Saga Privacy Policy
Effective date: October 4, 2026. Owner: Saga is a product owned and operated by Circe Social Co.
1. Who we are and what this covers
Saga is a family-video product owned and operated by Circe Social Co. ("Saga," "we," "us"). You use Saga to upload personal photos and videos, have them edited into films by automated systems, and share those films. This policy explains what information we collect, how automated systems and our service providers process it, how we share and retain it, what we can and cannot delete, and the choices you have.
This policy covers the Saga mobile app and the Saga websites at saga.you, including public film pages that anyone can watch through a share link without an account.
• Legal contact / address: Circe Social Co., 1955 Courtland Ave, Oakland,
CA 94601.
• Jurisdictions offered: United States only.
• Privacy contact: privacy@saga.you.
• Support contact: support@saga.you.
• Changes: When we make a material change we will update the effective date
and, where required, notify you in the app or by email.
2. Information you provide
• Account and identity. Your email address and password, handled through AWS
Cognito; your profile display name, avatar, and bio.
• Collaboration. Project titles, descriptions, story/mood/tone/location
choices, edit prompts and steering text, comments, timestamp tags, and the email addresses you enter to invite collaborators.
• Media you upload. Original photos and videos — including their bytes,
filename, type, dimensions, duration, and any metadata embedded in the file (see Section 5 on embedded location) — plus uploaded music and voice audio, and voice reactions. We derive thumbnails, proxies, transcripts, and rendered films from this content.
• Guest contributions. If someone watches a shared film without an account
and leaves a named reaction, we collect that name and reaction as pseudonymous guest content visible to the project owner.
• Support, feedback, and reports. Feedback text, an optional screenshot, the
route/app-version/platform/viewport context attached to it, and abuse reports (target, category, and optional free-text detail).
• Payments. If you buy a subscription or film, checkout happens on
Stripe-hosted pages. Payment-card details are entered at Stripe and are not stored in Saga's systems; we receive a Stripe customer reference, subscription or entitlement status, and billing events.
3. Information collected automatically
• Identifiers. Internal account, project, asset, and job IDs; your Cognito
subject; a stable browser/device key; platform and model hints; and, after you grant permission, an Expo/APNs push token.
• Share-view network data. When someone opens a public film link, we record
the viewer's IP address, user agent, first-view time, and a persistent pseudonymous viewer identifier stored on the viewing device, which can span multiple share links, used for view counts and product analytics.
• Usage and telemetry. Upload, editing, approval/rejection, voting, comment,
and usage events; per-second watch telemetry (play, progress, skip, rewatch, drop-off, completion, playhead position, watched milliseconds, app version). When you delete your account, the link between this telemetry and your account is severed; the resulting de-identified playback facts are retained indefinitely for product analytics.
• Operational logs. Standard server, security, and error logs from our AWS
infrastructure, and app context (version, platform, route, locale) attached to feedback.
4. How we use information
We use information to authenticate you and run your account; to upload, process, edit, transcribe, and render your media; to power collaboration and sharing; to deliver notifications; to bill for paid features; to provide support; to secure the service and prevent abuse; to moderate content and comply with law; and to maintain, debug, and improve Saga.
Section 5 describes what is sent to each provider. As a general rule we do not make claims about whether providers retain or train on your content until our provider agreements are verified. Saga has configured an AWS AI-service improvement opt-out for the AWS account used by Saga. This account-scoped setting does not cover other AWS accounts or ElevenLabs, and it does not mean the functional data used to provide a service is immediately deleted. We do not extend that claim to ElevenLabs or to Saga itself, and we do not make a blanket "we don't train on your content" claim while our diagnostic logs can still contain model responses. The three scoped exceptions to our general silence are this AWS account-scoped opt-out statement, the abuse/CSAM detection disclosure in Section 5, and the verified-processor statements in Section 7; otherwise we describe only protections we have verified.
5. AI and automated processing
Saga's core function is automated. Your media and instructions are processed by automated systems and foundation models to analyze clips, transcribe speech, generate edit structure, and render films.
• Processors. Editing and analysis run on Amazon Bedrock (an Amazon
Web Services service). Bedrock receives images and video frames, transcripts, editing instructions, and file details. Its configured foundation-model providers include Anthropic (Claude) and, for optional/legacy roles, Moonshot. Depending on the feature, speech transcription uses Amazon Transcribe or ElevenLabs. The selected service processes the full audio track, not only portions used in the finished film; audio tagged as music is not transcribed. Amazon Transcribe reads and processes audio from Saga-controlled AWS storage; its receipt of a storage reference does not mean it cannot access the audio. Voice notes and voice reactions may still use ElevenLabs. ElevenLabs receives audio directly at its own service, outside AWS/Bedrock. For AI-generated music and sound effects, ElevenLabs receives text prompts that may be derived from your editing requests and film content. Provider-side retention and cleanup must be assessed for each route; changing the transcription provider does not establish zero retention for other audio features.
• Saga safety review. Saga may send images and video frames to Amazon Rekognition to help identify potentially unsafe content. Authorized reviewers
may also review content submitted for publication, flagged media, and reports. Automated checks can make mistakes.
• Embedded location coordinates. Saga does not read your phone's live GPS
or Core Location. However, a photo or video you select can contain location coordinates embedded in the file (photo EXIF GPS, or a video container location tag). Our media pipeline extracts those coordinates and persists them server-side in media-metadata artifacts, and your original file (which also carries them) is retained in versioned storage. From the coordinates we derive a coarse place name using an offline lookup on our own servers — we do not call any location provider. That derived place name is stored server-side and linked to your account. Only that place name, never the coordinates, is sent to our AI providers, where it informs the edit. This is not live-phone tracking, and we do not use it for advertising. Saga v1 extracts and retains these coordinates rather than stripping them; a future stripping option may be offered but is not part of v1.
• Written descriptions of people. To assemble films, the AI analysis
generates and stores short written descriptions of the people in your clips — their appearance, clothing, and expressions — on a per-clip basis. Saga does not run face recognition or any biometric identification, and stores no faceprints or biometric templates.
• Support triage. Support feedback you submit is summarized by a foundation
model before it reaches our issue tracker.
• Accuracy. Automated outputs can be wrong, incomplete, or unexpected. You
should review films before relying on or sharing them.
• Automated abuse and CSAM detection. Separately from any product-improvement
use of content, the AI providers that process your media may run automated abuse and child-sexual-abuse-material (CSAM) detection as part of their service. Where a provider's system flags content, that provider may retain and human-review the flagged input and report apparent CSAM to the authorities (including NCMEC) under the provider's terms and applicable law. This is the provider's process, not a Saga retention promise, and it is not a blanket "never retained" statement. We will state the applicable retention period once it is verified.
• Retention/region/human review. Except for the abuse-detection basis above,
we have not yet established, and so do not claim, provider-side retention terms (including transcription-provider retention), data region, or routine human review. We will state these only once the relevant provider agreements are verified against the deployed configuration.
6. Sharing and collaboration
• Collaborators. People you add to a project may see that project's media and
content according to their role.
• Share links. A film share link is a bearer capability: anyone who has a
live link can watch the film, and can forward it. Revoking a link stops new resolutions but cannot recall copies already loaded. Some links can also let a viewer join the project; this is chosen when the link is minted.
• Guest data. Guest names and reactions are visible to the project owner.
• Notifications are disclosures to delivery providers. Push and email are
not content-free. Depending on the message, Expo/Apple (APNs) and AWS SES receive titles, choice prompts, synopsis/runtime copy, identifiers, and deep links; a film-ready message may include a short-lived presigned still-image URL (configured expiry ~900 seconds). URL expiry is not message deletion: the notification or email can remain at the provider, on your device, or in a recipient's mailbox, and we cannot retract copies already delivered.
7. Service providers and disclosures
We share data with providers who process it on our behalf:
Provider — Role — Data involved
Amazon Web Services — Identity (Cognito), media storage (S3), database (RDS), processing (Lambda/ECS/SQS), delivery (CloudFront), email (SES), AI (Bedrock — creative editing and support-feedback summarization; Transcribe; Rekognition safety scans), logging (CloudWatch) — Nearly all account, media, content, usage, and diagnostic data, including support feedback summarized before it reaches the issue tracker
Stripe — Hosted checkout/portal, subscriptions, entitlements — Email, Saga user reference, purchase/billing status; card data at Stripe
Expo — App updates and push transport — App/device metadata, push token, notification content
Apple — Photo-library permission, APNs delivery, App Store distribution — Selected media, device token, notification content
ElevenLabs — Feature-dependent speech transcription and generated music/sound effects; called outside AWS/Bedrock — Full audio for transcription; text prompts derived from editing requests and film content for generation; provider-side retention is not represented as universally zero
GitHub — Optional private feedback sink — Feedback text, context, IDs, screenshot reference
Circe Social Co. is the controller of your personal information; the providers above act as our processors/service providers. We may also disclose information for legal or safety reasons, in a corporate transaction, or to professional advisers. Our infrastructure and AI providers (AWS, ElevenLabs) are contractually prohibited from selling or sharing your personal information. We are completing a review of every provider in our data map, including our payment processor, before making a service-wide statement.
8. Safety, reports, and moderation
You can report content and accounts. We collect the category reported, your reporter details, and any evidence, and we preserve it as safety evidence. We investigate reports and may restrict, remove, or quarantine content or accounts, but we do not promise that every report results in removal, and we do not promise universal monitoring. Emergency and illegal-content escalation follows our internal takedown runbook. We review reports promptly. A logged-out report path is provided on every public film page before public sharing is enabled, so viewers without an account can report content.
9. Retention and deletion
We keep information for as long as needed to provide Saga and for the additional purposes described here. Deleting content is not instantaneous across every copy, and some copies persist on defined schedules:
• Active storage. Media lives in private, encrypted, versioned S3 with no
general expiration; database rows persist while your account and resources exist. Incomplete multipart uploads expire after 7 days.
• Deletion today. You can delete individual assets and projects. For
account deletion, check account settings or contact support@saga.you. Where in-app account deletion is available, submitting a request starts deletion processing. When deletion runs, removal from our systems completes on our deletion schedule (see the windows below). We do not publish a fixed completion time and will not claim one we cannot prove in production.
• Secondary copies (facts from configuration, not a full schedule). Database
backups are retained ~14 days; deleting a live row does not selectively erase it from an existing backup. Processing queues and dead-letter queues retain message bodies ~14 days. Worker container logs are copied to CloudWatch and retained 30 days (an ECS log-group override); API and Lambda logs are retained 90 days; identity logs are retained 30–90 days depending on the log group. Worker logs may contain a short excerpt of the editing instructions you typed. Deleting your data does not individually purge these; they age out on schedule or require operator-level deletion.
• Legal holds and retained records. We may retain certain records (e.g. safety
evidence, billing records, or data under legal hold) after deletion where required.
• Viewer telemetry for public links. When people open your public film links,
we retain rows about those viewers — including IP address and user agent (see Section 3). Those viewers are not account holders, so these rows are not covered by account deletion and have no fixed expiry today. A retention lifecycle for these rows is a separate backend task, not yet scheduled.
• Delivered messages. We cannot recall notifications or emails already
delivered to a device or mailbox.
To request deletion or ask about the status of a request, contact support@saga.you.
10. Security
Your media is stored in private S3 buckets, encrypted in transit and at rest, served over SSL only, versioned, and blocked from public access; film stills are served through short-lived signed URLs. We use access controls and account security measures. No method of storage or transmission is perfectly secure, and we do not guarantee absolute security.
11. Your choices and rights
• Permissions. You control photo-library and notification permissions through
your device.
• Share links. You can revoke share links at any time (subject to the limits
in Section 6).
• Access, correction, deletion, and other rights. Depending on the US state
you live in, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of sale/sharing (we do not permit our verified providers to sell or share your personal information; see Section 7), and to appeal a decision — including the rights California residents have under the CCPA as amended. Contact privacy@saga.you to exercise them; we will not discriminate against you for doing so. Saga is offered in the United States only, so this policy does not provide EEA/UK legal bases or international-transfer terms.
12. Children and family content
Saga is a family product, and the media you upload may depict children even though accounts are held by adults. You must be 18 or older to hold a Saga account, and Saga has no child-account mode in this version. We handle requests concerning child subjects and child safety as described in Sections 8 and 11.
13. International transfers
Saga is offered in the United States only and runs on US-based AWS and provider infrastructure. We do not offer Saga outside the US at launch, so this policy does not provide an international-transfer mechanism. If that changes, we will update this section before offering Saga in other countries.
14. Contact
Privacy requests: privacy@saga.you. Support: support@saga.you. Postal/legal contact: Circe Social Co., 1955 Courtland Ave, Oakland, CA 94601.