Privacy Policy

What ClipSocial collects, why, how long we keep it, and how you stay in control. You must accept this policy before using ClipSocial.

Last updated: November 1, 2026. Operator: [COMPANY LEGAL NAME: pending from owner]. Contact: support@clipsocial.app.

1. Who is responsible

2. What we collect

• Account: email address, a hashed password, optional two-factor secret, workspace name and role.
• Content you create: videos, captions, titles, schedules and posting rules.
• Connected platform data: described per platform below.
• Billing: plan and subscription status. Card details are handled by our payment processor or by Apple or Google; we never see full card numbers.
• Technical: sign-in session records (time, browser type), security logs, and error reports with personal data removed.
• Support: messages you send us.

3. Platform API data, by platform

YouTube (Google)

ClipSocial uses YouTube API Services. With your permission we use the Google OAuth scopes youtube.upload (to upload the videos you schedule, with the title, description and privacy setting you choose) and youtube.readonly (to show your channel name and your videos' statistics). We store your channel ID and name, the IDs and statistics of videos published through ClipSocial, and encrypted OAuth tokens. We never ask for your Google password. By using the YouTube features you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Statistics are refreshed, and authorization is re-checked, at least every 30 days; other YouTube data is deleted or refreshed within 30 days.

Meta: Instagram, Facebook Pages and Threads

With the permissions you grant through Meta's login (for example instagram_business_basic, instagram_business_content_publish, pages_show_list, pages_manage_posts, threads_basic and threads_content_publish), we read your account or Page name and ID, publish the posts you schedule, and read insights for those posts. We store the account IDs, post IDs, metrics and encrypted access tokens. Meta's own processing is covered by the Meta Privacy Policy.

TikTok

With the scopes you grant (basic profile info and video publishing), we read your TikTok display name, fetch the posting options TikTok requires before each post, publish the videos you approve, and read their status and metrics. See the TikTok Privacy Policy.

X

With the scopes you grant (read your profile, read and write posts, upload media, and offline access so scheduled posts can go out while you're away), we publish the posts you schedule and read their public metrics. See the X Privacy Policy.

4. Google API Services: Limited Use disclosure

ClipSocial's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: we use Google user data only to provide the user-facing features you see in ClipSocial (uploading your scheduled videos and showing their statistics). We don't use it for advertising, don't sell it, and don't transfer it except as needed to provide those features, for security, to comply with law, or in a merger or acquisition with your prior consent. People at ClipSocial don't read it unless you ask us to (for example in a support request), it's needed for security, or the law requires it.

5. How we use data

To run the service: publish what you schedule, check posting rules, show analytics compared with your own history, keep your account secure, provide support, and bill paid plans. We do not sell personal data, show ads, or use connected platform data to train AI models.

6. Sharing

We share data only with: the platforms you connect (to publish on your behalf); service providers who host, secure or bill for the service, under contracts that limit their use; and authorities where the law requires. Data from one platform is never shown to anyone outside your workspace.

7. Cookies

Only essential cookies (cp_session to keep you signed in and cp_csrf for security). No advertising or tracking cookies. See the cookie notice.

8. Security and encryption

Data in transit uses HTTPS (TLS). Stored API keys are encrypted at rest with AES-256-GCM using per-record keys. Platform access and refresh tokens are encrypted at rest the same way (envelope encryption: each record gets its own data key, which is itself encrypted with a master key kept outside the database). During the preview, the only stored tokens are placeholders or demo tokens from a local test sign-in; no real platform account is connected. Passwords are hashed, never stored in plain text. Access is restricted to your workspace and to staff who need it. See Security.

9. Retention

• Account and content: kept while your account is active, and deleted within 7 days after you delete your account.
• Platform data: deleted within 7 days after you disconnect a platform or revoke access. YouTube statistics are re-authorized every 30 days, and other YouTube data is refreshed or deleted within 30 days.
• If a platform token can no longer be refreshed, we treat that as revoked and delete the related data.
• Security audit records hold IDs but not email addresses, and are kept as a security record.
• Billing records: kept as long as tax and accounting law requires.
• Support messages: kept while needed to resolve your request. A fixed period will be set before launch.

10. Your controls: revoke access and delete data

• Disconnect any platform in ClipSocial under Connections. We revoke the token (using the platform's revocation endpoint where one exists) and delete that platform's stored data.
• Google / YouTube: in addition to our normal deletion process, you can revoke ClipSocial's access at any time on the Google security settings page.
• Meta: remove ClipSocial under Facebook Settings & Privacy → Settings → Apps and Websites, or Instagram → Settings → Website permissions → Apps and websites.
• TikTok and X: remove ClipSocial from the connected-apps section of your account settings.
• Export or delete everything from Account, export & delete in the app, or follow the data deletion instructions.

Deleting data stored by ClipSocial does not delete anything on YouTube or other platforms. To delete posts there, use the platform's own app.

11. Your rights

Depending on where you live, you may have rights to access, correct, export, delete or restrict use of your data, and to complain to a data protection authority. Use the controls above or contact us. We respond within the time the law requires.

12. Children

ClipSocial is not directed to children and is not for people under 13, or under the minimum age where you live.

13. International transfers

Hosting location and transfer safeguards will be stated here once the hosting provider is chosen.

14. Changes

If we start using data in a new way, we will ask you to accept the updated policy before we do.