SupaPush

SupaPush is operated by Tinyclass LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA ("SupaPush", "we", "us"), which is the controller of the personal data described here.

This policy explains what SupaPush collects, why we collect it, who we share it with, and what you can do about it. It covers the website and the product.

1. What we collect

Account data. Your email address, name and, if you sign in with Google, the basic profile Google returns. We use it to identify you, to let teammates see who did what, and to email you about your account.

Connected social accounts. For most networks the connection is made through our publishing provider, Zernio: the access token that platform issues is held by Zernio, and we store a reference to the connected account plus the public profile details needed to display it — handle, display name, avatar. For YouTube we connect to Google directly, and we store the OAuth access and refresh tokens ourselves, encrypted (see section 4). We do not receive or store passwords for any of these platforms.

Your content. Posts, drafts, captions, uploaded images and video, labels and comments you write or schedule through the Service.

Performance data. Metrics we retrieve from connected platforms about posts you published — reach, engagement, follower counts.

AI inputs and outputs. Prompts you submit and the text, images or video generated from them.

Billing data. Subscription status, plan and invoice history. Card details are handled by our payment provider and never reach our servers.

Usage and device data. Pages visited, features used, IP address, browser and approximate location, plus server logs. We use this to operate the Service, diagnose faults and understand what people use.

2. Why we can use it

To perform our contract with you — running the product you signed up for: publishing your posts, showing your inbox, billing you.
Legitimate interests — keeping the Service secure, preventing abuse, fixing bugs, and improving what we offer.
Consent — for marketing email and any non-essential analytics, which you can withdraw at any time.
Legal obligation — keeping the records we are required to keep, such as for tax.

3. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's advertising. We do use service providers who process data on our behalf:

cloud hosting and database providers, to run and store the Service;
our payment provider, to take payments and manage subscriptions;
an email provider, for transactional and (if you opted in) marketing email;
AI model providers, to generate the output you request from your prompts;
our publishing provider, Zernio, which connects and publishes to the social networks other than YouTube on our behalf;
the social platforms you connect — we send them exactly what you asked us to publish. For YouTube that is Google, through the YouTube API Services (see section 4).

Each is bound to use the data only to provide their service to us. We may also disclose data where the law requires it, or to protect our rights or someone's safety.

4. Google and YouTube data

SupaPush uses YouTube API Services. When you connect a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

What we access. With your permission SupaPush accesses: the name, ID and avatar of the YouTube channel you connect; the videos on that channel — the ones SupaPush publishes for you and, for the comment inbox, the title and thumbnail of your other uploads — and their public statistics (views, likes, comment counts); comments on your channel's videos, including each commenter's public name, handle and avatar; and YouTube Analytics reports for your channel (views, likes, comments, shares, watch time, average view duration, subscribers gained and lost).

How we use it. Only to provide features you use inside SupaPush: uploading the videos you schedule with the title, description, privacy status and thumbnail you choose; showing comments in the SupaPush inbox and posting the replies you write; and showing your channel's performance on the SupaPush analytics page. We only upload or reply when you schedule or send the action yourself.

What we store and for how long. Your OAuth access and refresh tokens, encrypted (AES-256-GCM); your channel ID, name and avatar; the IDs of videos we published for you; and cached comments and commenter profiles (shown in Comments and Contacts). Statistics and analytics are kept for 30 days and then deleted; cached comments and commenter profiles are refreshed or deleted at least every 30 days; and we check at least every 30 days that your authorization is still valid.

Sharing. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. We share it only with the infrastructure providers that host SupaPush (section 3) and when required by law.

Limited Use. SupaPush's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting. Disconnect YouTube any time on the Accounts page: we revoke the token with Google immediately and delete the data above within 7 days. You can also revoke access at https://security.google.com/settings/security/permissions; we check every day and delete the data as soon as we detect the revocation, within 7 days. Deleting data in SupaPush does not delete anything on YouTube. To request deletion email [email protected].

5. Where data is processed

Our providers may process data in countries other than yours. Where personal data leaves its home jurisdiction, we rely on the safeguards the law provides for such transfers, such as standard contractual clauses.

6. How long we keep it

We keep account data and content for as long as your account is open. When you delete your account we delete or anonymise your personal data, except where we must keep records for legal or accounting reasons. Disconnecting a social account removes the connection; for YouTube we also revoke the token with Google and delete the YouTube data on the timeline in section 4.

Backups are retained on a rolling basis and are overwritten in the normal cycle.

7. Security

Data is encrypted in transit and at rest. Social tokens we hold (including YouTube OAuth tokens, encrypted with AES-256-GCM) and API tokens are encrypted and scoped to a single workspace. Access to production data is limited to the people who need it. No system is perfectly secure, but if a breach affects your data we will notify you as the law requires.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, and withdraw consent. Most of this you can do yourself in Settings; for anything else, email us and we will action it.

You can unsubscribe from marketing email using the link in any such email, without affecting service email about your account.

9. Cookies

We use cookies that are necessary to keep you signed in and to keep the Service secure. We use a small number of analytics cookies to understand usage; these are not used for advertising and you can decline them without losing functionality.

10. Children

The Service is not intended for children, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it.

11. Changes

We will update this policy as the product changes. If a change is significant we will tell you by email or in the product before it takes effect.

12. Contact

Privacy questions, or to exercise any right above: [email protected], or by post to Tinyclass LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.