Your archive stays yours.

The desktop application

ClipVault Local is a desktop app with a local database. There is no ClipVault account, no sign-in, and no server of ours that your library is sent to.

• Originals are read-only. The app never deletes, moves, renames, overwrites or writes metadata into your source media. Scans open files for reading only.
• No media upload by default. There is no code path that sends your files to us. The one way media can travel is a source you configure yourself — see cloud sources.
• No telemetry. The application ships without analytics, usage tracking or crash reporting to us.
• It works offline. Scanning, indexing, searching, grading and browsing need no network connection.

Where your data lives

Everything ClipVault derives lives in one directory on your machine, separate from your media:

~/.clipvault/
  index.sqlite     # the library index: metadata, tags, embeddings, projects
  cache/           # thumbnails, keyframes, previews
  exports/         # CSV/JSON exports you asked for
  logs/

You can point this somewhere else with the CLIPVAULT_DATA_DIR environment variable. Deleting the directory removes everything ClipVault knows; your originals are untouched by that, as by everything else.

Cloud sources are read-only, and yours

ClipVault can index a bucket you own — your S3, or an S3-compatible service. This is opt-in, per-source, and constrained:

• The storage client is read-only. It lists and fetches; it has no write, delete or copy path, and a test in the repository asserts that.
• Scans are byte-budgeted — ClipVault prefers a provider thumbnail, then a ranged read of just the header it needs, and defers assets that would cost more than the budget allows rather than pulling whole files silently.
• Credentials go into the macOS Keychain in-process. Only the Keychain item name is stored in the database, and credentials are never passed as command-line arguments where another process could read them.
• Everything derived from a cloud source — previews, keyframes, metadata — is still stored locally.

AI processing happens on your machine, on small derivatives

Visual search uses OpenCLIP embeddings computed locally. They are computed from the small derivatives — roughly 512-pixel thumbnails and keyframes — not from your full-resolution 4K or RAW files. Nothing is sent to a hosted model, and there is no API key to configure because there is no external service involved.

Automatic per-asset creative summaries are not implemented yet. When they are, the same rule applies: local processing on derivatives, or the feature does not ship.

Licensing (planned)

The current developer preview contains no licensing, trial or activation code. When licensing ships, these are the constraints it will be built under:

• A licence check may need occasional connectivity. It will not require a permanent connection.
• A licence check will never transmit the contents, filenames, paths or metadata of your media library.
• Trial expiry will never delete, encrypt or lock your indexed work. The library stays browsable and a valid licence restores paid functionality immediately.
• Licensing identifiers will not be mixed with website analytics.

This website

dgtl.mov is a set of static pages. As shipped:

• No analytics, no cookies, no fingerprinting, no advertising trackers. Nothing is set in your browser by these pages.
• No third-party requests at all. Every byte — stylesheets, scripts, images, and the Manrope typeface — is served from this domain. No font CDN, no tag manager, no embedded video player. A site whose argument is that nothing leaves your machine should not be telling anyone else who reads it.
• The web server's ordinary access logs are the only record that a visit happened.
• The one page that collects anything is the early-access application — described in full below.

The early-access form

This is the only place on the site where you give us anything, so here is all of it.

What it collects

Your name and email address, which are required because we cannot reply without them, and optionally your company, your role, a rough archive size, and whatever you write in the free-text box. Nothing else. There is no hidden field, no tracking pixel, and no profile built from your visit.

Your IP address is not stored. It is counted in memory to rate-limit abuse and is never written to disk; that counter is discarded when the service restarts.

Where it goes

To a DGTL server — the same machine that serves this page — and nowhere else. The form posts to this domain, not to a form service, a CRM or a marketing platform. That is deliberate: routing your details through a third party on a page arguing for data sovereignty would be a contradiction, and it would break the no-third-party-requests property above. Applications are stored as a plain append-only file readable only by the service account.

What we do with it

We read it, and we email you about ClipVault early access. That is the whole list. You will not be added to a newsletter, enrolled in a sequence, retargeted, or shared with anyone. Applying does not create an account — there is no account system.

How long we keep it

Until the preview programme ends or you ask us to delete it, whichever comes first. If you apply and never hear anything useful from us, that is the correct outcome, not a filing error.

Getting it removed

Email DGTL from the address you applied with and ask. We will delete the record and confirm. You do not need to give a reason, and you do not need to have applied recently.

If funnel analytics are added later, they will be limited to high-level events — a CTA clicked, the demo launched, a download started — kept entirely separate from the desktop application and any future licensing system, with no media content captured, no search-query capture unless disclosed and sanitised, no cross-site advertising profiles and no fingerprinting. Consent and Do Not Track will be respected. This page will be updated before any of that ships, not after.

The browser demo

The demo at demo.dgtl.mov is a static page with a packaged sample library. It is read-only by construction, not by policy:

• It cannot read your filesystem. There is no upload control, no drag-and-drop handler and no file picker anywhere in it.
• It accepts no remote media URLs and connects to no cloud storage.
• It starts no scans, runs no media processing and performs no AI inference.
• It stores nothing in your browser — no cookies, no localStorage, no sessionStorage. The demo project board is held in memory and a reload resets it.
• It cannot start a trial, request an account or accept a licence key.
• Every path shown in it is a sample path from the packaged manifest, not a real location.

Removing everything

• Reset the library, keep the app: delete ~/.clipvault/index.sqlite.
• Remove derivatives: delete ~/.clipvault/cache/.
• Uninstall completely: delete ClipVault.app and the whole ~/.clipvault/ directory. If you connected a cloud source, remove its Keychain item in Keychain Access.

None of these touch your original media.