Privacy policy

The database holds only what publishing requires:

• Your account: email address, a bcrypt hash of your password, an optional display name, and your timezone.
• Connected platform accounts: the account identifier the platform gives us (including a YouTube channel id, Pinterest user id, or TikTok open_id), your handle, display name and avatar URL, the granted scopes, and encrypted access and refresh tokens.
• Cached platform settings: your Pinterest board names and ids, your TikTok creator settings, your Instagram publishing quota, and your YouTube channel details.
• Your content: uploaded images and videos, captions, titles, links, scheduled times, and per-destination publish results including the error text a platform returned on failure.
• Content performance: snapshots of statistics returned by a connected platform for content published through Vuala, such as views, likes, comments, shares, saves and engagement totals. The exact fields depend on the platform.

Vuala does not use behavioral website analytics, advertising identifiers, session recording or third-party tracking scripts. The content-performance statistics described above are fetched from a platform only to provide the analytics features requested by you.

When you connect YouTube, Vuala accesses Google user data through the YouTube Data API only after you grant permission. The raw Google user data Vuala accesses and stores is limited to:

• Your YouTube channel id, channel title, custom URL and channel thumbnail URL.
• The OAuth permissions you granted and encrypted access and refresh tokens.
• For connected YouTube channels: channel view, subscriber and public-video totals; and, when YouTube Analytics access is granted, aggregated views, engagement, watch time and subscriber changes. For videos published through Vuala, we also process the video id, URL and video statistics returned by YouTube.

Vuala uses this raw data only to:

• Identify and display the YouTube channel you connected.
• Upload or schedule a video when you ask Vuala to do so, using the video file and the title, description, tags, category, visibility and other publishing options you selected.
• Show the publication result and link to the published YouTube video.
• Synchronize and display performance statistics for your own videos in your Vuala analytics dashboard.

Vuala may calculate account-specific totals and trends from the raw statistics for your own YouTube videos. These derived figures are used only to display analytics to you. They are not combined with another user's Google data. Vuala does not create or retain anonymized or cross-user datasets from Google user data.

Neither raw nor derived Google user data is used for advertising, user profiling, sale, data-broker activity, credit or lending decisions, or training general-purpose artificial intelligence or machine-learning models.

Vuala's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held in our server environment and never stored alongside the data. Tokens are decrypted in memory only for the duration of an API call.

Tokens are never sent to any destination other than the platform that issued them, and are never included in logs, error messages or the JSON returned by this application's own API.

When you schedule a post, the media, caption and options you selected are transmitted to the destination platform so it can be published:

• YouTube — Google's OAuth services and the YouTube Data API. Vuala sends the video and publishing options you selected and receives the channel and video data described in section 2. Subject to the Google privacy policy.
• Pinterest — api.pinterest.com (or their sandbox host), plus the Amazon S3 endpoint Pinterest itself supplies for video uploads. Subject to the Pinterest privacy policy.
• TikTok — open.tiktokapis.com and the upload URL it returns. Subject to the TikTok privacy policy.
• Facebook and Instagram — Meta's Graph API, when you choose either destination. Subject to the Meta privacy policy.

Vuala also uses infrastructure providers to host the application, database and uploaded media. They process data only to operate those services for Vuala and are not permitted to use it for their own advertising or to sell it. There is no intermediary posting service between Vuala and the social platforms. Vuala does not sell personal information or Google user data.

In our database and file storage. Uploaded media is served only to your authenticated session, except when a destination platform must fetch the media from a temporary or unlisted publicly reachable URL in order to publish it.

• Posts, media, publish history and platform analytics snapshots remain until you delete the associated content, disconnect the associated account, or delete your Vuala account.
• Disconnecting a platform account deletes its stored tokens and associated analytics immediately. For Google/YouTube and TikTok, Vuala also asks the platform to revoke the token.
• Short-lived OAuth state records expire after 10 minutes and are deleted on use.
• Deleting your Vuala account deletes its connected accounts, tokens, posts, analytics records and uploaded media.

• Disconnect a connected account at any time from the account panel in the app. Scheduled posts to it will then fail rather than publish.
• Revoke from the platform side in your Google, Pinterest, TikTok or Meta app settings. The next refresh fails and the account is flagged for reconnection.
• Request deletion or a copy of your data by writing to the address at the top of this page.

One cookie, sched_session. It holds a signed session token, is httpOnly and sameSite=lax, and expires after 30 days. It exists to keep you signed in. There are no analytics or advertising cookies.

Material changes will be reflected in the date at the top of this page. If you disagree with a change, disconnect your accounts and close your account.

See also the terms of service.