Security

This page describes the security practices, data protection measures, and third-party processors used by Ozu (Cloud Creator LLC).

1. Infrastructure Security

Transport Encryption

All connections to ozu.studio and app.ozu.studio use TLS 1.2 or higher. Cloudflare provides automatic HTTPS for all traffic with HSTS headers enforced.

Hosting

The application is served via Cloudflare Pages. API requests are handled by a Cloudflare Worker. Both benefit from Cloudflare's DDoS protection, WAF (Web Application Firewall), and global CDN. Data is not stored in third-party compute instances beyond Cloudflare Workers KV and R2 storage. The native iPad app connects to the same Worker API over TLS.

Authentication

User authentication is handled by Firebase Authentication (Google). We use Google Sign-In, Sign in with Apple, and email/password authentication. All auth tokens are short-lived (1-hour) Firebase ID tokens validated by the Cloudflare Worker on every API request. Passwords are never stored by Ozu — Firebase handles credential storage.

API Keys

Ozu's AI provider API keys (Anthropic, xAI, Blockade Labs, World Labs) are stored as Worker secrets — environment variables that are never exposed in logs or client responses. BYOK keys provided by users are encrypted in transit and not persisted to storage.

2. Data Storage

User project data (scripts, generation metadata, project configurations) is stored in Firebase Firestore, scoped to each user's UID with server-side security rules. Generated assets (images, character sheets) are stored in Cloudflare R2 with access mediated through the Cloudflare Worker — direct public R2 URLs are not issued.

3. Rate Limiting

The API Worker enforces rate limits per IP address (60 requests/minute) and per generation operation type (30 generation requests/minute) using Cloudflare's native rate limiting. This protects both the service and users from abuse and runaway credit consumption.

4. Sub-Processors

The following third-party processors handle data on behalf of Ozu:

• Google Firebase — Authentication, Firestore database. Google Privacy Policy applies.
• Cloudflare — CDN, Workers, KV, R2, DDoS protection. Cloudflare Privacy Policy applies.
• Stripe — Payment processing (web). Stripe Privacy Policy applies. Ozu never sees raw card data.
• Apple — In-app purchases and Sign in with Apple for the iPad app. Apple Privacy Policy applies.
• Anthropic — Claude API for the Ozu AI assistant and script analysis. Anthropic Privacy Policy applies. Inputs are not used for training.
• xAI — Grok API for image and text generation. xAI Privacy Policy applies.
• Blockade Labs — Skybox AI for 360° environment generation. Blockade Labs Privacy Policy applies.
• World Labs — Marble API for Gaussian splat generation. World Labs Privacy Policy applies.

5. Vulnerability Disclosure

If you discover a security vulnerability in Ozu, please report it responsibly to [email protected] with "SECURITY" in the subject line. We will acknowledge receipt within 24 hours and aim to resolve confirmed vulnerabilities within 30 days.

Please do not publicly disclose vulnerabilities before we have had the opportunity to investigate and remediate them.

6. Contact

Security concerns: [email protected]
Cloud Creator LLC, c/o Northwest Registered Agent, 30 N Gould St Ste R, Sheridan, WY 82801