VidNexusVidNexus
Security · Privacy · Data handling

Your data stays put.

VidNexus is local-first by design. Your scripts, footage, voiceover, and final renders live on your machine and never get uploaded to our servers. Here's exactly what does and doesn't leave your device.

Principle 01
enforced

Local-first by design

Your scripts, footage, voiceover clips, motion graphics, and final renders all live in a SQLite database + a folder structure on your machine. Disconnect the internet and renders still work - only the LLM (if you use OpenAI hosted) and the API calls to ElevenLabs / Pexels / Pixabay / Coverr need network.

Principle 02
enforced

Zero content telemetry

Crash logs and usage events (usage events are off by default) stay in files on your machine. Nothing is uploaded automatically; they reach us only if you send them with Report an issue. We never receive script content, voiceover audio, source footage, or rendered output. Read the source-of-truth list below.

Principle 03
enforced

License token security

Licenses are JWT tokens signed with an ed25519 keypair. The public key is shipped with the desktop app for offline verification. Machine fingerprint is hashed (SHA-256) before being sent to the license server - we never see your hardware IDs in plaintext.

Principle 04
enforced

No content uploaded - ever

VidNexus never uploads your project files, scripts, or generated videos to our servers. The only network calls from the desktop app go to your configured LLM/voice/stock providers (using your API keys) and to our license server for activation + heartbeat checks.

Data inventory

What leaves your machine. What doesn't.

Transmitted
opt-in via TLS
  • License token + machine fingerprint hash (about once an hour; works 14 days offline)
  • Anonymous app version + OS version (for update checks)
  • Crash logs and usage events only when you choose to send them with Report an issue
Never transmitted
local-only
  • Script content (prompts, generated text, edits)
  • Source footage (stock clips downloaded to your machine)
  • Generated voiceover audio
  • Rendered MP4 files
  • API keys (ElevenLabs, ai33.pro, OpenAI, Pexels, etc.)
  • SQLite database contents
  • Project file paths or file names
  • Hardware identifiers in plaintext
Verify it yourself
trust but verify

Don't take our word for it. Block VidNexus's license server in your firewall and the app keeps working in offline mode (renders, scripts, motion graphics - all local). Or run Wireshark while VidNexus runs:

# Run this in PowerShell while VidNexus is rendering:
Get-NetTCPConnection -State Established | Where { $_.OwningProcess -eq (Get-Process VidNexus).Id }
# You'll see connections to your configured providers
# (ElevenLabs, OpenAI/Ollama, Pexels) and the license server.
# Nothing else.
Sub-processors

Who we share what with.

VidNexus uses these external services for specific, narrow purposes. Each handles only the data described - never your project content.

Sub-processor list
current
Provider
Purpose
Region
Payment provider
Merchant of record for license sales: takes the card payment, handles sales tax and sends your receipt. We never see your card details.
Named on your receipt
Hostinger
Website, license server (Node.js + MySQL) and app update downloads.
European Union (Lithuania)
Resend
Transactional email (license delivery, account sign-in links).
United States
Loops.so
Waitlist and product-news email, only if you sign up for it.
United States

Found a vulnerability?

Email support@vidnexus.app with details. We respond within 48 hours, fix critical issues within 7 days, and credit responsible disclosure in the changelog (with your permission).