Network traffic analysis

First-paint requests (page load)

These fire once when the editor opens. They are static assets: HTML, CSS, JavaScript, fonts.

• index.html — the editor shell, ~3 KB.
• main.[hash].js — the React bundle, ~1.4 MB gzipped. Contains the entire editor logic.
• main.[hash].css — Tailwind styles, ~30 KB.
• Google Fonts — Fraunces + Bricolage Grotesque, loaded from fonts.gstatic.com. Replaceable with a self-hosted copy if you prefer zero third-party requests. Logged for transparency.

None of these carry user data. They are the same requests every visitor's browser makes.

Does AetherCut send network requests while I edit?

No. After the editor loads, scrubbing, cutting, transitions, color grading, and exporting send zero outbound HTTP requests. Processing happens in the browser with WebCodecs, FFmpeg.wasm, and MediaRecorder, without server involvement.

Once the editor is loaded, scrubbing, cutting, adding transitions, applying color grades, and exporting fire zero outbound HTTP requests. The browser's WebCodecs / FFmpeg.wasm / MediaRecorder do the work; there is nothing for our servers to be involved in.

What data is sent when I use AetherCut AI features?

Only features you choose send data. Auto Captions sends extracted audio to Whisper, AI Director sends timeline details to Claude, and Generate B Roll sends a text prompt. These requests do not run automatically.

Some AI features call our backend, which calls an LLM provider. These are individually toggled by the user — none fire automatically.

• POST /api/transcribe — when you click 'Auto-Captions'. Sends the extracted audio track (not the video) to Whisper. The audio is processed and deleted within seconds; we retain only the resulting subtitle text.
• POST /api/director/suggest — when you click 'AI Director'. Sends a description of your timeline (clip count, lengths, type tags) — not the video itself — to Claude for editing suggestions.
• POST /api/broll/generate — when you click 'Generate B-Roll'. Sends a text prompt to Kling (via fal.ai) or Gemini Image Gen. Your existing footage is not transmitted.

Privacy Mode (toggle in the header) disables all of these in one click.

What always on requests does AetherCut make?

AetherCut sends a page view beacon with path, referrer host, UTM tags, and a user agent bucket. It may also check sign in status with a session cookie. Stripe.js loads only on the pricing page.

• POST /api/analytics/page-view — page-load beacon. Sends path, referrer host, UTM tags, user-agent bucket (desktop / mobile). No identifiers, no content.
• GET /api/auth/me — checks if you're signed in. Sends the session cookie, returns user email + tier.
• Stripe.js — loaded only on the pricing page. No upfront tracking.

How to verify this yourself in DevTools

If you want to confirm the behavior firsthand, open your browser’s Network panel before loading the editor, then record a short test session. Start with a hard refresh so you can see the initial HTML, CSS, JavaScript, and font requests separately from anything that happens later. Once the page is fully loaded, clear the request log and perform the edits people usually worry about: drag clips around, scrub the timeline, split a clip, trim in and out points, add a transition, tweak color, and export. In a normal editing flow, the request list should stay empty because those actions run locally in the browser rather than calling a server.

The easiest way to avoid false alarms is to distinguish editor traffic from browser noise. Extensions, ad blockers, password managers, cloud backup tools, and even other open tabs can generate requests that have nothing to do with the editor. Filtering by the editor’s domain and clearing the log after page load makes the result much easier to interpret. It also helps to leave “Preserve log” off during the editing test so you are not mixing first-paint asset fetches with later activity.

Then test the optional cases one by one. Click an AI feature and you should see a request appear only at that moment; turn on Privacy Mode and repeat the same click to verify that the AI call no longer fires. If you are signed out, you should also see that the auth check disappears, which is a simple way to separate account-related traffic from editing behavior itself.