it does not look like an email address, phone number, street address or school.
• The character selected as your avatar.
• The questions you ask, and the videos and interactives those questions produce.
• If you connect ChatGPT or Claude, the record of that connection described above.

We also use the sign-in and security information described under Cookies and identifiers. We do not require extra personal details to make videos.

What we never collect

• Photographs, video, or recordings of your voice. There is no camera and no microphone anywhere in Isotoon.
• Voiceprints, faceprints, or any other biometric identifier. We never run voice or face recognition on anything.
• Your home address, school, or telephone number.
• Advertising in Isotoon. There are no ads in the app or on the website, we do not sell your information, and we do not build advertising profiles of our own. We do advertise Isotoon on Instagram and Facebook, and what Meta receives for that is described under Advertising Isotoon.

Your videos are private

Your videos are visible to you and to nobody else. There is no gallery, no public feed, no comments and no messages. We do not disclose your personal information to anyone except the service providers described here, Meta as described under Advertising Isotoon, and an app you connect yourself, as described under Using Isotoon in ChatGPT or Claude. Meta never receives a question, a lab name or a video.

Who else sees it

• TypeSafe

  Screens every question and every script before it is saved, for unsafe content, personal information, attempts at outside contact, and signs someone may be at risk. Also picks which science simulation, if any, a question needs, from a fixed list.

  Acts as a service provider only. May not train on your data or use it for any other purpose. Text is screened and not retained.

These are service providers supporting how Isotoon runs. They are bound in writing to use your information only to do the job described, and for nothing else. If we add another, we will update this notice before it starts.

Cookies and identifiers

Isotoon uses first-party session cookies to keep accounts signed in. Session records may include an IP address and browser information for security and abuse prevention. Sessions expire after 30 days unless renewed. Expiry ends access and is not the same as deleting the stored record.

Your videos and your plan are kept on our servers; the browser keeps no copy of them. We use these records to operate the service, not for behavioral profiling.

When you arrive on the website from a link carrying campaign tags (such as utm_source=meta) or an ad click reference from Meta, Google or TikTok, we keep those tags in two first-party cookies for 90 days: the first such link you arrived on, and the latest. Meta’s own advertising cookies are described under Advertising Isotoon.

Advertising Isotoon

We advertise Isotoon on Instagram and Facebook, and use Meta’s tools to learn which ads lead people to sign up and to help Meta show our ads to people likely to find Isotoon useful. On the website this means Meta’s Pixel, a script from Meta that runs on every page. It sends Meta the address of each page viewed, your network address and browser details, and sets or reads two Meta cookies (a browser reference, and a reference to the ad you clicked, if any) that last 90 days. It also tells Meta when an account is created, when an account makes its first video (and whether it was a video or an interactive), and when a free trial or a subscription starts, with the plan’s price.

Our servers send Meta the same events directly, so they are counted even when the browser blocks the Pixel. With them go your email address and a reference to your account, each first turned into a one-way hash (SHA-256) so Meta can match them only to what it already holds, plus your network address, browser details and the Meta cookies above. Meta never receives a question, a lab name, a video or anything you type into Isotoon. On your account we keep the campaign tags of the first tagged link you arrived on, which ad network’s link it was, and Meta’s ad click reference, so a subscription can be counted against the ad that led to it; they are deleted with the account.

Meta uses this under its own terms and privacy policy, including to measure and deliver ads. Under some US state laws, including California’s, this counts as “sharing” personal information for cross-context behavioral advertising. To opt out, turn on Global Privacy Control in your browser: with it on, the website does not load the Pixel or set Meta’s cookies, our servers send Meta nothing about that visit, and an account created with it on is never reported to Meta. You can also control how Meta uses information about you in your Facebook and Instagram ad settings.

Analytics and error reports

We use PostHog to count how people use Isotoon, so we can see what works and fix what does not: which pages are visited, which links and buttons are used, how quickly pages load, whether signing up and subscribing work, and what people make. On the website, counting tied to an account starts once you are signed in; nothing from before then is sent afterwards. In the iPhone and iPad app, counting starts when the app opens.

On the website, a visitor who is not signed in is counted anonymously on our public pages only: the home page, Plans, For schools, Support, Study help and each subject page under it, this privacy policy, the terms, signing in and getting started. On those pages we count which page was viewed and when it was left, which of our links and buttons were clicked (by their own label, such as “Try it free”, and where they lead), how far down the page was scrolled, and how quickly the page loaded. We also keep the website that sent the visitor (only its address, such as google.com, never the page or search) and our own campaign tags from the link (such as “newsletter”), and note whether the link came from a Google, Microsoft, Facebook, TikTok or LinkedIn ad, without the ad’s code. With these go the browser, system, screen and window size, and the country and state or region the visit comes from, which our own server reads from our hosting provider when the page loads (never the city or anything closer, and the network address is not kept). Nothing anyone types is ever sent: not an email address, not a question, nothing written in a box. The box where a question is asked is never counted at all.

These counts share one random reference while the visitor moves between those pages in the same tab. It is kept only in memory and thrown away the moment the visitor goes to any other page, so it cannot be linked to a later visit. The one exception is signing up or in: when the visitor picks a way in (email, Google or Apple), we count that and keep the reference in that browser tab for up to an hour, so that once they are signed in, the visit that brought them is joined to their account; it is then deleted from the tab. The network address reaches PostHog with the request, as with any web request, but PostHog does not use it for location. There is no cookie, no “13 or over” label, no recording of the screen and no advertising. No other page — making, the notebook or settings — is ever counted this way.

• What is sent once counting is tied to an account: the name of what happened (a page viewed or left, a link or button used, an account made or signed in to and which way (email code, email link, Google or Apple), the subscription screen viewed, subscribe tapped, checkout opened, the App Store subscription link tapped, a free trial or subscription started, a trial's first payment, a subscription set to stop, ended or a payment that failed, a purchase or restore in the app), the page or screen, which plan (Basic or Pro), its price, and whether it came through Stripe or the App Store, the label "13 or over", and a reference to the account made by one-way hashing.
• With that reference PostHog keeps a short record of the account: its plan, the day it signed up, how it signed up, the campaign tags of the first tagged link it arrived on (such as "meta" and the campaign's name) and whether that link came from a Meta, Google or TikTok ad, how many videos are in its notebook, and its email address. The email address is sent only while deleting the account also deletes this record and everything counted for the account from PostHog, which it does.
• On the website, once counting is tied to an account it covers every page: page views, how long a page was open, how quickly it loaded, and which links and buttons were used, recorded by the kind of element and where it sits on the page, never by its words, so no question or video title is ever part of it. It also counts what you make: a video or 3D scene started (with its type, length, style and the host's subject from our own lists), refused (such as needing a plan), finished with how long it took to make, whether it was the account's first and a reference to that video made by one-way hashing, failed, or asked as a follow-up; a video opened, watched (and whether to the end) or deleted; finishing sign-up; and the 3D scene's play, pause, step, fullscreen and notes buttons.
• In the iPhone and iPad app, PostHog also keeps a random install reference on the device, never tied to the account, and receives the device model, screen size, system version and app version.
• The app also sends: that it was opened once counting is on (and whether that is the first time on this device), each sign-up screen reached and finishing sign-up, and that a video was made, with only its length, host and drawing style from the app's own lists, never the question, lab name or the video itself.
• What is never sent: names, lab names, questions or videos, or any email address other than the account's own as above. No advertising identifier, no location from the network address finer than the country and state or region on the public pages above, no recording of the screen, and nothing anyone types.
• On the website, analytics sets no cookie and keeps no identifier in the browser, apart from the tab-only sign-up reference above. When analytics is switched off on a device that had it on, it forgets that session and leaves only a note on the device that it is off.

When something breaks, an error report goes to Sentry, and from our servers also to PostHog, kept apart from analytics: the kind of error, its message and where in our code it happened, with email addresses, numbers, tokens, identifiers and the parts of web addresses after the page removed first. Sentry’s reports come from our servers, the website and the iPhone and iPad app, and with a sample of pages, screens and server requests goes which one it was and how long it took. Reports are never tied to a person, an account or a device. The network address reaches Sentry with the request, as with any web request, but is not added to the report, and no location is worked out from it; the device’s time zone is removed too. Reports carry nothing anyone types, no screenshot and no recording of the screen. Neither Sentry nor PostHog is used for advertising, and the account record in PostHog is used only to understand how Isotoon is used.

How long we keep it

• Your email address, lab name and avatar

  To sign you in and show your notebook.

  While the account is open. Deleted when you delete the account.

• The questions you ask and the videos they make

  So you can watch, review and build on what you made.

  While the account is open. Deleted with a video when you delete it, and with everything else when you delete the account.

• Emails you send us

  To answer you, and to carry out requests about your information.

  Kept while we deal with your request and for one year afterwards, then deleted.

• How you watched your videos

  To learn which videos, and which parts of them, work, so we make them better.

  Kept with the video and deleted with it.

• Your email, if you join the waitlist

  To send you an invite to sign up, and for nothing else.

  Deleted after 90 days if you have not been invited and signed up by then.

• The question and the video from the first video, before any plan

  To show you what Isotoon does. There is no account behind it.

  Deleted when the video has been watched, and within two hours if it was not.

• A cookie saying the first video was used, and a one-way hash of the network address

  To stop the first video being made repeatedly.

  The cookie lasts seven days. The hash lives in memory for an hour and is never stored.

• An account we learn belongs to someone under 13

  Isotoon is for people 13 and over.

  Deleted with everything on it within 7 days of our learning it.

• The campaign tags of the link you first arrived on, and Meta's ad click reference

  To count sign-ups and subscriptions against the ad or campaign that led to them.

  In the browser, two cookies that last 90 days. On the account, while it is open. Deleted when you delete the account.

• What Meta receives about visits, sign-ups, first videos, trials and subscriptions

  To measure our Instagram and Facebook ads and help Meta show them to people likely to find Isotoon useful.

  Kept by Meta under its own terms. Meta's two cookies in the browser last 90 days.

• Usage analytics, for signed-in accounts

  To see whether signing up, making videos and subscribing work.

  Kept in PostHog for 12 months, then deleted, and deleted at once with the account.

• Your connections to ChatGPT or Claude

  To let an app you connected make and read videos in your library, and to show what you approved.

  Each key lasts one hour, renewed for up to 30 days at a time while the app stays connected. The record of the connection is kept while the account is open, and deleted with it.

• A record of each request to make, change or read a video

  To find and fix what fails. It holds the action, the video, the app, whether it worked and how long it took, never the question or the video.

  Deleted after 90 days, sooner with the video it was about, and at once with the account.

• Error reports

  To find and fix what breaks. They hold no personal information and are tied to no one.

  Kept in Sentry and PostHog for no more than 90 days, then deleted.

Nothing is kept indefinitely. When information is no longer needed for the purpose it was collected for, we delete it so that it cannot be recovered in the normal course of our business.

What you can do

• See every video you have made, in your notebook, and ask us for everything else we hold about you.
• Delete any video, or your whole account. We delete it everywhere we hold it.

Open Settings → Delete account to delete the account and its videos. Deletion cancels web subscriptions; Apple subscriptions must be canceled separately in your Apple Account. Other devices lose access within five minutes. You can also email us at the contact address above to make a privacy request. We will confirm you control the account first, and keep it brief.

When this notice changes

If we change what we collect, what we use it for, who else sees it, or how long we keep it, we will update this notice and tell you before the change takes effect.