Security

This page describes the security practices, data protection measures, and third-party processors used by Ozu (Cloud Creator LLC).

1. Infrastructure Security

Transport Encryption

All connections to ozu.studio and app.ozu.studio use TLS 1.2 or higher. Cloudflare provides automatic HTTPS for all traffic with HSTS headers enforced.

Hosting

The application is served via Cloudflare Pages. API requests are handled by a Cloudflare Worker. Both benefit from Cloudflare's DDoS protection, WAF (Web Application Firewall), and global CDN. Data is not stored in third-party compute instances beyond Cloudflare Workers KV and R2 storage. The native iPad app connects to the same Worker API over TLS.

Authentication

User authentication is handled by Firebase Authentication (Google). We use Google Sign-In, Sign in with Apple, and email/password authentication. All auth tokens are short-lived (1-hour) Firebase ID tokens validated by the Cloudflare Worker on every API request. Passwords are never stored by Ozu — Firebase handles credential storage. On the web, those ID tokens are separate from the first-party __pp_session cookie; see the Cookie & Analytics Policy.

API Keys

Platform API keys for the AI providers we call are stored as Worker secrets — environment variables that are never exposed in logs or client responses. The current provider list is in our Privacy Policy §4.1 and §9, not here.

If you enable BYOK, your own API keys are stored encrypted in our database and used only by our servers to make calls on your behalf. They are persisted (encrypted) until you disable BYOK, plus a 30-day cleanup window. They are not stored in your browser, not sent to the client, and not used for anything other than the Service. See the BYOK Addendum and Privacy Policy.

2. Data Storage

User project data (scripts, generation metadata, project configurations) is stored in Firebase Firestore, scoped to each user's UID with server-side security rules. Generated assets (images, video, audio, character sheets, and related files) are stored in Cloudflare R2 with access mediated through the Cloudflare Worker — direct public R2 URLs are not issued.

3. Rate Limiting

The API Worker enforces rate limits per IP address (60 requests/minute) and per generation operation type (30 generation requests/minute) using Cloudflare's native rate limiting. This protects both the service and users from abuse and runaway credit consumption.

4. Sub-Processors

Third-party processors handle data on behalf of Ozu. The live list — who they are, what we send, and each AI provider’s training posture — is Privacy Policy §4.1 and §9. That is the source of truth. We do not keep a second full table here, because the mix of models changes.

In summary, infrastructure includes Firebase (auth and database), Sentry (iPad crash reporting, not advertising), Cloudflare (hosting, CDN, R2, Workers), Stripe (web payments), and Apple (App Store distribution, in-app purchases, Sign in with Apple).

AI providers are reached either directly (including Anthropic, xAI, Google, OpenAI, ElevenLabs, Replicate, Blockade Labs, and World Labs — World Labs is not currently reachable in the app) or through the EvoLink generation gateway (including Kling, Seedance/Seedream, Seed Audio, Midjourney, Suno, Qwen, and VideoRetalk). Training claims for those providers are in Privacy §9, not here.

5. Vulnerability Disclosure

If you discover a security vulnerability in Ozu, please report it responsibly to [email protected] with "SECURITY" in the subject line. We will acknowledge receipt within 24 hours and aim to resolve confirmed vulnerabilities within 30 days.

Please do not publicly disclose vulnerabilities before we have had the opportunity to investigate and remediate them.

6. Contact

Security concerns: [email protected]
Cloud Creator LLC, c/o Northwest Registered Agent, 30 N Gould St, Ste N, Sheridan, WY 82801

Revised August 13, 2026: corrected BYOK key storage (encrypted in our database, not “not persisted”); stopped listing a stale four-provider set as if it were current; pointed the provider and training details at Privacy §4.1 and §9; standardized the registered-agent address to Ste N. Effective date remains March 9, 2026.