CLIPS

Last updated: 9 September 2026 Version 1.0

Operator: Simone Bellini · Contact: simonebellini2012@gmail.com · Jurisdiction: Italy / EU

This is a private, invite-only service for friends. By registering or using Clips you agree to everything below. If you don't agree, don't create an account.

Part A — Terms of Service

1. What Clips is

Clips ("the Service") is a privately-run cloud for sharing photos and video clips between friends. Every registered user sees the same shared library: anything you upload is visible to every other member, together with your username as the uploader.

Key facts:

Images and videos only, 500 MB max per file, up to 20 files per upload batch.
Only the uploader can delete their own files (via Delete button / DELETE /api/files/:id).
Accounts: username + password (min. 8 characters). Login sessions are JWT tokens valid for 7 days.
This is a best-effort hobby / friends project — no uptime, backup, or availability guarantees.

2. Who may use it

Private circle only. Do not share invite / tunnel / domain links publicly. The operator may disable open registration at any time.
You must be at least 16 years old (or the age of digital consent in your country), or have a parent/guardian's permission.
One account per person. Usernames must not impersonate others or be offensive.
You are responsible for keeping your password secret and for everything done under your account. Tell the operator immediately if you suspect misuse.

3. Your content — rights & responsibility

You keep ownership of what you upload. By uploading, you grant the other members and the operator a licence to view, stream, and download it inside Clips only.
Only upload content you own or have permission to share — especially when other people (friends, kids, strangers) appear in photos/videos. Get their consent first.
Everything you upload is attributed to you (@username). Think before you post: the whole group can see and download it.
Do not re-share another member's clips outside the group without their explicit permission.

4. House rules — acceptable use (zero tolerance)

The following will get content removed and accounts banned, and may be reported to the authorities:

Illegal content of any kind, including CSAM (sexual content involving minors) — strictly prohibited.
Non-consensual intimate imagery, stalking, harassment, hate speech, or threats.
Copyrighted movies, sports streams, music, or other material you have no right to share.
Malware, phishing, spam, or attempts to break into the service, other accounts, or the server (brute force, token theft, path traversal, etc.).
Anything that puts the operator's hosting, domain, or tunnel provider (e.g. Cloudflare) at risk.

Login and registration are rate-limited (10 attempts per IP per minute). Abuse of the upload API, scraping, or automated mass downloading is not allowed.

5. Encryption — what it does and doesn't do

Files are encrypted at rest with AES-256-GCM (per-file random IV, random storage IDs, encrypted filename/owner index). Plaintext temp files are securely wiped.
This protects against disk theft / casual snooping. It does not mean zero-knowledge: the server decrypts files to serve them, so the operator can technically access content.
If the file-encryption key (FILE_ENCRYPTION_KEY / data/.filekey) is lost, all files are permanently unrecoverable. The operator keeps a backup, but users should keep their own copies of anything important.
Traffic is protected by HTTPS at the Cloudflare edge and/or direct TLS when enabled. Don't use the service over untrusted networks without HTTPS.

6. Deletion & retention

Deleting a file removes its index entry and securely wipes the ciphertext. It does not delete copies other members already downloaded.
Accounts with no activity may be pruned at the operator's discretion. Ask the operator if you want your account + (your) files deleted.
Server logs (if any) are kept short-term for debugging/abuse prevention only.

7. Availability, warranty, liability

The Service is provided "as is", without warranties of any kind. The operator may update, suspend, or shut it down at any time without notice.
To the maximum extent permitted by law, the operator is not liable for lost files, loss of access (e.g. lost encryption key), interruptions, or any indirect damages.
You use the Service at your own risk. Keep independent backups of anything irreplaceable.

8. Enforcement

The operator may remove any content and suspend or permanently ban any account that violates these terms, without prior notice. Serious illegal content will be preserved as required by law and reported.

9. Changes to these terms

Terms may be updated (the version/date at the top will change). Continued use after changes means acceptance. Material changes will be announced in the group chat / on the login page where reasonable.

10. Contact & governing law

Operator: Simone Bellini — simonebellini2012@gmail.com. These terms are governed by the laws of Italy. Disputes should first be resolved amicably within the group.

Part B — Privacy Policy

1. Data controller

Controller: Simone Bellini, simonebellini2012@gmail.com. This is a private non-commercial service among friends, but we still handle your data carefully.

2. Data we store

Data	Why	How stored
Username + bcrypt password hash + creation date	Login / account identity	AES-256-GCM encrypted (`users.json.enc`)
Uploaded files (bytes), original filename, MIME type, size, upload date, owner	Shared library	Files AES-256-GCM encrypted under random IDs; index encrypted (`files.json.enc`)
Login JWT (on your device only)	Keep you logged in for 7 days	`localStorage: clips_token` — never a cookie
Backend URL override (optional)	Custom API host	`localStorage: clips_api`
IP address + login attempt counts	Rate-limiting / brute-force protection	In-memory only, resets every minute

We do not use analytics, trackers, ads, or third-party cookies. No profiling.

3. Who can see your data

All members can see every file, its name, size, and your username.
The operator/host can technically access all stored data (server decrypts on serve) for administration, moderation, and backups.
Infrastructure providers that carry the traffic (e.g. Cloudflare Tunnel, your ISP, host network) may see metadata (IPs, TLS SNI, timing) but not file contents when HTTPS is on.
We never sell data and never share it outside the group, except if required by law.

4. Legal basis & retention (GDPR)

Basis: consent + contract (you asked for an account to share clips with friends) and legitimate interest (security, abuse prevention).
Files and accounts are kept until you (or the uploader) delete them, or the operator shuts down / prunes the service.
Your rights: access, rectification, erasure, restriction, portability, objection. To exercise them, contact simonebellini2012@gmail.com. You can also self-serve: delete your own files, ask for account removal.
EU users may complain to their supervisory authority (in Italy: Garante per la protezione dei dati personali).

5. Security measures

AES-256-GCM encryption at rest, bcrypt (cost 12) password hashing, 7-day expiring JWTs, login rate-limiting, security headers (nosniff, DENY framing, no-referrer, restricted permissions-policy), Cache-Control: no-store on API/media.
No system is perfect. Use a unique password, log out on shared devices (Logout discards your token), and don't upload highly sensitive documents.

6. Children

If children appear in shared family/friends clips, upload only with parental consent. Anyone under 16 needs a parent/guardian's permission to hold an account.

7. Changes to this policy

Updates will be posted here with a new date/version. Continued use means acceptance.

Note: this page is a plain-language policy for a private friends-only service, not legal advice. If the service becomes public or handles sensitive data at scale, have a lawyer review it.

← Back to Clips