Privacy and data flow
A feature-by-feature account of what stays on your Mac, what leaves it, who receives it, and how to turn each one off.
RoughCut has no servers. Your original video and audio stay where they are and are read in place. On-device transcription, the default, runs entirely on your Mac and uploads nothing. The AI editing pass sends transcript text and word timing to the provider you chose, under your own key, and never your video or audio. Pro Cloud transcription is the one feature that sends audio, and only that job's audio, only to OpenAI, only when you select it for that job. Langfuse tracing is off by default and inert without your own keys. API keys live in the macOS Keychain. Every one of these paths is separate and individually switchable.
On this page
The short answer
Your video is never uploaded. Not by the editing pass, not by Cloud transcription, not by anything.
Audio leaves your Mac in exactly one case: you have RoughCut Pro and you explicitly select ✦ Cloud (OpenAI) as the Transcription source for a particular job. On-device transcription is the default and uploads nothing.
Transcript text leaves your Mac when Bad-take removal is on, going directly to the AI provider you chose, under your own API key.
There is no RoughCut server anywhere in these paths. RoughCut does not operate one.
The in-app FAQ currently answers the question "Does my video get uploaded anywhere?" with a categorical "Never … the only thing that ever leaves the machine is the transcript text". That answer predates Pro Cloud transcription and is no longer complete. This page is the accurate version.
The complete matrix
| Feature | Default | What is sent | Who receives it | Billing | How to disable | Local alternative |
|---|---|---|---|---|---|---|
| Original media | — | Nothing. Read in place, never copied or re-encoded | — | — | — | — |
| On-device transcription | On | Nothing leaves | — | None | — | This is the local path |
| AI editing pass | On when a key exists | Transcript text and word timing | Gemini or OpenAI, your key | Your provider, directly | Turn Bad-take removal off | Silence-only cut |
| Cloud transcription | Off | That job's audio, 16 kHz mono chunks | OpenAI, your key | OpenAI, per audio minute | Select On-device | On-device Whisper |
| Video goal summarising | Off | The goal text you typed | Gemini or OpenAI, your key | Your provider | Do not click Summarize with AI | Shorten the goal by hand |
| Speech model download | On first use | A request for the model file | Hugging Face | None | Import the file manually instead | Import model file… |
| Langfuse tracing | Off | Run metadata and aggregate scores | Your Langfuse project | None | Leave Langfuse tracing off | — |
| Purchases | — | Handled by StoreKit | Apple | Apple | — | — |
Feature by feature
Your original video and audio
RoughCut reads your files where they are, through file access you grant. It never copies them, never re-encodes them, and never uploads them. The exported FCPXML is a set of cut decisions that references your original file by path. This is why moving the file after export breaks the link in Final Cut Pro.
On-device transcription — the default
Audio is extracted locally, transcribed locally with Whisper using Metal acceleration, and the transcript stays on your Mac. Nothing is uploaded and no API is billed. This requires the one-time speech model download.
The AI editing pass
When Bad-take removal is on, RoughCut sends the transcript text and word timing context directly to Gemini or OpenAI using your own API key. No video. No audio. No files.
If you turn Bad-take removal off, no key is needed and nothing at all is sent — RoughCut still removes silences using on-device analysis. See Bad-take removal.
Cloud transcription — the one audio path
This is a Pro feature, chosen per job, and it is the only feature that sends audio anywhere.
When you select ✦ Cloud (OpenAI) for a job, RoughCut uploads that job's audio to OpenAI's transcription endpoint under your own key. The audio is converted to 16 kHz mono and split into chunks whose boundaries land in detected silences, so a chunk never breaks mid-sentence. Your video is not uploaded — only the audio.
The picker states this on screen before you choose it. Every other job on your Mac remains on-device unless you select Cloud for it too. See On-device and Cloud transcription.
Langfuse tracing
Off by default and completely inert unless you turn the toggle on and supply both your own Langfuse project keys. When enabled, it sends run metadata — run identifier, mode, clip counts, outcome — and aggregate scores to your own Langfuse project. It does not send media, transcript text, or API keys.
If you are privacy-sensitive, leave it off. It is not needed for any editing feature. See Connect Langfuse tracing.
Where secrets live
API keys are stored in the macOS Keychain, encrypted by the system. They are never written into RoughCut's configuration file — secrets are explicitly stripped before that file is saved — and never included in an exported configuration. Each key is sent only to the provider it belongs to.
Four secrets can be stored: your Gemini key, your OpenAI key, and your Langfuse public and secret keys.
Purchases
Purchases and entitlements go through Apple's StoreKit. RoughCut does not see or store payment details.
The website
This website uses its own separately disclosed analytics, described in the Privacy Policy and controllable through Privacy Choices. Website analytics are unrelated to what happens inside the app — the app sends no telemetry to us at all.
Consent is per feature, never bundled
Accepting the Terms, buying the app, or entering an API key is not consent to send data to a third-party AI provider. Each cloud feature is opted into separately, at the point of use:
- The AI editing pass runs only when
Bad-take removalis on and a key exists. - Cloud transcription runs only for a job where you selected it.
- Langfuse runs only when you enable it and supply keys.
Common mistakes
- Believing the absolute claim. "Nothing ever leaves your Mac" is not accurate once you enable an AI feature. The accurate statement is that each path is separate, opt-in, and visible.
- Confusing the editing provider with the transcription source. Choosing Gemini for editing does not affect how audio is transcribed.
- Assuming Pro means cloud. Pro includes local features too, such as Smart Silence. Buying Pro does not send anything anywhere by itself.
- Sharing a Debug Bundle without checking it. It contains your transcript and cut decisions. Review it before attaching it to a support message.
The governing documents
This page explains behaviour. The Privacy Policy, Privacy Choices, and Terms of Use are the governing legal texts, and where they and this page differ, the legal pages govern. The app licence itself is covered by Apple's Standard EULA, with the RoughCut Terms as supplemental product terms.