Privacy policy

Who is responsible

The owner of this Video Publisher installation runs it and is responsible for the data it holds.

What it stores

• Connected accounts. For each YouTube channel, TikTok account and Instagram account the owner connects: the platform's account ID, name, username, profile picture link, the permissions granted, and the OAuth access and refresh tokens. Tokens are encrypted (AES-256-GCM) before they are saved, and they are never shown, logged or returned by the API.
• Videos. The uploaded file, a copy converted to 1080×1920 for publishing, and a cover image. They are kept until every platform has finished with the post, then deleted after a retention period the owner sets (7 days unless changed).
• Posts. The caption, the options chosen for each platform, the schedule, the status of each upload, the ID and link of each published post, and a log of the publishing steps, kept for troubleshooting.
• Sign-in and API access. The owner's sign-in sessions and API keys. Only hashes of them are stored.
• Server logs. Technical records of requests and errors. They never contain tokens, passwords or API keys.

What it sends to each platform, and why

Video Publisher only contacts a platform to publish a video the owner chose for it, or to read what that needs. It uses each platform's official API.

YouTube

Video Publisher uses the YouTube API Services. It uploads the video with the title, description, tags, category, privacy setting, made-for-kids answer, altered-content disclosure and notify-subscribers choice the owner picks. It reads the channel's name and picture, to show which channel is connected, and each upload's processing status. Google's handling of this data is described in the Google Privacy Policy, and using YouTube is subject to the YouTube Terms of Service.

TikTok

Video Publisher uses TikTok's Login Kit and Content Posting API. Before each post it reads the creator's posting details (nickname, username, avatar, the privacy options and interaction settings available to them, and the longest video they can post) to show them in the posting form. It sends the video with the caption, the privacy level, the comment, Duet and Stitch settings and any commercial content disclosure the owner chooses, or sends just the video to the owner's TikTok inbox to finish in the app. It then checks the post's status.

Instagram

Video Publisher uses Meta's Instagram API. It sends a link to the converted video, which Instagram downloads from Video Publisher's media server, with the caption, the cover frame and the options the owner chooses (showing the Reel in the feed, collaborators, audio name and trial Reel settings). It reads the account's name, username and picture, and the upload's processing status. The video link is long and random, so it can't be guessed, and the file is deleted after the retention period.

What it doesn't do

• It doesn't sell, rent or share data with anyone other than the platform a video is published to.
• It has no ads, analytics or tracking scripts.
• It doesn't read messages, comments, followers, analytics or other videos on the connected accounts.

Cookies

One cookie keeps the owner signed in. It is HTTP-only and is removed on sign-out or when the session expires. The public pages set no cookies, and there are no third-party cookies.

How to remove its access

In Video Publisher, open Accounts and choose Disconnect. This asks the platform to revoke the token, where the platform supports that, and deletes the stored tokens straight away. Access can also be removed on each platform:

• Google and YouTube: In your Google Account, open Security, then Third-party connections, and remove Video Publisher. Open Google's third-party access settings.
• TikTok: In the TikTok app, open Settings and privacy and remove Video Publisher from the apps and services that can access your account.
• Instagram: In Instagram, open Settings, then Apps and websites, and remove Video Publisher. Open Instagram's apps and websites settings.

Once access is removed, Video Publisher can no longer post to the account or read anything from it.

Deleting data

• Tokens are deleted as soon as an account is disconnected.
• Videos are deleted automatically after the retention period.
• Everything else (account names, post history and logs) is deleted on request within 7 days. Send the request to the contact address on this page.

Security

All traffic uses HTTPS. Tokens are encrypted at rest, sign-in sessions and API keys are stored only as hashes, failed sign-in attempts are rate limited, and only the owner can sign in.

Changes

When this policy changes, the date at the top changes with it. The terms of service cover the rest of how the tool may be used.