Privacy policy

Who we are

SocialReel is the controller of the personal data described here. Questions and requests go to support@socialreel.app.

What we store

• Your account: your email address and whether it is verified. Your password is held by Amazon Cognito, our sign-in provider; we never see it.
• Emails: whether you want emails about your videos, the code in their unsubscribe link, and a note of each one we sent, kept for 7 days so none is sent twice. They are sent through Amazon SES, and turned off from the Account screen or any email's own link.
• How you use the product: events such as signing up, starting a video, a video finishing or failing, publishing to a platform, and subscribing or buying credits — with details like the video's length, format and language, the platform, and your plan. They are recorded against a random account identifier, never your email address, and never include your prompts or scripts.
• What you make: your prompts, the scripts written from them, your language, voice, length, format, subtitle and music choices, the finished videos and their thumbnails.
• Connected accounts: for each TikTok account, Facebook Page, YouTube channel, Instagram account or X account you connect directly, its identifier, name and (except for X, which gives us none) picture link, the permissions you granted, when you connected it, and the access tokens that let us post to it — and, for Facebook, the identifier Facebook gives your account for our app, so we can act when you remove the app there. The tokens are stored encrypted and are never shown back, not even to you.
• What you publish: the titles, captions and hashtags you approve, which linked account each video went to, when, and the resulting post's address and status.
• Plan and usage: your plan, how many videos and AI credits you have used, your purchased credit balance, the credits each pack you bought granted and any refund of it, and your Creem customer, subscription and order identifiers. Card details are handled by Creem and never reach us.
• Content checks: the outcome of each automated check described below, the categories involved and up to 4,000 characters of the text that was checked.
• Messages you send us: the name, email address and message you write in the contact form go to our support mailbox. To limit abuse of the form, a one-way hash of your IP address and of your email address is kept for up to two days.
• Service logs: records of requests and errors, which include your account identifier, kept to operate and secure the service.

Why we use it

• To provide the service you signed up for — writing, voicing, rendering, storing and publishing your videos, and billing for them — because it is necessary to perform our contract with you.
• To keep the service safe and fair — checking content, limiting free trials to one per person, preventing abuse and investigating faults — on the basis of our legitimate interest in running a lawful service that cannot be abused.
• To understand and improve the product — seeing which steps new users finish and where they stop, from the usage events above — on the basis of our legitimate interest in improving the service. These events are sent from our servers, not collected in your browser, and set no cookies.
• To measure visits to the website — which pages are viewed, from what kind of device and roughly where — only if you allow analytics cookies, on the basis of your consent, which you can withdraw at any time from “Cookie settings” in the page footer.
• To meet legal obligations, such as keeping billing records or answering a lawful request or a copyright notice.

We do not use your content to train AI models, and we do not sell or rent personal data.

Automated content checks

Before a video is made, its prompt and the script written from it are checked automatically by an AI model against our acceptable use policy. A failed check means that video is not made; you are told which categories it failed, and nothing is charged. After five refusals within an hour, new attempts are paused until the oldest of them is an hour old. If you think a check got it wrong, write to support@socialreel.app and a person will review it.

Who else receives it

Making a video takes several specialist services. Each receives only what its part of the job needs. Naming them here does not mean any of them is affiliated with or endorses SocialReel.

Your data is stored in the United States, and the providers above process it in the countries where they operate, which may be outside the country where you live.

How long we keep it

• Videos, their files and their publishing records are deleted automatically 7 days after the video is made on the free trial, and 90 days after on a paid plan. Deletion runs in the background and can take a day or two to complete. Download anything you want to keep.
• Content-check records are deleted after 365 days.
• Data exports you request are deleted after one day.
• Service logs are deleted after 30 days.
• Emails to our support address: a copy kept by AWS for 30 days so a message can be re-delivered if forwarding fails, then deleted.
• Connected accounts are kept until you disconnect them or delete your account. Removing SocialReel from your Facebook account deletes your Facebook data as soon as Meta tells us — see data deletion.
• Backups of our database are kept for 35 days, then overwritten.
• Your account, plan and usage are kept until you delete the account.
• Usage events held by our analytics provider are not deleted with your account. They carry only the random identifier, and once the account is gone nothing we hold links that identifier to you.

Deleting your account

Deleting your account on the Account screen removes your profile, videos, files, publishing history, content-check records and sign-in, and disconnects every linked social account. An active subscription has to be cancelled first, so that you are not charged for an account that no longer exists, and a video still rendering has to finish.

Copies in service logs and database backups are not removed early; they are gone once those expire, within 30 and 35 days.

One thing is kept: a pseudonymised form of your email address (a salted hash) and the number of free-trial videos it used. It holds nothing else — no name, no content, no account identifier — and it exists so that deleting an account and signing up again does not start a new free trial. We keep it on the basis of our legitimate interest in preventing abuse of the trial, for as long as we offer one.

Creem keeps its own records of past payments, as the law requires of it. Posts already published stay on the platforms they were published to; delete them there.

To delete only what we hold from a connected Facebook or TikTok account, see data deletion.

Your rights

Depending on where you live, you may have the right to access, correct, delete or move your data, to object to or restrict how we use it, and to withdraw consent you have given.

• Access and portability: download a copy of your account data from the Account screen.
• Deletion: delete your account from the same screen.
• Anything else, including correcting your email address: write to support@socialreel.app from the address on your account. We answer within one month.

You can also complain to the data protection authority where you live or work.

Cookies and browser storage

We use no advertising cookies. If you allow it, our website analytics provider sets _ga and _ga_* cookies, which last up to two years and tell repeat visits apart; nothing loads until you choose, and choosing “No thanks” or withdrawing later through “Cookie settings” in the page footer removes them. Your choice is remembered in this browser's local storage. The product usage events above are sent from our servers and set no cookies. The app stores your sign-in session in your browser's local storage, and remembers the page you were on while you sign in. Both are needed for the service to work, which is why we do not ask for consent to them. When you open checkout you go to Creem's payment page, which sets the cookies it needs to take the payment and prevent fraud.

Anything else that is not strictly necessary, we will ask about first.

How we protect your data

The most sensitive data we hold is the access tokens that let us publish to the accounts you connect, including your YouTube channel through Google. We protect it, and everything else we store, like this:

• Encrypted in transit: every connection to SocialReel, and from SocialReel to Google and the other platforms, uses HTTPS (TLS). Our file storage refuses unencrypted connections.
• Encrypted at rest: our database and file storage (Amazon Web Services, in the United States) are encrypted at rest. Your videos are private: public access to the storage is blocked, and a video is reached only through a link that expires.
• Connected-account tokens, including the Google OAuth tokens for your YouTube channel, are additionally encrypted with a dedicated key in AWS Key Management Service that is used for nothing else and is rotated automatically. Each token is bound to the account it belongs to, so it cannot be decrypted anywhere else. Only the parts of the service that publish your videos, refresh the connection or disconnect it can decrypt it. Tokens are never shown in the app, never returned by our API, and never written to our logs.
• Least access: each part of the service has only the permissions its job needs. Our own service credentials are stored encrypted in AWS Systems Manager, not in our code.
• Passwords and payments: your password is handled by Amazon Cognito and your card details by Creem. Neither ever reaches us.
• Google user data is used only to connect your channel and publish the videos you approve. It is not sold, not used for advertising, not used to train AI models, and not shared except with the providers listed above to run the service. What we keep, for how long and how to delete it is set out under YouTube API Services, and you can revoke our access at any time at myaccount.google.com/permissions.

If a security incident affects your personal data, we will tell you and the relevant authorities as the law requires.

YouTube API Services

SocialReel uses YouTube API Services to connect your YouTube channel and upload the videos you publish. By connecting a channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

• What we access, collect and store: your channel ID, title and thumbnail link (from YouTube's channels.list); the OAuth access and refresh tokens Google issues; and, for each video you publish, the video ID YouTube returns and its processing status (from videos.list, asked for that ID only). The title, description, tags, category, privacy setting, made-for-kids setting and AI-content disclosure are what you enter in SocialReel and we send. We read nothing else from YouTube.
• How it is used and shared: only to show the channel you connected, upload the video you approved and report its status. Inside SocialReel, only the parts of the service that publish your videos, refresh the connection or disconnect it can decrypt the tokens. We use it for nothing else: no advertising, no profiling, no AI training. It is sent to YouTube and Google to perform the upload, and stored with our hosting provider, Amazon Web Services in the United States, encrypted. It is not sold and not shared with anyone else.
• Other content: we do not show advertising or any third-party content alongside YouTube data. Cookies and browser storage are covered in Cookies and browser storage.
• Keeping it current: the channel title and thumbnail are refreshed from YouTube regularly, and never go more than 30 days without a refresh. The tokens are kept while the channel is connected; if Google revokes our access, the tokens, which no longer work, are deleted with the connection within 30 days.
• Deleting it: disconnecting a channel deletes its details and tokens at once, asks Google to revoke our access, and removes the YouTube video IDs and links from that channel's published videos; the record that a video was published stays, without the link. If you revoke our access from Google's side instead, we keep the connection marked as needing reconnection for up to 30 days, then delete it and those IDs and links. Deleting your account deletes everything. You can also ask us to delete your YouTube data at support@socialreel.app, and we delete it within 7 days.
• Revoking access: besides Disconnect on the Connections screen, you can revoke SocialReel's access to your Google Account at security.google.com/settings/security/permissions.
• Contact: support@socialreel.app.

Age

SocialReel is only for people aged 18 or over, and we do not knowingly collect data about anyone younger. If you believe someone under 18 has an account, write to support@socialreel.app.

Changes

When this policy changes in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top says when it last changed.