Privacy Policy

Last updated: 25 July 2026 · Effective: [CONFIRM — set to the public launch date before submission].

This Privacy Policy explains what MomentReel collects, why, who else sees it, how long it is kept, and how you delete it. MomentReel is operated by Erbacci LTD ("Erbacci", "we", "us"), the controller of the personal data described below. Contact: info@erbacciltd.com.

MomentReel is offered in the United States only.

1. What MomentReel does

MomentReel turns a security camera you already own into a family camcorder. Once you link your Ring account and choose which cameras take part, MomentReel watches the motion events those cameras already record, discards the overwhelming majority of them, and keeps the rare few that look like a moment worth saving — the dog doing something absurd, a raccoon on the porch, the delivery driver being greeted like an old friend. You get a small library of short clips you can trim, crop, caption and export.

Two things follow from that, and they shape everything below:

MomentReel is not a security, monitoring, alarm or life-safety product. It raises no intrusion alerts and takes no protective action.
MomentReel cannot make a camera record. It only retrieves footage the camera already captured on its own. If nothing was recorded, there is nothing to retrieve.

2. Information we collect

2.1 From your Ring account, when you link it

Your Ring account identifier. The stable id Ring gives us for your account. It is the primary key of your MomentReel record.
The email address on your Ring account, lowercased. This is your sign-in identity — MomentReel has no passwords, so this address is how you get back in.
Access and refresh tokens issued by Ring so we can call the Ring API on your behalf. These never leave our servers and are never shown in the app or written to a log.
Camera metadata — device identifiers, camera names, whether a camera is online, and the privacy zones you configured in the Ring app.
Subscription state — whether you have an active MomentReel subscription or trial, and when it expires.

2.2 Media we retrieve from your cameras

Snapshots. For each motion event on a camera you enabled, we retrieve a single still frame at the moment of the event, in order to decide whether anything interesting happened. The overwhelming majority of these frames are judged uninteresting and are discarded immediately; they are never stored and you never see them.
Short clips. Only when a snapshot passes that judgement do we retrieve a short video clip around the event (by default 3 seconds before the event and about 20 seconds long) and store it as a moment in your library.
Audio is never requested. Every clip we download is requested with audio disabled, and MomentReel never stores, processes or exports the original audio track from your camera.

2.3 Information we generate

Moment metadata — an interest score, a one-line reason the moment was kept (for example "dog rolling in the flowerbed"), a suggested caption, a few lowercase tags, the camera name, the capture time and the clip length.
Thumbnails — one still frame per stored moment, for the library grid.
Export records — the trim points, aspect ratio, caption, music selection and blur setting you chose for an export, and the rendered MP4 file that results.
Sign-in state — a random session token, and, while a sign-in code is outstanding, a keyed hash of that code, its expiry and an attempt counter. The code itself is never stored.
A signed recovery cookie (mr_recover) in your browser, so returning from the Ring app lands you in your own account without signing in again.
Diagnostic logs — errors, timings and event counts. Account identifiers and device identifiers are masked to their last 20 characters in every log line, email addresses are masked, and tokens, secrets and sign-in codes are never logged at all.

2.4 Information you give us

The cameras you enable, the profile you pick for each one (pets, wildlife or doorstep), whether faces are blurred by default, the minimum score at which a moment is worth keeping, and whether you want the "a moment is ready" email.

2.5 What we do not collect

No passwords (MomentReel has none). No faceprints, voiceprints, gait signatures or any other biometric identifier. No license plate numbers. No audio. No location beyond the fixed view of your own cameras. No contacts, calendar, photo library or other unrelated device data. No advertising identifiers, and no third-party analytics or advertising SDKs.

3. How footage is analysed

Every frame reaching our pipeline is processed by machine. No Erbacci employee watches your footage as a matter of routine. Human access happens only if you ask us to investigate a specific problem, or where the law compels it.

The pipeline has three stages:

Watermark crop. Ring burns an overlay into every image and clip it serves — the Ring logo, and your device identifier, the app name and a timestamp. We crop the top band off our working copy before any analysis, because the overlay is not part of the scene and would otherwise be read as content. We do not remove, disable, inpaint or reconstruct Ring's overlay; we simply frame our own copy below it.
A local pre-filter (disabled at launch). MomentReel is built to run a cheap yes/no pre-check — "is there an animal in this frame at all?" — on a compact open-weights vision model running on hardware operated by Erbacci ([CONFIRM] — name of that model and the country the hardware sits in; the transfers statement in §13 depends on it). It answers a binary question only, and its sole power is to discard a frame early. It is switched off at launch. Turning it on is a material change under the Ring Appstore Program Requirements: we will update this policy and re-certify before it processes anyone's frames.
The judgement. The cropped still frame is sent to Anthropic's Claude Haiku 4.5 model, running inside Amazon Bedrock in the United States, which returns a score, a short reason, a suggested caption and a few tags. The model is instructed to judge whether the moment is charming or worth keeping — never to identify anyone, never to read the burned-in overlay, and never to describe the scene in security terms.

Your footage is never used to train any model — not ours, not Anthropic's, not Amazon's, not any third party's. Frames sent to Amazon Bedrock are used to answer that one inference call and are not retained by the model provider for training.

Privacy zones are honoured. Areas you masked in the Ring app are masked in our copy before any frame reaches any model — the judgement above, and the face detector in §4 — and they stay masked in everything we keep or give back to you: the clip stored in your library, the thumbnail in the grid, and any clip you export. If we cannot read your camera's privacy settings, we do not process that camera at all, and an export we cannot mask is stopped rather than delivered.

4. Faces: blurred by default, never recognised

MomentReel performs no facial recognition. It does not identify anyone, does not create or store face templates or embeddings, has no enrollment step, maintains no gallery or watchlist, and never matches a face against any external database, social network, public record or another MomentReel account. Nothing in the product is capable of telling you who a person is.

What it does do is detect that a face is present so it can cover it. Face blurring is on by default on every export. When you export a clip, we sample a handful of frames from it (five by default) and send them to Amazon Rekognition's DetectFaces operation, which returns nothing but rectangles and a confidence number — where a face is, never whose. No face collection is created, indexed, searched or compared; no face template or embedding is ever computed or stored; there is no enrollment step and no way to add one from the app. The rectangles live for the length of a single render and are never written to storage or to a log line.

You can turn blurring off for an individual export. If you do, you are choosing to publish an identifiable image of whoever is in it, and the responsibility for that choice is yours — see the Terms of Service.

5. How we use information

To find the handful of moments worth keeping among the motion events your cameras record, and to build your library.
To store, show, trim, crop, caption, blur and render the clips you ask for, and to give you a download link for the result.
To sign you in without a password, and to keep you signed in.
To run your subscription — to know whether you are on the free or paid tier, and to restore or end paid features when Ring tells us your subscription changed.
To send you the two kinds of transactional email described in §6.
To keep the service running: debugging, error monitoring, abuse prevention and capacity planning, using masked identifiers and aggregate counts.
To comply with the law and respond to valid legal process.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA. Data derived from your cameras is never used for marketing or advertising, ours or anyone else's — including marketing for MomentReel itself. We will never email you that your camera caught something in order to sell you an upgrade. Upgrade prompts live inside the app and nowhere else.

6. Emails we send

There are exactly three, all transactional, and there is no promotional email of any kind.

Email	When	Contains
Sign-in code	You ask to sign in	A six-digit code, valid 10 minutes
A moment is ready	A new clip lands in your library — at most one routine email a day	How many moments, which camera, and a link to the app. No clip, no thumbnail
Account notice	Your trial is ending, paid access ended, a linked camera was removed, or your account was deleted	The fact and what it means

You can turn the "a moment is ready" email off in the app. Sign-in codes and account notices are part of operating the account and are not marketing, so they cannot be switched off — but they are only ever sent in response to something that happened on your account.

Email is delivered by Resend, our email delivery provider (with Amazon SES as a fallback path). They receive the recipient address and the message text. They never receive clips, thumbnails or tokens.

7. Who else sees your data

Recipient	Role	What they receive
Amazon Web Services	Hosting, storage, compute — region us-east-1 (N. Virginia, USA)	All stored data, encrypted at rest
Anthropic, via Amazon Bedrock	Vision inference — is this a moment worth keeping?	One cropped still frame per candidate event. Not retained for training
Amazon Rekognition (AWS)	Face detection, so faces can be blurred	A few frames of a clip you are exporting, at the moment you export it. Returns geometry only
Resend (fallback: Amazon SES)	Email delivery	Recipient address and message text
Ring / Amazon	Account linking, media retrieval, subscription and billing	The API calls we make on your behalf
Law enforcement or regulators	Only under valid legal process	Only what the process compels

MomentReel operates no law-enforcement integration, no evidence-sharing programme, no public gallery, no feed, and no way for one user's clips to reach another user's account. Your clips are visible to your account and to nobody else until you export one and share it yourself.

8. Retention and automatic deletion

Everything below expires by itself. Retention is stamped on a moment when it is created, so a later change of plan never shortens clips you already have.

Data	Kept for
Moments and their clips and thumbnails — free tier	7 days from capture, then deleted automatically
Moments and their clips and thumbnails — paid tier	90 days from capture, then deleted automatically
Rendered exports	7 days from render, then deleted automatically
Discarded snapshots (the ~99% judged uninteresting)	Not stored at all
Download links for clips and exports	Signed links expire 15 minutes after they are issued
Sign-in code	10 minutes, or until used, or after 5 failed attempts
Session token	Until you sign out or delete your account
Recovery cookie	1 year, or until you clear your browser cookies
Duplicate-delivery records for Ring webhooks	24 hours
Account record, camera choices, settings, subscription state	Until you delete your account
Unlinked accounts that were never signed in to	Swept after 15 minutes
Diagnostic logs	[CONFIRM] days

9. Deleting your data

In-app deletion is the primary channel. In MomentReel, open Account → Delete account and confirm. This immediately and permanently erases:

every clip, thumbnail and rendered export stored for you;
every moment record, export record and setting;
your camera choices and subscription record;
the Ring access and refresh tokens we hold, so we can no longer reach your Ring account;
your session, so you are signed out everywhere.

The app shows you a confirmation of what was deleted when it finishes. Deletion covers all copies and backups; it is not reversible and there is nothing to restore afterwards.

Email is the secondary channel, for when you cannot get into the app: write to info@erbacciltd.com from the email address on your Ring account with the subject "Delete my account". We verify the request and complete deletion within 30 days, and confirm by reply.

Deletion also happens without you asking:

You remove MomentReel from your Ring account — Ring tells us, and we run the same purge.
You remove a camera from your Ring account — we purge what came from that camera.
Your moments and exports expire on the schedule in §8.

To stop MomentReel reaching your Ring account, you can also revoke the integration from the Ring app at any time; that is independent of anything you do here.

10. Your rights

You may ask us to access, correct, delete, port or restrict processing of your personal information, and to tell you what we hold. Use Account → Delete account in the app, or write to info@erbacciltd.com. We respond within 30 days and we do not treat you differently for asking.

California residents have the rights to know, delete, correct, and to opt out of the "sale" or "sharing" of personal information — we do neither, so there is nothing to opt out of. We do not knowingly process the personal information of anyone we know to be under 16 for any purpose that would require an opt-in.

11. Security

Encryption in transit (TLS) everywhere, and at rest for every store we use.
Clips, thumbnails and exports live in a private storage bucket with all public access blocked. They are only ever delivered through a signed link that expires in 15 minutes.
No passwords exist to be stolen. The only app credential is a random session token.
Sign-in codes are stored only as a keyed hash, compared in constant time, expire in 10 minutes and are locked out after 5 attempts.
Ring webhooks are verified against a shared secret on the exact bytes received, before the payload is parsed.
Ring tokens and every other secret live in AWS Secrets Manager, and every backend component runs with least-privilege permissions.
Logs mask account identifiers, device identifiers and email addresses, and never contain tokens, secrets or sign-in codes.

No system is perfectly secure, and we make no claim to any certification or audit we have not completed. If we ever suffer a breach affecting your data, we will notify you and the relevant authorities as the law requires.

12. Children

MomentReel is not directed to children and is not for use by children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, contact us and we will delete it.

13. United States only

MomentReel is operated from, and offered only in, the United States. All storage and processing described above takes place in AWS region us-east-1 (N. Virginia, USA), with the sole possible exception of the local pre-filter in §3 — which is disabled at launch and whose hosting location is [CONFIRM]. Erbacci LTD is established outside the United States, so our own staff may access administrative systems from abroad under appropriate safeguards.

14. Changes to this policy

We may update this policy. Changes to what we collect, how we use it, who we share it with, or whether any model is trained on your data are material changes under the Ring Appstore Program Requirements: we will update this page, tell you in the app before the change takes effect, and re-certify with Ring first.

15. Contact

Erbacci LTD, data controller · info@erbacciltd.com

Registered office: Strovolou 77, Strovolos Center, Office 301, Strovolos 2018, Nicosia, Cyprus (Company No. HE 457237). Subscriptions are billed through the Ring Billing System, with proceeds paid to Erbacci LLC (Wyoming, USA).