Studio Privacy Policy

Overview

Studio is a native macOS creative production workspace by Mountain Meadow Systems. Studio is local-first, but features that a user deliberately starts can send selected content to third-party AI providers or, for certain reference-frame workflows, through Mountain Meadow Systems' temporary reference-media relay.

This policy describes those data flows, their purposes, the controls available to users, and the limits of Mountain Meadow Systems' control over third-party providers.

Local Projects And Credentials

Studio stores projects locally in user-selected .studio packages. A package can contain project metadata, imported media, generated outputs, captions, transcripts, exports, cache files, prompts, provider jobs, provider request and response snapshots, logs, timelines, and related project state.

Provider API keys are supplied by the user and are intended to be stored in the macOS Keychain. Mountain Meadow Systems does not receive those keys through this website or the reference-media relay. Users can remove keys in Studio or Keychain and can delete local projects from their Mac.

AI Providers

Adding a provider credential does not send project content by itself. When a user starts a provider-backed feature, Studio sends only the prompt, script, dialogue, settings, selected project context, and selected image, video, or audio inputs needed for that request. Studio does not upload the entire .studio project package.

• OpenRouter: Studio can send prompts, settings, selected context, and selected reference media to OpenRouter and the upstream model provider selected through OpenRouter.
• ElevenLabs: Studio can send supported speech, dialogue, transcription, voice, and audio inputs and settings to ElevenLabs.
• Runway: A source-video edit can send the edit prompt, a provider-accessible source-video URI, optional timed guidance keyframes, and the requested output aspect ratio. Studio prepares timeline source video without its existing timeline audio; that audio stays local and unchanged. When Runway needs a reachable source URL, Studio may first use the temporary reference-media relay described below. That relay is conditional and is not used for every installation or workflow.
• MiniMax: Video generation can send the video prompt and settings plus selected reference images, source or reference video, and reference audio. Studio uploads selected reference media directly to MiniMax as video-generation input.

Providers generate or temporarily host outputs before Studio downloads them into the local project. Runway says its API customer data is not used for model training, but that does not mean Runway stores nothing or that every Studio user has Zero Data Retention; Runway presents Zero Data Retention as an enterprise capability. Runway ephemeral-upload URIs are usable for approximately 24 hours, and API output URLs ordinarily expire approximately 24–48 hours after API access. See Runway's Privacy Policy, Data Security, input documentation, and output documentation.

MiniMax does not publish a blanket no-training or Zero Data Retention protection for these requests. Its API privacy policy permits aggregated, anonymized, or deidentified analysis and service improvement. Video-generation input files can remain valid for up to seven days. MiniMax provides file-deletion and task-deletion endpoints, but Studio does not currently delete every input file automatically after a successful operation, deletion may not be immediate, and a running task cannot be cancelled. See MiniMax's API Privacy Policy, Terms of Service, and file-upload and retention documentation.

As of the effective date, OpenRouter account controls for provider training, publication, and related data sharing are disabled. Universal Zero Data Retention enforcement is not enabled because the current video route requires endpoints that would be unavailable under that restriction; individual requests can therefore be subject to provider retention. The current ElevenLabs Starter account exposes no Zero Retention Mode control, so Studio does not treat ElevenLabs requests as zero-retention. Studio uses request-level privacy settings only when the endpoint and account support them.

Provider processing and retention can include service operation, moderation, security, analytics, legal compliance, and service improvement. Provider accounts, request metadata, content history, training choices, moderation records, generated or hosted output, backups, and deletion are governed by the selected provider's current policy, API behavior, upstream provider, account agreement, and legal obligations. Deleting Studio-controlled relay data, a local credential, or a local project does not delete provider-held data.

Temporary Reference-Media Relay

Some First Frame and Last Frame video workflows require an HTTPS URL that the selected AI provider can fetch. After the user's first affirmative confirmation, Studio may send the selected reference frames to media.mountainmeadowsystems.com. The relay creates a temporary provider-accessible URL and is not AI compute, a credit system, advertising, or Studio-owned analytics.

For authorization, Studio sends an Apple-signed AppTransaction proof plus app version, build, bundle, channel, and platform metadata. The relay verifies the signed proof in memory. It does not store the raw proof, a full App Store receipt, provider keys, original filenames, local paths, prompts, raw IP addresses, upload tokens, media capabilities, or delete tokens. It stores keyed digests and a keyed pseudonymous subject derived from the verified AppTransaction identifier.

The relay processes the request IP address in memory for rate limiting and stores only short-lived keyed network buckets. Access logging is disabled for the versioned relay routes. Sanitized security events contain bounded event type, reason, status, environment, byte-range category, and keyed network-bucket data; they exclude request content and secrets.

Relay Retention And Deletion

• An upload token is valid for one hour.
• Reference media becomes unavailable after no more than six hours and is physically removed by cleanup scheduled every fifteen minutes. An explicit delete or permission reset can remove active media earlier.
• Expired or revoked token rows are removed no later than 24 hours after token expiry.
• Keyed rate-limit buckets are removed after two hours.
• Sanitized security events are removed after 14 days.
• An inactive keyed pseudonymous subject is removed after 30 days.

Mountain Meadow Systems does not create separate application-level backups of relay media or the versioned relay database. Infrastructure backups, if enabled by the hosting provider, are governed by that provider's account configuration and retention schedule; deletion from an active system may not immediately remove an existing infrastructure backup copy.

Consent And Privacy Choices

Studio asks before the first relay-backed reference-frame transfer and remembers the choice locally for the disclosed recipients, data, purpose, and retention terms. Canceling the confirmation prevents the relay and provider transfer. Choosing Reset AI & Relay Permissions in Studio Settings > Privacy blocks future applicable transfers until the user confirms again and starts a best-effort request to revoke active relay tokens and delete active Studio-controlled relay media.

See Studio Privacy Choices for local deletion, relay permission reset, provider-account deletion, and contact options.

Apple And Subscriptions

Apple processes Mac App Store downloads, subscription purchases, billing, refunds, and subscription management under Apple's terms and privacy policy. Studio uses StoreKit transaction information locally to determine subscription access. The reference relay uses the minimized Apple-signed AppTransaction proof described above only to authorize the relay, not to collect payment information.

Support And Website Data

If a user emails support, Mountain Meadow Systems receives the information the user chooses to send, such as an email address, message, Studio build, macOS version, screenshots, logs, project details, or attachments. Users should avoid sending provider keys, access tokens, or private project media unless specifically necessary and authorized.

The Mountain Meadow Systems website and its hosting provider may process ordinary operational data such as IP address, request time, requested URL, browser user agent, and error information. Studio and this website do not use advertising tracking.

Contact And Changes

For privacy questions, email patrick@mountainmeadowsystems.com. Material policy changes will be reflected by a new effective date and, when they change the remembered reference-frame disclosure, Studio will require confirmation again.