Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored in hashed form; we never store or have access to your plaintext password)
• Full name
• Account creation date and timestamps

1.2 Social Media Account Data

When you connect social media accounts via OAuth authorization (or, for Skool, with your Skool session cookie), we collect and store the following data from each platform:

1.3 Media and Content Data

When you upload media or create posts, we collect:

• Uploaded image and video files (JPEG, PNG, WebP, MP4, MOV, WebM)
• File metadata including file name, file size, file type, and upload timestamp
• Post content including captions, hashtags, mentions, and platform-specific metadata (e.g., YouTube video titles, descriptions, tags, privacy settings, categories)
• Scheduling preferences such as post time, target platforms, and posting settings (e.g., TikTok privacy levels, branded content flags, comment/duet/stitch toggles)

1.4 Payment Information

When you subscribe to a paid plan:

• We do NOT collect or store your credit card number, CVV, or other payment card details
• All payment processing is handled by Whop, Inc., our third-party payment processor
• We store your Whop membership ID and user ID to link your payment account
• We store subscription metadata including plan type, subscription status, billing period dates, and plan ID
• Whop webhook event records are processed for billing reconciliation, including the date, amount and ID of your latest payment and any refund Whop reports
• If you request a refund, we store the request: the plan and payment it concerns, the reason you give (optional), and its outcome

1.5 API Usage Data

When you use our REST API, we collect:

• API key used for authentication
• API endpoint and HTTP method called
• Request body and response body
• IP address and User-Agent header
• HTTP status code and response time
• Error messages (if any)
• Request timestamp

1.6 Automatically Collected Data

When you access the Service, we may automatically collect:

• IP address
• Browser type and version
• Operating system
• Referring URLs
• Pages visited and features used within the Service
• Date and time of access

Product analytics with PostHog (pages and clicks) runs only if you turn on Analytics in the cookie settings, and session recordings only if you also turn on Session recordings. Error reports go to Sentry. See Section 7.

1.7 How You Found Us (recorded once at sign-up)

When you create an account, we record once how you found us:

• The campaign tags of the link you arrived through (utm_source, utm_medium, utm_campaign, utm_term and utm_content)
• The domain of the website that sent you, for example youtube.com, never the full address of the page
• The first page you opened on our site, as a path only (for example /pricing), without anything after it
• When you first visited
• If the link carried an advertising click ID, only the name of that ID (for example "gclid"), never its value

From this we derive one word for the channel, such as youtube, google, referral or direct. We do not record full web addresses.

Why: to learn which channels bring us new accounts, so we can put our marketing where it works. We rely on our legitimate interest in understanding how people find the Service. It is used only for our own statistics, never for advertising, and never shared with advertising networks.

How long: it is kept with your account and deleted when your account is deleted.

In your browser: during your visit this is held only in the page's memory. It is kept between visits (s200_first_touch, for up to 90 days) only if you allow Analytics in the cookie settings, and it is deleted as soon as you turn Analytics off. If you allowed Analytics and sign in with Google, a copy is kept in your browser tab's session storage (s200_signup_touch) while you are at Google and deleted once your sign-in is handled. See Section 7.

4.1 Where We Store Data

• Account data, social media connection data, post logs, and API logs are stored in a PostgreSQL database hosted by Supabase
• Uploaded media files (images and videos) are stored in Supabase cloud storage
• Payment data is stored by Whop on their secure infrastructure
• OAuth access tokens and refresh tokens are stored in our database alongside connection metadata
• Skool session cookies are stored in the same database, encrypted with AES-256-GCM

4.2 Security Measures

We implement the following security measures to protect your data:

• All data in transit is encrypted using TLS/HTTPS
• Passwords are hashed using industry-standard algorithms and are never stored in plaintext
• Database access is protected by Row Level Security (RLS) policies ensuring users can only access their own data
• API keys are generated using cryptographically secure random generation
• OAuth state parameters are used to prevent CSRF attacks during social media account connection
• Supabase JWT-based authentication protects all authenticated endpoints

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

4.3 Data Retention

• Account data is kept while your account exists, and deleted when you delete your account.
• How you found us (recorded once at sign-up, see Section 1.7) is kept with your account and deleted with it.
• Social media connection data (including tokens) is kept until you disconnect the account or delete your account.
• Uploaded media files may be deleted automatically after a retention period, and are deleted when you delete your account. A deleted file can still be served from our content cache for up to an hour.
• Post history and engagement figures are kept while your account exists, and deleted with it.
• API request logs and your sign-in history are kept for at most 90 days, and deleted earlier when you delete your account.
• Internal alerts about the Service can mention your account. They are deleted after 90 days, and your details in them are replaced when you delete your account. Copies in our team chat are cleared once a month when they are older than 90 days.
• Payment records and invoices are kept by Whop. Our copy of your plan and payment details is deleted when you delete your account; an open refund request is kept, without your name or email, until it is processed.
• Support emails you send us, and our replies, are kept for 1 year.
• Our database backups are overwritten within 7 days.
• Logs kept by our hosting and error-monitoring providers expire within 90 days.
• If you turned on Analytics, we delete your data in PostHog by hand within 30 days of your account deletion.
• When you delete your account in the app (Settings, then Delete Account), your data is deleted within minutes; a deletion you ask for by email is done within one month. What we keep after a deletion is listed in 4.4.

4.4 What We Keep After You Delete Your Account

• A deletion record for 3 years: your receipt code, the dates, counts of what was deleted and how your plan ended. It holds no email address, name or IP address.
• For 30 days after the deletion: your internal account number, and the internal numbers of your profiles, connections, API keys and AI app connections. After that, only a one-way code of the account number stays with the deletion record.
• The masked form of your API keys (the first 8 and the last 4 characters) for 90 days, so that requests made later with a deleted key can be found and deleted.
• Your Whop membership and Whop account numbers for 60 days after the deletion, or until 60 days after your paid period ends if that is later, so that a late message from Whop cannot put your details back into our database.
• An open refund request, without your name or email, until it is processed.
• Used coupon codes stay used.
• If another customer referred you, their referral list keeps an entry for you, without your name or email.
• If you sent a data deletion request through Facebook, Instagram or Threads: a record of the request (its code, date, platform and the id Meta sent us) for 1 year, and which connected accounts it removed for 90 days.

If you joined our free plan on Whop, that free membership stays open at Whop until you leave it at whop.com/orders.

Step-by-step instructions are at status200uploads.com/data-deletion.