This Privacy Policy explains how HitCue collects, uses, discloses, and protects personal data when you use our app, website, and related services.
By creating an account, uploading content, or otherwise using HitCue, you acknowledge this Privacy Policy.
1. Controller
For the purposes of applicable data protection law, the controller of the personal data processed through the service is Davide Deponti, operating HitCue, unless otherwise stated.
If you have questions about this Privacy Policy or want to exercise your privacy rights, you can contact us at: support@hitcue.app
2. Personal Data We Collect
We may collect and process the following categories of personal data:
Account and identity data
- name, email address, login credentials, account identifiers, and authentication data;
- profile information you choose to provide;
- information received from sign-in or identity providers if you use third-party login methods.
Content and rehearsal data
- scripts, text, notes, prompts, recordings, uploads, and other materials you submit to HitCue;
- collaboration data, such as shared notes, shared recordings, invite link metadata, script membership data, and information about users with whom content is shared;
- microphone audio and speech-recognition results processed transiently while you use Scene Partner;
- metadata relating to uploaded content, such as file names, timestamps, processing status, and usage context.
Technical and usage data
- device information, app version, browser type, operating system, language, IP address, approximate location derived from technical data, and crash or diagnostics data;
- log data, session activity, feature usage, timestamps, and interactions with the service;
- on our website, cookie identifiers and usage data collected by Google Analytics, such as pages viewed, clicks on key buttons, device and browser information, and approximate location, only if you accept Analytics cookies (see Section 13).
Support and communications data
- messages you send to support, feedback, survey responses, and other communications with us;
- your choice about receiving marketing emails, and a record of each time you gave or withdrew it (see Section 14).
We may also generate internal service data, such as processing results, moderation flags, performance metrics, or system records linked to your use of HitCue.
3. How We Use Personal Data
We use personal data to:
- create and manage user accounts;
- provide the core functionality of HitCue, including script upload, storage, organization, rehearsal tools, and account features;
- provide Scene Partner by recognizing speech during an active drill, matching recognized words against the expected line, showing live progress, and continuing playback when the line ends;
- process content using AI-assisted or automated tools;
- authenticate users, secure the service, prevent abuse, and investigate incidents;
- provide customer support and respond to requests;
- monitor performance, debug issues, maintain logs, and improve reliability;
- measure how our website is used, if you accept Analytics cookies, so that we can improve it;
- send you news, tips, and offers about HitCue by email, only if you agreed to receive them (see Section 14);
- improve, develop, and optimize HitCue and related features;
- comply with legal obligations, enforce our terms, and protect our rights, users, and third parties.
4. Legal Bases for Processing
Where the GDPR applies, we process personal data on one or more of the following legal bases:
- performance of a contract, where processing is necessary to provide HitCue to you;
- legitimate interests, such as securing, maintaining, improving, and administering the service, preventing misuse, and supporting our business operations;
- compliance with legal obligations;
- consent, where required by law for specific processing activities, including optional cookies and similar technologies on our website (see Section 13) and marketing emails (see Section 14).
Where we rely on legitimate interests, we assess those interests against your rights and freedoms as required by law.
5. AI Processing, Speech Recognition, and Third-Party Providers
HitCue may use third-party service providers to operate the service, including cloud hosting providers, storage providers, authentication providers, analytics or monitoring providers, email delivery providers, customer support tools, AI providers, and operating-system speech-recognition providers.
To provide AI-assisted features, personal data and user-submitted content may be transmitted to or processed by external AI providers and cloud infrastructure providers. This may include scripts, prompts, notes, related metadata, and technical information necessary to generate, structure, analyze, or return outputs.
Scene Partner accesses the microphone only during an active rehearsal drill after you grant the required permissions. It uses speech-recognition results to compare your spoken words with the line already shown in your script. HitCue does not save Scene Partner microphone audio or recognized text as a dialogue recording or other rehearsal content. If you separately choose to create and save a dialogue recording, that recording is handled as user-submitted content under this Privacy Policy.
Speech recognition may run on your device where the device, operating system, and language support it. Otherwise, the operating system's speech-recognition service may process microphone audio over a network. Depending on your device, this service may be provided by Apple, Google, or another operating-system speech provider. Their processing is subject to the terms and privacy practices that apply to your device and platform. You can deny or revoke microphone and speech-recognition permissions in your device settings, but Scene Partner will then be unavailable and HitCue will use a manual rehearsal mode instead.
We use third-party providers because certain parts of the service depend on infrastructure and systems that we do not operate ourselves. While we select providers carefully and seek to use contractual, technical, and organizational safeguards that are appropriate for the service, we do not control every aspect of third-party systems, infrastructure, sub-processors, or security operations.
Accordingly, where your data is processed by third-party providers, their systems, availability, and security controls may affect the service. We do not make any promise that third-party systems will be error-free, continuously available, or immune from security incidents.
6. Data Sharing
We may disclose personal data:
- to service providers and processors acting on our behalf;
- to AI, hosting, cloud, storage, authentication, analytics, email delivery, support, and operating-system speech-recognition providers as needed to operate HitCue;
- to other users, cast members, collaborators, or invite recipients when you choose to share scripts, notes, recordings, invite links, or other materials through HitCue;
- where necessary to comply with law, regulation, court order, or lawful request from a public authority;
- where necessary to establish, exercise, or defend legal claims;
- in connection with a merger, acquisition, financing, asset sale, or similar transaction, subject to appropriate safeguards where required.
We do not sell personal data in the ordinary meaning of the term, and we do not currently use website data for advertising. If we start, it will be controlled by the optional Marketing category described in Section 13, because under some US state laws such use may be considered a "sale" or "sharing" of personal information. Marketing is off by default, you can turn it off at any time, and we honor Global Privacy Control signals.
If you choose to use collaboration or sharing features, some of your personal data and content may become visible to other users as part of that functionality. This may include your display name, shared scripts, notes, recordings, comments, activity related to shared scripts, and other collaboration-related metadata. You are responsible for deciding whether to share content and with whom to share it.
7. International Transfers
Your personal data may be processed in countries outside the European Economic Area, including countries whose data protection laws may not provide the same level of protection as those in your country.
This may happen, for example, when our AI providers, cloud providers, speech-recognition providers, analytics providers, or other service providers store, access, or process data from infrastructure or personnel located outside the EEA.
Where required by applicable law, we rely on lawful transfer mechanisms for such transfers, including:
- adequacy decisions issued by the European Commission; or
- appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate.
Even where such safeguards are used, international transfers can involve residual risks, including the possibility that public authorities in foreign jurisdictions may access data under local law.
8. Data Retention
We keep personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the service, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate interests.
In general:
- account and service data may be retained while your account remains active;
- uploaded content and related records may remain available until you delete them, request deletion, or the account is deleted, subject to operational and legal retention needs;
- microphone audio and recognized text used by Scene Partner are processed for the active recognition session and are not retained by HitCue as rehearsal content after that session ends;
- your marketing email choice and the record of how you gave or withdrew it are kept while your account exists and are deleted with it;
- Google Analytics keeps event-level data for 2 months and user-level data for 14 months, then deletes it automatically; aggregated reports, which do not identify individual users, are not affected;
- logs, diagnostics, and security records may be retained for shorter periods or longer where needed for security, abuse prevention, compliance, or incident investigation;
- backup copies may persist for a limited period before being overwritten or deleted in the ordinary course of operations.
If an account has been inactive for 12 consecutive months, we may delete or anonymize the account and any associated personal data. We consider an account inactive when there has been no sign-in or activity recorded during that period. Where we choose to proceed with such deletion, we may send advance notice to the registered email address at least 30 days before the scheduled date. You may avoid deletion by signing in or contacting support before the deadline. Even after deletion, we may retain limited information where necessary for legal, security, billing, dispute resolution, fraud prevention, or compliance purposes.
9. Security
We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
These measures may include access controls, authentication safeguards, logging, provider security features, data segregation, and processes intended to support confidentiality, integrity, and availability.
However, no method of transmission over the internet, cloud infrastructure, mobile network, or electronic storage is completely secure. For that reason, we cannot guarantee absolute security, uninterrupted protection, or that unauthorized access, loss, misuse, or disclosure will never occur.
10. Important Notice About Security and Liability
Because no system is 100% secure, you use HitCue with that understanding. To the maximum extent permitted by applicable law, we will not be liable for unauthorized access, loss, corruption, interception, or disclosure of data caused by:
- vulnerabilities, outages, or security incidents affecting third-party providers or telecommunications networks;
- actions or omissions outside our reasonable control;
- misuse of your account credentials or failure to keep them confidential;
- malicious acts by third parties that could not reasonably be prevented despite appropriate measures.
This does not apply to the extent a loss is directly caused by our fraud, willful misconduct, gross negligence, or any other matter for which liability cannot be excluded or limited under applicable law.
11. Your Rights
Depending on your location and applicable law, you may have the right to:
- access your personal data;
- request rectification of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing;
- request portability of data you provided to us, where applicable;
- withdraw consent where processing is based on consent, without affecting prior lawful processing;
- opt out of the sale or sharing of personal information and of targeted advertising, where applicable, including through the "Do Not Sell or Share My Personal Information" link on our website;
- lodge a complaint with a competent supervisory authority.
We may need to verify your identity before acting on a request. Some rights are subject to legal limitations or exceptions.
12. Children
HitCue is not intended for children under the age at which they can lawfully consent to the relevant data processing under applicable law. If you believe a child has provided personal data unlawfully, contact us so we can review the situation.
13. Cookies and Similar Technologies on the Website
This section applies to the HitCue website at hitcue.app and its web app. It does not cover the permissions and settings of the mobile app.
The website uses cookies and similar technologies, such as your browser's local storage, in three categories. Optional categories are off until you turn them on, wherever you are.
Necessary
These are needed for the website to work, so they cannot be turned off in the cookie settings. They include:
- browser storage that keeps you signed in to the web app (kept in local storage, not in a cookie);
- interface preferences you choose, such as whether line numbers are shown in a script;
- a temporary record that lets the web app finish a task you started, such as retrying the deletion of a dialogue recording you removed;
- the cookie that remembers your cookie choices (cc_cookie), kept for up to 12 months.
Analytics
If you accept Analytics, we load Google Analytics, provided by Google, to measure how the website is used, such as pages viewed and clicks on key buttons. Google Analytics sets the cookies _ga and _ga_<container ID>, which Google keeps for up to two years by default. Google processes this data on our behalf.
Before you accept, we do not load Google Analytics and Google receives no measurement requests from the website. We do not send Analytics data from pages whose address contains a private link token, such as shared script and company invitation pages.
Marketing
Marketing controls whether Google may use the data collected through Google Analytics for advertising-related purposes, such as measuring advertising campaigns and personalizing ads. We do not use website data for advertising today, and we do not display advertising on the website. If we start, we will update this Privacy Policy and ask for your choice again. Under some US state privacy laws, this kind of use may be considered a "sale" or "sharing" of personal information, or targeted advertising. If you keep Marketing off, the website does not allow this use. Because Google Analytics is the only Google tag we load, Marketing has no effect unless Analytics is also on.
Your choices
- On your first visit you can choose Accept all, Reject all, or Customize. Rejecting is as easy as accepting.
- You can change or withdraw your choice at any time with "Cookie preferences", in the footer of the public pages and in the side menu of the web app. The "Do Not Sell or Share My Personal Information" link in the footer turns Marketing off and opens the same settings.
- When you withdraw Analytics, we delete the Google Analytics cookies and reload the page. Events your browser had already queued just before you withdrew may still be sent as the page closes.
- We keep your choice in that browser for up to 12 months and then ask again. If you clear your cookies or use another browser or device, we ask again.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information and keep Marketing off in that browser, even if you accepted it before. The signal does not by itself turn off Analytics: that stays your choice in the cookie settings.
14. Marketing Emails
We send news about HitCue, tips for using it, and offers, such as discounts on HitCue Pro, by email only if you agree to receive them. This choice is separate from accepting our Terms of Service, and saying no or not answering does not affect your use of HitCue.
How we ask
- If you sign up with your email in the app, a box that is unchecked by default lets you agree.
- If you sign in with Apple or Google, or already had an account, we ask once, with "Yes" and "No". We save either answer and do not ask again.
How to withdraw
You can withdraw your consent at any time, as easily as you gave it: with the switch in the app's Settings, in the Account page of the web app, or by contacting us at support@hitcue.app. Every marketing email will also contain a link to unsubscribe.
The record we keep
Each time you agree or withdraw, we record the date, the version of the wording you were shown, and where you made the choice (signup, the one-time question, your settings, or an unsubscribe link). We use this record to show that you agreed.
What this consent does not cover
- Service emails, such as Company invitations, messages about your account or its security, and notices about changes to our Terms or this Privacy Policy. We send these without this consent. An email that mixes service and marketing content counts as marketing.
- Push notifications, which you control in the app and in your device settings.
- The Marketing category of website cookies described in Section 13, which is a separate choice.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we may notify you through the app, website, or other reasonable means.
The updated version will apply from its stated effective date.
16. Contact
For privacy requests or questions, contact: support@hitcue.app