Privacy
Last changed 15 October 2026.
Slideback runs in your browser. The project you open is read by code on this page and stays on your computer. It is not uploaded, not even in part, and neither are the photos, the sound, the preview or the MP4.
A Movie Maker project also needs the folder its photos, videos and music are in. When you choose one, the browser asks you first and then lets the page see the names of the files inside. The page opens only the files the project uses, and reads those on your computer as well.
What the page loads from elsewhere
The site itself is served by Cloudflare Pages. When you export an MP4, the page downloads a small open-source MP4 packer (mp4-muxer) from cdn.jsdelivr.net. If your project has sound the browser cannot decode by itself, such as WMA music, it also downloads ffmpeg compiled to WebAssembly from cdn.jsdelivr.net, about 32 MB. For Movie Maker projects the page also loads a video reader (mediabunny), from this site itself. These are code downloads; your files are not sent with them. Like any web server, Cloudflare and jsDelivr see your IP address and browser details when they serve a file.
There are no cookies and no ad trackers on this site. To count visitors I use Cloudflare Web Analytics, a small script from Cloudflare that records page views and which pages were opened, without cookies, without storing your IP address and without any identifier that follows you from one visit to the next. It is Cloudflare's product, covered by Cloudflare's privacy policy, and it never sees your files.
What is stored in your browser
One item, sb.licence, if you buy the MP4 export. It is a short signed code that says this browser has the export. It holds no name, email or card details. Clearing the site's data removes it, and Restore brings it back.
When you buy
Stripe takes the payment and sends the receipt. I never see your card number. After paying, Stripe sends you back to this site with a checkout id in the address. The page passes that id to a small server of mine (a Cloudflare Worker), which asks Stripe whether that checkout was paid and answers with the licence code. The Worker keeps no record of the purchase.
Restore sends the email address and the card digits or receipt number you type to the same Worker, which looks for a matching paid checkout at Stripe and answers with a licence code or a no.
To stop someone guessing card digits, the Worker counts requests. The counters are keyed by a salted hash of your IP address or of the email you typed, never the address itself, and they expire within a day. It also counts how many times each purchase has been restored, keyed by a salted hash of the checkout id. Nothing else is stored, and the Worker's request logging is switched off.
What Stripe keeps is covered by Stripe's privacy policy.
If you write to me, I have your email address and what you wrote, in my mailbox, and I use it to answer you. I do not add anyone to a mailing list. If you send me a project file to look at, I delete it once the problem is sorted.
Contact
Plaug Studios, Ontario, Canada. [email protected]