Security & Privacy

This page explains how 60 Minute Creator handles your API keys, your connected accounts, and your personal data.

How your API keys are stored

When you add a provider API key in Settings > API Keys, here is exactly what happens to it:

1. It's encrypted the moment you save it. Your key goes straight into a separate encrypted store. It is never written down in plain text.
2. The main database never holds your key. It keeps only a reference to the encrypted secret, plus the last 4 characters. Those 4 characters are recorded separately at save time, so showing you the masked version never touches the real key.
3. There is no direct way to read it. The encrypted store cannot be opened with a plain lookup, by the app or by anyone else. The only way in is a small set of locked-down access routines, and each one checks that the key belongs to you before doing anything.
4. It's only decrypted at the moment of use. Decryption happens right when your workflow needs to call your provider. The decrypted key lives only in memory while that run is going, and it is never saved to disk, run history, or anywhere else.
5. Every access is logged. Each time your key is decrypted, a security log records that access.
6. You never see it again, and neither does anyone else. After saving, the app only ever shows the masked version (**** plus the last 4 characters) and the date it was last checked.
7. Deleting is complete. Removing a key deletes the reference and the encrypted secret together, in one step. Nothing is left behind.

You're always in control of your keys:

1. Add, update, or remove a key at any time from Settings > API Keys.
2. Removing a key is a two-step action: click remove, then confirm "Remove this key?".
3. A security log entry recording that a key was added or removed stays behind, but it never contains the key itself.

The same secure storage and controlled-access approach is used for your Google Drive and Dropbox connections in Settings > Connected Accounts.

Your data is also isolated from other users' accounts. What you create, upload, and generate is yours, and other users cannot see or reach it.

Google Drive access

When you connect Google Drive, the consent screen only asks for enough access to show your files and work with the ones you choose. That means:

• 60 Minute Creator can view your Drive files' names and thumbnails so the file picker can show you what to import.
• 60 Minute Creator can only change or download the contents of files it created or that you explicitly pick.

You can disconnect Google Drive at any time from Settings > Connected Accounts.

Dropbox access

Dropbox works the same way from your side: you connect your account once from Settings > Connected Accounts, and from then on you can import files you choose from Dropbox into your media library, and export media you generate back out to Dropbox. You can disconnect Dropbox at any time from the same screen.

What personal data we collect

• Account details: your email address and name (from your sign-up), plus your timezone.
• Preferences: your light/dark mode choice and your default AI provider.
• Billing: if you subscribe to a paid plan, your email and name are shared with our payment processor to set up billing. Your card details are handled and stored by the payment processor, not by us.
• Connected accounts: if you connect Google Drive or Dropbox, we store the email address that provider reports for the connected account.
• Product usage: we collect basic usage analytics (pages viewed, actions taken) tied to your account once you're signed in, so we can understand how the product is used and improve it. Session recordings, if used, mask all typed input, so anything you type (like prompts or keys) is never visible in a recording.

Account and data deletion

Account settings, including closing your account, are managed through the account menu (click your profile icon in the sidebar, then Manage account).

When your account is deleted:

• Your account record is removed.
• Everything tied to your account (your workflows, media, connected accounts, and saved API keys) is removed along with it.
• Your generated media files are cleared out from storage as part of the same process.
• This is safe to happen more than once, so nothing goes wrong if a deletion is retried behind the scenes.

Some records are kept in a de-identified form rather than deleted outright: a small internal security log keeps a record that an action happened (for example, that a key was added or removed) but with your identity stripped out, so it can no longer be tied back to you.

FAQ