Last updated: 16 July 2026
The short version: Smirk is built to know as little about you as possible, everything it does store is scoped to what you explicitly save or share, and you can permanently delete all of it yourself, at any time, in one tap, no email, no waiting.
Smirk is the data controller for the personal data described below. For any privacy request or question, use the contact details published on this site, we respond to access, correction, deletion and objection requests within one month, as required by Article 12 GDPR.
By default, your scripts, cast, and settings live only in your own browser (localStorage) and never reach our servers. The moment you tap Save or Share, the script text, character/contact names, and any cast photos you uploaded are stored on our server (Supabase) so the link works for whoever opens it, and so you can find the project again. A cast photo is resized to at most 250×250px and compressed before upload; nothing else in the photo (metadata, location, etc.) is kept beyond that resized copy. A short link's content is readable by anyone who has the exact link, links are not listed, searchable, or discoverable, but they are not private in the way a password-protected file is.
A share link you create but never save to an account is automatically and permanently deleted after 90 days. A project you save to My Projects (with or without a Google account) is kept until you delete it or delete your account, we don't otherwise cap this, because it's content you've told us you want kept. Deleting a project, or your account, removes the underlying content immediately, not just its listing.
Every visitor gets an anonymous, unnamed session automatically so Save/Share work with no signup. If you choose "Sign in with Google," that Google identity (name, email, profile photo) is linked to your existing anonymous session so your existing and future projects sync across your devices, we show you what this means the first time you do it. We never post, message, or share anything on your behalf, and we don't request any Google scope beyond basic profile/email.
Under GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. Most of this is self-service: open Settings → "Delete my data" to permanently and immediately erase your account, every saved project's content, and every uploaded photo, this also invalidates any share links to those projects. For anything the interface doesn't cover (e.g. a copy of your data, or a question about a specific request), contact us using the details on this site; we'll respond within one month.
We use PostHog, configured to be as minimal as we can make it: no cookies (device-local storage only), no cross-site tracking, no session recording, no automatic click/keystroke capture, only a small number of explicit product events (e.g. "exported a video"), and anonymous visitors are never assigned a tracked profile. Analytics traffic is routed through our own domain rather than PostHog's directly. You can turn this off entirely in Settings → Privacy at any time; turning it off takes effect immediately and doesn't affect anything else in the app.
We use a small number of infrastructure providers to run the Service, each acting as our processor under a data processing agreement: Supabase (database, file storage, authentication), Vercel (hosting), PostHog (product analytics, see above), and Google (optional sign-in). We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
Our infrastructure providers may process data outside the EU/EEA (e.g. the US). Where that happens, it's covered by Standard Contractual Clauses or an equivalent safeguard under GDPR Chapter V, provided by that processor.
The site is served by our hosting provider, which processes standard technical data (such as IP addresses in server logs) to deliver the site and protect it against abuse.
To exercise a right not covered by Settings, or for any other question about your data, use the contact details published on this site. If you believe we haven't resolved your request properly, you also have the right to lodge a complaint with your local data protection authority.