Privacy and data flow
A feature-by-feature account of what stays on your Mac, what leaves it, who receives it, and how to turn each one off.
RoughCut has no servers. Your original video and audio stay where they are and are read in place. On-device transcription, the default, runs entirely on your Mac and uploads nothing. The AI editing pass sends transcript text and word timing to the provider you chose, under your own key, and never your video or audio. Pro Cloud transcription is the one feature that sends audio, and only that job's audio, only to OpenAI, only when you select it for that job. Langfuse tracing is off by default and inert without your own keys. API keys live in the macOS Keychain. Every one of these paths is separate and individually switchable.
On this page
This article describes the released native macOS app. For the optional local ChatGPT/Codex plugin with compatible builds, see the integration privacy notice. The compatible native build is not yet released through the Mac App Store, and the plugin is an OpenAI draft.
The short answer
Your video is never uploaded. Not by the editing pass, not by Cloud transcription, not by anything.
Audio leaves your Mac in exactly one case: you have RoughCut Pro and you explicitly select ✦ Cloud (OpenAI) as the Transcription source for a particular job. On-device transcription is the default and uploads nothing.
Transcript text leaves your Mac when Bad-take removal is on, going directly to the AI provider you chose, under your own API key.
There is no RoughCut server anywhere in these paths. RoughCut does not operate one.
The complete matrix
| Feature | Default | What is sent | Who receives it | Billing | How to disable | Local alternative |
|---|---|---|---|---|---|---|
| Original media | — | Nothing. Read in place, never copied or re-encoded | — | — | — | — |
| On-device transcription | On | Nothing leaves | — | None | — | This is the local path |
| AI editing pass | On when a key exists | Transcript text and word timing | OpenAI, Google (Gemini) or Anthropic (Claude), your key | Your provider, directly | Turn Bad-take removal off | Silence-only cut |
| Cloud transcription | Off | That job's audio, 16 kHz mono chunks | OpenAI, your key | OpenAI, per audio minute | Select On-device | On-device Whisper |
| Video goal summarising | Off | The goal text you typed | OpenAI, Google (Gemini) or Anthropic (Claude), your key | Your provider | Do not click Summarize with AI | Shorten the goal by hand |
| Speech model download | On first use | A request for the model file | Hugging Face | None | Import the file manually instead | Import model file… |
| Langfuse tracing | Off | Run metadata and aggregate scores | Your Langfuse project | None | Leave Langfuse tracing off | — |
| Purchases | — | Handled by StoreKit | Apple | Apple | — | — |
| App Store rating request | Occasional, after repeated use | Nothing from RoughCut; Apple's own rating dialog | Apple | None | — | Help → Rate RoughCut in the App Store… any time |
Feature by feature
Your original video and audio
RoughCut reads your files where they are, through file access you grant. It never copies them, never re-encodes them, and never uploads them. The exported FCPXML is a set of cut decisions that references your original file by path. This is why moving the file after export breaks the link in Final Cut Pro.
On-device transcription — the default
Audio is extracted locally, transcribed locally with Whisper using Metal acceleration, and the transcript stays on your Mac. Nothing is uploaded and no API is billed. This requires the one-time speech model download.
The AI editing pass
When Bad-take removal is on, RoughCut sends the transcript text and word timing context directly to the provider you selected — OpenAI, Google for Gemini, or Anthropic for Claude — using your own API key. No video. No audio. No files.
If you turn Bad-take removal off, no key is needed and nothing at all is sent — RoughCut still removes silences using on-device analysis. See Bad-take removal.
Cloud transcription — the one audio path
This is a Pro feature, chosen per job, and it is the only feature that sends audio anywhere.
When you select ✦ Cloud (OpenAI) for a job, RoughCut uploads that job's audio to OpenAI's transcription endpoint under your own key. The audio is converted to 16 kHz mono and split into chunks whose boundaries land in detected silences, so a chunk never breaks mid-sentence. Your video is not uploaded — only the audio.
The picker states this on screen before you choose it. Every other job on your Mac remains on-device unless you select Cloud for it too. See On-device and Cloud transcription.
Langfuse tracing
Off by default and completely inert unless you turn the toggle on and supply both your own Langfuse project keys. When enabled, it sends run metadata — run identifier, mode, clip counts, outcome — and aggregate scores to your own Langfuse project. It does not send media, transcript text, or API keys.
If you are privacy-sensitive, leave it off. It is not needed for any editing feature. In the App Store build there is no way to enter the two keys it requires — those fields sit in the development-only Evals group — and the evaluation runs that emit traces cannot be started there either, so this path is unreachable. See Connect Langfuse tracing.
Where secrets live
API keys are stored in the macOS Keychain, encrypted by the system. They are never written into RoughCut's configuration file — secrets are explicitly stripped before that file is saved — and never included in an exported configuration. Each key is sent only to the provider it belongs to: OpenAI, Google or Anthropic.
In the App Store build three keys can be stored: your OpenAI key, your Gemini key and your Claude key. The schema also has Langfuse public and secret key fields, but they sit in the development-only Evals group.
Purchases
Purchases and entitlements go through Apple's StoreKit. RoughCut does not see or store payment details.
After you have exported a few jobs over at least a week, RoughCut may occasionally ask the system to show Apple's rating request — at most once per version, and never more often than Apple's own limits allow. The dialog is Apple's; RoughCut sends nothing, and it never learns whether you rated it or what you wrote. Only a local record of when it last asked is kept. Help → Rate RoughCut in the App Store… opens the App Store review page directly, any time.
The website
This website uses its own separately disclosed analytics, described in the Privacy Policy and controllable through Privacy Choices. Website analytics are unrelated to what happens inside the app — the app sends no telemetry to us at all.
Consent is per feature, never bundled
Accepting the Terms, buying the app, or entering an API key is not consent to send data to a third-party AI provider. Each cloud feature is opted into separately, at the point of use:
- The AI editing pass runs only when
Bad-take removalis on and a key exists. - Cloud transcription runs only for a job where you selected it.
- Langfuse runs only when you enable it and supply keys.
Common mistakes
- Believing the absolute claim. "Nothing ever leaves your Mac" is not accurate once you enable an AI feature. The accurate statement is that each path is separate, opt-in, and visible.
- Confusing the editing provider with the transcription source. Choosing Gemini or Claude for editing does not affect how audio is transcribed.
- Assuming Pro means cloud. Pro includes local features too, such as Smart Silence. Buying Pro does not send anything anywhere by itself.
- Sharing a Debug Bundle without checking it. It contains your transcript and cut decisions. Review it before attaching it to a support message.
The governing documents
This page explains behaviour. The Privacy Policy, Privacy Choices, and Terms of Use are the governing legal texts, and where they and this page differ, the legal pages govern. The app licence itself is covered by Apple's Standard EULA, with the RoughCut Terms as supplemental product terms.