Privacy Policy

Last updated: 10 November 2026.

This policy explains how ERH Capital Partners LLC ("DashShorts", "we", "us") handles personal information when you use the DashShorts website at dashshorts.io (and dashshorts.com, which redirects to it) and the DashShorts app at app.dashshorts.io, where you make videos.

1. Who we are and how to contact us

ERH Capital Partners LLC runs DashShorts.

• Privacy questions and requests, and account or billing support:[email protected]
• General questions: [email protected]
• Copyright notices: [email protected] (see ourTerms)

2. What we collect

2.1 Your account

• Email address. You sign in with a one-time 6-digit code that we email to you. There is no password.
• Profile and settings: display name (if you set one), your notification choices ("email me when a video is ready", "product news and offers"), whether and when you turned on AI data sharing, plan and credit balance, and the credit history (what was charged or returned, and when).

2.2 What you create

• Ideas, scripts and storyboards: the topic, story or script you type, the script and storyboard we write from it, and your edits, voice choice, caption style, format, length and music choice.
• Pictures you choose: stock pictures or clips you pick in the storyboard, and AI pictures or clips made for your video.
• Finished videos and posters (the still image shown before a video plays).
• Reports you send about a video: the reason and any details you type.
• Uploads. The app does not let you upload files today. Your input is text, and the pictures come from stock libraries or AI.

2.3 Data collected automatically

• Sign-in and device cookies: see section 6.
• Abuse and free-use limits: to stop people from taking free credits or AI tries over and over, we store a one-way, keyed hash of your network (IP) address and of a random device ID kept in a cookie. We do not store the raw IP address for this purpose.
• In-app activity events: the app records simple events (for example "viewed the sign-in page" or "chose a sign-in method") in our own database, so we can see where the app works and where it breaks. These events are not sent to an ad network.
• Website analytics: dashshorts.io uses Cloudflare Web Analytics, a cookieless tool that counts page views and performance and does not receive your email address. The app at app.dashshorts.io does not load it.
• Security and server logs: our hosting provider (Cloudflare) processes IP addresses, browser details and request logs to deliver the service and to block attacks. We use Cloudflare Turnstile to check that you're a person.

2.4 Payments

If you buy a plan or credits, Stripe processes the payment. We don't see or store your full card number. We store your Stripe customer ID, what you bought, your plan status, and renewal or cancellation dates.

2.5 Old waitlist records

Before the app launched, dashshorts.io had a waitlist form. That form is gone. We still hold the rows people submitted (email, the form used, campaign and referrer fields, the country Cloudflare reported, optional first name, where you post and what kind of creator you are, plus confirmation and unsubscribe timestamps) so we can honor unsubscribes. You can ask us to delete yours (section 9).

2.6 TikTok, if you connect it

If you connect a TikTok account, we receive the basic profile information and tokens in section 13. We don't receive them unless you connect.

3. How we use it

• To create your account and sign you in.
• To make your videos: writing scripts, checking requests against our content rules, generating voiceovers, finding stock clips, making AI pictures and video, adding music, and rendering the file.
• To store your videos so you can play, download, re-render and share them.
• To run credits, free allowances, limits and billing.
• To prevent fraud, abuse and repeat free-tier signups, and to keep the service secure.
• To email you about your account: sign-in codes, "your video is ready" or "didn't finish", report outcomes, and account deletion. We send product news only if you turn it on.
• To review reports and enforce our Terms.
• To understand and improve the product (in-app events, website analytics).
• To meet legal, tax and accounting duties.
• If you connect TikTok: to show which account is connected, and to publish videos you explicitly approve (section 13).

4. AI processing

Making a video sends your idea, script and storyboard text to AI providers. AI pictures and AI video also send the related prompts and pictures. Those providers process the content to return a result to us. We don't send your email address with these requests.

AI data sharing setting. The app asks for your consent before it sends your content to AI providers. You can see that setting, and withdraw it, under Account › Privacy and AI. If you withdraw, the app can't make new videos until you turn it back on.

5. Who we share it with (service providers)

We share personal information only with the providers below, and only as needed to run DashShorts. We do not sell personal information and do not share it for cross-context behavioral advertising.

• Supabase: sign-in (one-time email codes) and our main database. Receives your email address, account, profile, video and credit records, and events.
• Cloudflare: hosting for the site and app, the render servers, video and picture storage (R2), DNS, email forwarding, Turnstile bot checks and Web Analytics. Receives IP address, request data, stored videos, posters and pictures, and mail sent to @dashshorts.io addresses.
• OpenAI: writing scripts and storyboards, checking requests against content rules, AI pictures, and a backup voice when ElevenLabs is unavailable. Receives idea, script and storyboard text, picture prompts, and voiceover text (backup only).
• ElevenLabs: voiceovers. Receives your script's spoken text and the voice you chose.
• fal.ai: AI video clips. Receives scene pictures and the prompt text for each AI-video scene.
• Pexels: stock video and photo search. Receives search words drawn from your script. No account details.
• Resend: sending email (sign-in codes through Supabase, video-ready and account emails, admin alerts, and old waitlist confirmation and unsubscribe emails). Receives your email address and the message.
• Stripe: payments, subscriptions, receipts and tax. Receives the payment details you enter at Stripe, your email and your purchase history.
• TikTok: only if you connect an account and approve a post. We send that video to TikTok. Section 13 describes the profile details and tokens we receive, and how you disconnect.

Music in the DashShorts library was made ahead of time with AI (Stable Audio 2.5 through fal.ai). Choosing music does not send any of your data to a music provider.

We may also disclose information if the law requires it, to protect rights and safety, or as part of a merger, sale or reorganization of the business.

6. Cookies and similar technologies

App (app.dashshorts.io):

• __Host-zs_session and __Host-zs_refresh: keep you signed in (up to 30 days). Strictly necessary.
• ds_device: a signed random ID used only for abuse and free-use limits (lasts 1 year).
• Cloudflare Turnstile may set its own cookies or use similar technology to check that you're a person.

Website (dashshorts.io):

• Cloudflare Web Analytics sets no cookies.
• Advertising pixels (Meta and TikTok) are off. Connecting a TikTok account to publish a video (section 13) is separate from these pixels and does not turn them on. If we ever turn the pixels on, the site will show a banner and load them only after you click Accept. Your choice is kept in your browser's local storage.

7. How long we keep it

• Account and profile: while your account is open.
• Videos, scripts and storyboards: while your account is open, until you delete them. Storyboard drafts are cleared automatically on a schedule. Quick edits are available for 30 days after a video is made.
• After you delete your account: your videos, scripts and settings are erased within 30 days.
• TikTok connection data: deleted when you disconnect, and when you delete your account. See section 13.
• Payment and tax records: as long as tax and accounting law requires.
• Abuse-prevention hashes, in-app events and reports: as long as we need them for the purposes above.
• Old waitlist rows: until you ask us to delete them.
• Server logs at Cloudflare: per Cloudflare's retention.

8. Security

Sign-in uses one-time codes. Session cookies are HttpOnly and Secure. Videos are stored privately and played through links that expire after 10 minutes. API keys stay on our servers. No method is perfectly secure, so we can't guarantee absolute security.

9. Your choices and rights

• Delete your account: Account › Delete account. We email you a confirmation.
• Delete a video: use its ⋯ menu › Delete.
• Email: turn product news off under Account › Notifications. Sign-in and account emails are still sent.
• AI data sharing: withdraw under Account › Privacy and AI.
• TikTok: disconnect on the posting screen, or revoke access in TikTok's settings. See section 13.
• Access, correction, a copy of your data, or deletion: email[email protected].
• Old waitlist rows: email[email protected] to have yours deleted.

10. Children

DashShorts is not for children. You must be at least 13 to use the app, and 18, or have a parent's permission, to buy credits. We don't knowingly collect information from children under 13. If you think a child has given us information, email [email protected]and we will delete it.

11. International users

DashShorts is run from the United States, and our providers may process data in the US and other countries.

12. SMS / Text Messaging

The /sms-alerts page lets the DashShorts account owner opt in to automated operational texts. Text alerts are only sent to people who opted in. Message frequency varies, up to 10 msgs/day. Message and data rates may apply. You can reply STOP to opt out or HELP for help.

Mobile numbers and SMS consent are not shared with or sold to third parties or affiliates for marketing purposes.

13. TikTok Login and posting

You can connect a TikTok account in the app when you want DashShorts to publish a video for you. Connecting is optional. This is not the TikTok advertising pixel in section 6. That pixel stays off, and connecting an account does not turn it on.

When you connect TikTok, we receive basic profile information: your open ID, display name and avatar. We also receive an access token and a refresh token. The scopes are user.info.basic, video.publish and video.upload.video.upload is used to upload a video you chose to your TikTok account as a draft or for posting, only with your approval.

We use this only to show which account is connected, and to publish videos you explicitly approve.

We store the tokens encrypted. We never share them or sell them.

You can disconnect at any time from the posting screen. Disconnecting revokes the tokens and deletes them. You can also revoke access in TikTok's settings. You can also email [email protected] and ask us to delete this data.

We delete this data when you disconnect, and when you delete your account.

14. Changes

If we change this policy in a material way, we will update the date at the top and notify account holders by email or in the app.