What MOVON sees of your footage

Nothing leaves the Mac. The match (frame analysis, grouping, LUT generation) runs locally. No upload, no account, no connection.

The short version: MOVON Match runs the entire matching pipeline on the Mac. Nothing about the footage uploads to a server, because there is no server in the matching path. This page covers what that means in practice, with the few qualifications worth being honest about.

What runs locally

When the panel hits Analyze, three things happen on the Mac:

• Frame sampling. A few frames per clip are read off disk.
• Embedding. The backbone model produces a per-camera color embedding for each clip from those frames.
• LUT generation. The predictor model takes the embeddings for the hero group and every other group and writes a 33³ .cube LUT per non-hero group.

All three steps run in the local match engine that the installer registered as a LaunchAgent. The panel inside Premiere talks to that engine over localhost, the same network address that never leaves the machine.

The Mac does not need an internet connection to match cameras. Pull the Wi-Fi cable, run Analyze, the match still works.

What does and does not leave the Mac

Does not leave the Mac:

• Source footage. Never sampled, never read by anything outside the local engine.
• Sampled frames. Held in memory during the embedding pass, never written off-device.
• The embeddings themselves.
• The generated .cube files. Written to the project folder by default; they go wherever the editor saves them.
• The grouping plan and hero pick. Stay in the panel; not telemetered.

Can leave the Mac, only with explicit action:

• Update check. The panel pings MOVON Labs occasionally to see if a newer build is available. This carries the current build number and nothing else, no footage information, no usage data. The update check can be turned off in the panel settings; the match keeps working with it off.
• Bad-match reports. If the editor sends a sample via the homepage Contact form (the path documented at Report a bad match), the clips and screenshot the editor chooses to attach reach MOVON Labs. Nothing is auto-uploaded; every byte sent in a report is one the editor explicitly attached and submitted.

That is the full list. There is no analytics ping, no crash telemetry, no anonymous usage stream, no behavioral logging.

No account, no login, no cloud user

The private beta does not have user accounts. The install is a .pkg, the panel opens in Premiere, the match runs. There is no email-and-password gate inside the product, no Apple ID linkage, no MOVON Labs profile associated with the install.

When the free window ends in January 2027 and paid plans launch, a license check will be added so the paid tier knows whose machine it is running on. The match itself will keep running locally; the license check is the only part that talks to a server, and it carries a license token, not footage. The shape of the paid-tier auth is published 90 days before launch.

NDA work

A lot of MOVON's design choices line up with the reality of NDA work: unreleased films, brand campaigns before launch, confidential events. The questions an NDA-conscious editor asks (where does the footage go, what gets logged, what happens during the analysis) have the same answer for MOVON: the footage stays on the Mac, nothing gets logged off-device, the analysis is local.

That answer holds whether the Mac is online or offline, on a studio network or a hotel Wi-Fi.

What changes if a cloud option ever ships

A cloud-acceleration option may be offered in the future, if the local performance ceiling stops being enough for the hardest use cases. If that happens, it would be:

• An option, off by default. Local stays the default.
• Per-project, not per-account. Cloud acceleration would be a toggle the editor opts in to on a project where it makes sense, not a global setting that surprises someone next session.
• Clearly described before it ships. The exact data path, retention policy, and region routing would be documented on this page and in the dispatch before the option becomes available.

This is a future possibility, not a current feature.

What happens to data in bad-match reports

For the one path that does leave the Mac (a bad-match report the editor explicitly submits), the data goes to MOVON Labs and:

• Stays private. Not shared, not resold, not used for advertising.
• May feed the next training cycle, anonymized. Names, timestamps, and metadata are stripped before any clip enters the corpus.
• Is retained only as long as the report is being worked on, and as long as the anonymized clip is useful for training. Identifiable copies are deleted once the report is resolved.

Sending a report is the most direct way to make the next match better for the camera that triggered it, but the choice to send the report stays with the editor.

A summary line for procurement

If a procurement or compliance team needs a one-line statement: *MOVON Match runs the entire color-matching pipeline locally on the Mac. Footage and project data do not leave the device. The only outbound traffic is an optional update check; bad-match reports are user-initiated, attach-only, and never auto-uploaded.*