Privacy Policy
Table of Contents
At RecordReach, we prioritize your privacy and data security. This Privacy Policy outlines what information we collect, why we collect it, how it is stored and processed, your rights regarding your personal data, and the third-party service providers we use to deliver our services.
1. Information We Collect & Do Not Collect
We collect specific categories of data necessary to provide our screen recording, AI captioning, and multi-channel publishing service: • **Account Data:** Account email address, full name, and password hash (or Google profile ID for single sign-on). • **Connected Channel Tokens:** OAuth 2.0 authorization tokens and account identifiers for social platforms you choose to link (YouTube, TikTok, X, Pinterest, Threads, Bluesky, Mastodon). • **Media Content:** Uploaded video files, screenshots, and custom captions when saved to your Media Library or queued for social publishing. • **Usage & Telemetry:** Aggregated feature usage counts (e.g. daily AI caption generations) to enforce plan limits, and web performance metrics via Google Analytics 4. • **Support Ticket Submissions:** Text description of support requests and optional screenshots provided when submitting support inquiries. **What We Explicitly DO NOT Collect:** We DO NOT track, record, or inspect your web browsing history, keystrokes, passwords, or off-screen computer activity. All screen recording, canvas cropping, reframing, and annotation rendering occur 100% locally inside your browser's private memory using WebAssembly. Video recordings are never uploaded or transmitted to our servers unless you explicitly choose to save them to your Media Library or publish them to a connected social channel.
2. How We Use Your Data
We process your personal data strictly for legitimate operational purposes: • **Service Delivery:** Authenticating access, processing client-side video exports, generating AI caption suggestions, and storing Media Library assets. • **User-Directed Social Publishing:** Transmitting video media and captions to connected social channels ONLY upon your explicit user action or scheduled publish instruction. • **Customer Support:** Resolving technical support inquiries, billing questions, and troubleshooting ticket reports. • **Transactional Communications:** Sending mandatory service notifications, account verifications, password resets, post-failure alerts, and scheduled post publication confirmations. • **Service Improvement:** Analyzing aggregate, non-identifying telemetry to optimize platform speed, uptime, and user experience.
3. Third-Party Service Processors
We partner with reputable third-party infrastructure and service providers to deliver specific platform capabilities. Each processor processes data solely for the designated function: • **Anthropic (Claude AI):** Processes video transcripts or topic prompts to generate optimized social captions, viral hooks, and hashtags. • **Hetzner Online GmbH:** Provides secure EU-hosted cloud infrastructure, database hosting, and S3-compatible object storage (Germany and Finland server locations). • **Lemon Squeezy:** Our Merchant of Record (MoR) managing secure payment processing, recurring subscription billing, invoices, and global sales tax compliance. • **Resend:** Dispatches transactional system emails and notification messages. • **Google Analytics 4 (Google LLC):** Measures aggregate site traffic, pageviews, and user engagement metrics. • **Connected Social Platforms:** Social destination platforms that you explicitly choose to authorize (YouTube, TikTok, X, Pinterest, Threads, Bluesky, Mastodon). Publishing data transmitted to these platforms is governed by each respective platform's Terms of Service and Privacy Policy.
4. Data Retention & User Rights
We enforce strict data retention timelines to minimize stored data: • **Published Post Files:** Video files uploaded for instant social publishing are automatically cleaned up and purged from cloud storage within 24 hours after posting. • **Media Library Storage:** Video files saved to your Media Library (Creator/Business plans) are retained for 30 days, after which they are permanently deleted. • **Account Data:** Account profile data is maintained for the duration of your active registration. • **OAuth Access Tokens:** Connection tokens for linked channels are deleted immediately when you disconnect a channel or delete your account. **Your Privacy Rights:** You have the right to access, review, correct, export, or request permanent deletion of all your personal data at any time. You can disconnect linked social channels or permanently delete your account directly inside your settings panel. Account deletion immediately removes all stored OAuth tokens, media files, and personal records. You may also contact our privacy team at support@recordreach.pro.
5. Security & Encryption Standards
We implement robust security controls to safeguard your data: • **Encryption at Rest:** All OAuth refresh tokens and API credentials stored in our database are encrypted using AES-256-GCM encryption. • **Encryption in Transit:** All website and API communication is enforced over HTTPS (TLS 1.2/1.3 encryption). • **Session Security:** User authentication sessions are maintained using cryptographically secure, httpOnly, SameSite, and Secure cookies.
6. TikTok-Specific Data Policy
Data received from TikTok's APIs is used solely to publish the user's own content to their own TikTok account at their direction. We do not sell, share, or use TikTok data for any other purpose. TikTok data is deleted when the user disconnects their TikTok account.
7. Children's Privacy, International Transfers & Policy Updates
• **Children's Privacy:** RecordReach is not directed to children under the age of 13 (or applicable legal age in your region). We do not knowingly collect personal data from children. • **International Data Transfers:** Primary backend services and storage infrastructure are hosted in the European Union (Hetzner, Germany/Finland). • **Cookie Usage:** We use essential session cookies required for authentication and basic service operations. We do not use cross-site tracking cookies. • **Policy Updates:** We may update this Privacy Policy from time to time. Material changes will be published on this page with an updated 'Last Updated' date. • **Contact Information:** For any privacy inquiries or data requests, contact us at support@recordreach.pro.