Privacy Policy

Last updated: 2026-08-06

This Privacy Policy describes how Reversepostiz (“we”, “us”) collects, uses, and shares information when you use our website and services (the “Service”).

Reversepostiz is the developer and operator of the Service. We hold the developer accounts and platform-side approvals with the third-party social platforms whose APIs the Service integrates with (TikTok, YouTube, Meta / Instagram / Facebook, and others we add over time). When you connect an account through Reversepostiz, we act as the OAuth client on your behalf.

1. Information we collect

• Account data. Email address, name (optional), and a hashed password. If you sign in with Google, we receive your email, name, and a stable Google user ID.
• Workspace content. The source URLs you submit, generated clips, captions, logs, and any credentials (API keys, cookies) you connect to your workspace.
• Usage metadata. Timestamps of your video runs, plan selection, and quota usage.
• Support messages. Anything you send via the /contact form, including your email and IP address.

2. How we use it

• To operate and secure the Service (auth, session cookies, quota enforcement).
• To generate the videos you request, against the credentials you connect.
• To respond to support requests you send us.
• To improve reliability — for example, aggregate failure rates on upstream provider calls.

3. What we don’t do

• We don’t sell your data.
• We don’t share the content you generate with other users.
• We don’t use your workspace content to train third-party models.

4. Third parties in the loop

When you connect third-party AI or social-platform credentials, requests go directly from Reversepostiz to those providers using your credentials. Their handling of that traffic is governed by their own privacy policies.

5. Data received from connected social platforms

When you connect a social account (TikTok, YouTube, Instagram, Facebook, and others we add over time) via OAuth, we receive and store only the data required to publish on your behalf and to identify the connected account in the Reversepostiz UI. We never read, access, or store your existing posts, followers, messages, comments, or any private data on those platforms.

TikTok

We collect your open_id (a stable, platform-scoped identifier), union_id, display name, username, and avatar URL. We store your OAuth access token and refresh token to publish videos you schedule through Reversepostiz. Scopes requested: user.info.basic (profile identity) and video.upload (upload scheduled videos). Data is handled in accordance with the TikTok Privacy Policy.

Facebook

We collect your Facebook user ID, display name, and profile picture URL. We also collect the ID, name, and Page access token for each Facebook Page you administer and choose to connect. Page access tokens are used exclusively to publish videos to that Page on your behalf. Scopes requested: pages_show_list (list your Pages) and pages_manage_posts (create posts on your Pages). We do not access, read, or store your personal timeline, friends list, messages, or any data beyond what is listed here. Data is handled in accordance with Meta’s Privacy Policy and the Meta Platform Terms.

Instagram

We collect your Instagram Business Account ID, username, display name, and profile picture URL. We store your OAuth access token to publish Reels on your behalf. Scopes requested: instagram_business_basic (profile identity) and instagram_business_content_publish (publish Reels you schedule). We do not read your existing posts, followers, direct messages, story views, or any other Instagram data beyond what is listed here. Data is handled in accordance with Instagram’s Privacy Policy and the Meta Platform Terms.

YouTube

Reversepostiz uses YouTube API Services to publish videos to your YouTube channel on your behalf. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service and Google’s Privacy Policy.

We collect your YouTube channel ID, channel title, and avatar URL, along with an OAuth access token and refresh token. Scope requested: https://www.googleapis.com/auth/youtube.upload (upload videos you schedule through Reversepostiz). We do not read your existing videos, playlists, subscribers, comments, analytics, or any other YouTube data. We do not use your YouTube data to develop, improve, or train AI or machine learning models.

You may revoke Reversepostiz’s access to your YouTube account at any time via your Google account security settings. Upon revocation, we will delete your stored tokens and profile data.

How all platform tokens are stored and used

Tokens from all connected platforms are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256) and transmitted only over TLS. They are used solely to perform actions you explicitly initiate (a scheduled post you created or a manual upload you triggered). We never post to any connected account without your explicit action. We never sell, share, or transfer platform data to any third party other than the platform it came from. We maintain industry-standard administrative, physical, and technical safeguards to protect all stored credentials.

6. Data retention and deletion

Your account data and workspace artifacts persist until you delete them or close your account. Contact-form messages are kept for support-record purposes.

Tokens and profile data for connected social accounts are deleted as soon as reasonably possible when you take any of the following actions:

• Disconnect from Reversepostiz — click Disconnect on the Connections page. We delete stored tokens and profile snapshots immediately.
• Revoke from the platform side — revoke access in the platform’s own security settings (e.g. TikTok, Facebook, Google). Tokens become invalid immediately on the platform side and are removed on our side on next use.
• Close your Reversepostiz account — all connected account tokens, profile snapshots, and associated data are deleted.
• We are required to delete by Meta — if Meta notifies us that a user has revoked app permissions or requests data deletion, we delete the relevant data promptly.

We do not retain platform data beyond what is necessary to provide the Service.

7. Your rights

You can request a copy of your account data, or delete your account and all data we hold about you, at any time by emailing support@reversepostiz.com. We will respond within a reasonable time and typically within 30 days.

You must be at least 13 years old (or the minimum age of digital consent in your jurisdiction, whichever is higher) to use Reversepostiz. We do not knowingly collect data from anyone under that age; if we learn we have, we will delete it.

8. Contact

Questions about this policy? Reach us at support@reversepostiz.com or via the contact form.