What DigiFX encrypts, what we deliberately never store in readable form, and where your data goes when it leaves our systems. The authoritative document is the DigiFX Privacy Policy; this page explains the mechanics behind it.
01Encryption in transit, and at the payment boundary
All traffic to and from the Media Console is encrypted in transit with TLS. The Console additionally checks at runtime that it is executing in a secure browsing context and reports the result on your Security page, so a downgraded connection is visible to you rather than silent.
Card details are the clearest boundary in the product. They go directly from your browser to Stripe. DigiFX never receives, stores, or processes a card number — we hold only the resulting customer reference, the amount, and what you bought. Access to stored files uses short-lived signed links measured in minutes rather than permanent URLs, and the server refuses to sign a link for a file you do not own.
02Secrets we do not keep in readable form
Several things in the Console are deliberately unrecoverable by us, because storing them in a usable form would create the exact risk they exist to prevent.
- Your password. Authentication is handled by Google Firebase Authentication. DigiFX never sees or stores your password.
- Your authenticator seed. The TOTP second factor is built and its guards are green, but it has not yet been deployed. As designed, the secret is never written to storage: a refresh part-way through enrollment means starting over — the alternative is a persisted seed, which is a second factor an attacker could take.
- Your recovery codes. Recovery codes ship with that same not-yet-deployed second factor; no real recovery code has ever been minted against the live project. As designed, they are stored only as memory-hard hashes with a per-account salt, chosen specifically so that a stolen copy cannot be ground through offline at speed. The plaintext exists for exactly one response, when it is shown to you, and is never stored, and there is no legitimate read path to those hashes, including for you.
- Your identity in crash reports. Diagnostics replace your identity with a one-way hash before storage, and email addresses and secret-shaped values are scrubbed out of error text.
03Isolation between accounts
Access to your records is enforced on the server, not in the browser. Database rules pin each account record to its owner, so one account cannot read another's data even if the client is tampered with. Administrative access is restricted to a small, explicitly listed set of named company accounts, and reaching the Console's primary database that way additionally requires a verified email address on the administrator's own account.
Almost nothing in the Console is public. There are no public profiles, no public galleries, and no social feed. The single exception is live broadcasting, which creates a public directory entry while you are on air and deletes it when you stop.
04What leaves our systems
Two things are worth stating plainly because encryption does not cover them.
Generative features send your input to Google's Gemini API. Text tools send your prompt; image tools send your prompt and the image you are working on. We do not attach your name, email, or account identifier to those requests, and we do not use your content to train models — we do not have our own models. Once something has been sent, we cannot reach back and retrieve it.
Live broadcasting is peer-to-peer. Your browser connects directly to your viewers' browsers, which means broadcasting reveals your IP address to viewers, and watching reveals yours to the host.