Lookbook is a continuity and department-management tool for film/TV Makeup, Hair, Wardrobe and Prosthetics departments. It handles sensitive material — photographs of actors in various states of makeup and costume, schedules, and crew information — and is built accordingly.
Where the data lives
- On device: each crew member's phone keeps an encrypted-at-rest local copy (standard iOS/Android storage encryption), so the department keeps working with no signal on location. Photos never leave the app's private storage area.
- In the cloud: data syncs through Supabase (built on Amazon Web Services), encrypted in transit (TLS) and at rest. Photos are stored in a private bucket — there are no public links; every download requires a signed, expiring URL issued only to authenticated members.
- In the chat: on productions that turn it on, chat text is sealed end to end — the keys live on the crew's phones and the server relays what it cannot read. With no service, the trailer's Local Net carries the same sealed messages phone to phone, and a phone may join only after proving a key the crew has already seen.
Who can see what
- Per-production isolation, enforced by the database. Every record is bound to a production, and row-level security rules in the database itself — not just the app — make records invisible to anyone who is not an active member of that production. A crew member on Show A cannot query, guess or stumble into Show B's data.
- Membership is scheduled. Day players are given a last working day; when it passes, their access lapses automatically. Nothing needs to be remembered or revoked by hand.
- Roles. Only the production owner and department heads can invite crew, change roles, or set access dates. Invites are short-lived codes (30 days / limited uses).
- Accounts are individual email sign-ins (Supabase Auth). No shared logins.
Security levels — matched to the show
Not every production runs the same policy, so each production sets its own security level in the app. Department heads choose it; it applies to the whole crew immediately.
- Standard — call sheets are visible to the whole department. Right for most shows.
- Restricted — call-sheet documents are visible to production admins only. Every crew member still gets their own call time (with alarms), the day's locations, and their scenes — the workday works without the sensitive document circulating.
- Locked — Restricted, plus retention: call-sheet documents are purged automatically 24 hours after their shoot day, from the cloud and from every crew phone's cache, matching studio retention policies. Continuity records — the department's own work product — are unaffected.
Current enforcement, stated plainly: per-production isolation, membership expiry and the Restricted/Locked call-sheet rules are enforced by database row-level security — on a Restricted or Locked production, a non-admin querying the API directly gets no call-sheet records back, independent of the app. Restricted and Locked productions also keep an audit trail: every open, share and scene-read of a document is logged (who, what, when), readable by production admins only. On Locked productions, screenshots are blocked on Android. Still in development, stated so reviewers never discover gaps themselves: viewer-name watermarking on sheet views (requires our in-app document viewer), screenshot blocking on iOS, and application-level encryption of the on-device database on top of OS storage encryption.
What the vendor can see
- What reaches an AI provider is text a crew member asks to have read: call-sheet and script prose, the background wrangler's list, a receipt, a lunch menu, or a question typed to support. It is sent for reading only, results are returned to the production, and the text is not used for model training under the provider's enterprise terms. Schedules, the day-out-of-days and background breakdowns are read by Lookbook itself from the PDF's own layout — no AI provider ever sees them. No continuity photos are ever sent to AI providers. (The current AI subprocessors are named in the Privacy Policy.)
- AI reading is a granted power, not a default: department heads and keys hold it; other crew use it only after their department head turns it on for them, and every call is capped per person per day.
- Usage metering records counts — who used which feature, when, how much text, and when the app was opened — never content.
Ownership & wrap
- The production owns its data. At wrap, the department exports the Wrap Archive — the complete continuity book (profiles, looks, product records, per-scene entries and photos) — as a deliverable, and can additionally export the raw data.
- Deletion on request: a production's records can be permanently removed after wrap.
Email-in paperwork
- Each production can receive its paperwork by email at a dedicated address — the nightly call sheet from the distro, and the background wrangler's list, which the department shows the wrangler as a QR code to scan. The address is an unguessable random token — never the show's name; any member of the department may show the QR, and only its admins manage the address and its allow-list.
- An optional sender allow-list adds a second lock: only mail from the production office's domain (or named addresses) is accepted.
- Incoming webhooks are cryptographically signed by the mail provider and verified before anything is stored; received PDFs land in the same private, production-scoped storage as photos (signed, expiring URLs only).
- Nothing applies automatically: a crew member always reviews the paper in the app before reading it in.
Operational safeguards
- All sync writes are authenticated and validated server-side; conflicting edits resolve deterministically (last-writer-wins with server timestamps).
- Daily database backups are taken for licensed productions.
- Payment handling is by Stripe; Lookbook never stores card numbers.
See also the Data Processing Addendum — written so a production's legal and security teams can sign off quickly. We will also answer reasonable written security questionnaires and execute a production's standard NDA on request.
Questions: ordynapp@gmail.com