Privacy Controls

modelBridge is designed with a local-first approach. Your creative work — prompts, generated media, project structure, file paths — stays on your machine. The plugin sends only what’s necessary to generate AI content (via fal.ai) and nothing else by default.

Where your video goes (and where it doesn’t)

Every editing tool — silence removal, cuts, timeline work — runs on your machine. The AI features that need to actually see or generate footage (visual scan, generative AI) are separate, opt-in per action. You decide what leaves your computer, and when.

What runs on your machine

Feature	Where it runs
Silence detection & timeline cleanup	Your computer, via ffmpeg
Timeline edits (cuts, ripple, trim)	Premiere, on your machine
Timeline scans (offline media, gap detection, LUT consistency, dailies prep)	Reads project metadata locally — no media content leaves
Agent chat about editing	Timestamps and clip names go to Anthropic through your own key. Your video file never does.
License checks & error reports	No media. No prompts. No timeline content.

An editor who uses only these features never sends footage to any external server.

What uses the cloud, and when

Feature	What it sends	When
Visual scan (looking at footage with Claude)	A handful of small sampled keyframes — never the full clip	Only when you explicitly ask Claude to look at footage
Generative AI (Generate tab)	Your media, to fal.ai	Only when you use the Generate tab

Both are opt-in per action. Skipping them entirely does not disable anything else.

When you want AI to see your footage

Sometimes you want Claude to actually look at your footage — “find shots where the subject is smiling,” “pick the takes with the best lighting.” modelBridge’s visual scan handles that. When you run it, a small set of sampled keyframes goes to Anthropic for the scan — never the full video file. Anthropic doesn’t store them. The scan stays under your control: you decide when it runs, on which clips, and with which prompt.

For NDA work, you can skip visual scan entirely and still use every cleanup feature. They don’t need to see your footage. See the NDA editing guide for a full feature-by-feature safety card and a paragraph you can hand to legal.

What is never transmitted

Regardless of any setting, modelBridge never sends:

• Your prompts or negative prompts
• File paths or file names
• Generated media or previews
• API keys (fal.ai or Anthropic)
• License keys
• Project or sequence names
• Search queries
• Chat messages (Agent Mode conversations go to Anthropic via your own API key — never through modelBridge servers)

Error telemetry (opt-in)

When something goes wrong during a generation, modelBridge can send a minimal error report to help improve the plugin. This is off by default — you must explicitly enable it in Settings.

What is sent

• Error type and source (e.g., “validation error from fal.ai”)
• HTTP status code
• A truncated error message (maximum 300 characters)
• Model ID (which model was involved)
• Whether the error was retryable
• Plugin version, host app version, and platform (macOS)

What is scrubbed

Before any error report is sent, PII is automatically removed:

• Email addresses
• URLs and file paths
• API tokens and keys

How to enable or disable

Go to Settings in the plugin. The error telemetry toggle controls whether error reports are sent. Turning it off stops all error reporting immediately — no data is queued or sent retroactively.

Behavioral analytics (opt-in)

Separate from error telemetry, modelBridge offers behavioral analytics that track usage patterns — which features you use, how often, and in what order. This is also off by default.

What is sent

• Feature usage events (e.g., “opened Dual Mode”, “exported CSV”)
• Event timestamps
• An anonymous installation ID (a hash derived from browser signals — not linked to your identity, fal.ai account, or license)

What is never sent

• Prompt content, file content, or media
• API keys, license keys, or account identifiers
• Model outputs or generation results

How to enable or disable

Toggle behavioral analytics in Settings. When disabled, no events are collected, queued, or transmitted.

Installation ID

If you enable behavioral analytics, modelBridge generates an anonymous installation ID — a 16-character hex string derived from a SHA-256 hash of stable browser signals. This ID:

• Cannot be traced back to you, your fal.ai account, or your license
• Is stored locally in your browser’s localStorage
• Is only transmitted if behavioral analytics is enabled
• Changes if you clear your browser data

Where your data lives

All modelBridge data is stored locally:

Data	Storage	Survives updates
Installed models	localStorage + disk file	Yes
Generation history	localStorage + disk file	Yes
Cost history	localStorage + disk file	Yes
Learned constraints	localStorage + disk file	Yes
Settings & preferences	localStorage + disk file	Yes
API keys	Local .env file (fal.ai) / localStorage (Anthropic)	Yes
License state	localStorage + disk file	Yes

Disk files are stored in a data directory outside the extension folder, so they survive plugin updates and CEP cache clears.

GDPR rights

You can request deletion of any data modelBridge holds about you. Since almost all data is local, you control it directly. For server-side data (if you’ve opted into telemetry), contact us to request deletion.

The plugin does not use cookies, does not fingerprint users, and does not share data with third parties beyond fal.ai (for generation) and Anthropic (for Agent Mode, using your own key).

See also

• Privacy Policy — full legal privacy policy
• Settings Tab — where to find telemetry toggles
• Agent Mode — how Agent Mode conversations are handled