Privacy Policy

Social accounts you connect (rolling out)

Connecting social accounts so you can publish from VyneCraft is rolling out, and it isn’t open to every workspace yet. When you connect an account, this is what we receive from the platform and what we do with it. You choose which accounts to connect, and you can disconnect any of them at any time.

• TikTok: your account’s open ID (the ID TikTok gives you inside our app), your avatar and your display name, plus the permissions you approve to upload and publish videos and photos. We use them to show which account is connected, to check your account’s posting options before a post, to post what you ask us to post, and to show each post’s status. TikTok handles its own data under the TikTok Privacy Policy.
• Instagram and Facebook: your Facebook Page’s name, ID and picture and your Instagram professional account’s username, name, ID and profile picture, plus the publishing permissions you approve and the ID Meta gives you inside our app (stored encrypted, so we can end our access when you disconnect and act on Meta’s deletion requests). We use them to show which accounts are connected, to post what you ask us to post, and to show each post’s status. When Meta tells us you removed VyneCraft or asked for your data to be deleted, we delete those connections right away. Meta handles its own data under the Meta Privacy Policy. To delete the data we received from Meta, follow the steps on our data deletion page.
• YouTube: your channel’s ID, title, handle and picture, plus the permissions you approve to upload videos and to see which channel is yours. We use them to show which channel is connected, to upload the videos you ask us to with the title, description and settings you choose, and to show their status. See “Google and YouTube” below.

We use a connected account only to do what you ask in VyneCraft. We don’t read your private messages, we don’t post anything you haven’t approved, and we never sell this data or use it for advertising.

How we store it: each account’s access tokens are stored encrypted (AES-256-GCM), and only our servers can read them; they are never sent to your browser. To publish a post, the platform fetches its images or video from our own server through a private link that expires within an hour, or our server sends the video to the platform (YouTube). For some posts we may keep a copy in our storage (Cloudflare R2) just long enough for the platform to fetch it, and delete it once the platform has it, or after 48 hours at the latest.

How long we keep it: while the account stays connected. When you press Disconnect, we delete its tokens and the account details we stored right away. If you email us to delete your data, we delete what we received from these platforms within 7 days, and the rest of your account within 30 days. Disconnecting removes our copy; to also remove VyneCraft from the platform’s list of connected apps, see the data deletion page. Posts you published stay on the platform under its own rules.

Google and YouTube

When you sign in with Google, Google shares your email address, name and profile image with us. That is all sign-in asks Google for (its email and basic profile permissions). If you connect a YouTube channel (rolling out), you approve two more permissions: uploading videos to your channel (youtube.upload) and seeing your YouTube account (youtube.readonly), which we use to show which channel is connected and to check whether an upload has finished processing. We ask for nothing broader. If you don’t approve both, we cancel the permission with Google at once and store nothing.

We use Google user data only to:

• sign you in, and show which account you’re signed in with;
• name your workspace when you first sign in, from the part of your email address before the @;
• put your first name on feedback you send us;
• show which YouTube channel is connected, upload the videos you choose with the title, description and settings you pick, and show whether YouTube has finished processing them;
• email you about your account and early access, as described under Early access below.

We don’t sell it, we don’t use it for advertising, and people at VyneCraft don’t read it unless you ask us to for support, it’s needed for security, or the law requires it. We never send it to our AI provider, and we don’t use it to develop, improve or train AI or machine learning models, ours or anyone else’s.

VyneCraft’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

VyneCraft uses YouTube API Services: the YouTube player on teardown pages, and, as publishing rolls out, uploads to the channel you connect. By using VyneCraft’s YouTube features you agree to the YouTube Terms of Service. Google’s handling of your data is covered by the Google Privacy Policy. You can revoke VyneCraft’s access to your Google account and YouTube channel at any time on Google’s security settings page, and you can ask us to delete what we stored from YouTube: we delete it within 7 days.

Who we share Google user data with

Google user data is what Google gives us when you sign in with Google and, if you connect a YouTube channel, the channel’s details and its access tokens. We don’t sell it, rent it or trade it, and we don’t give it to advertisers or data brokers. We share, transfer or disclose it only to the service providers below, who handle it for us so VyneCraft can run, and each one gets only what its job needs:

• Supabase (our database, sign-in and file storage) stores your account: your email address, name, profile image link and Google account ID. If you connect YouTube, it also stores the channel’s ID, name, handle and picture link, and the channel’s access tokens, which we encrypt first (see below).
• Vercel (our hosting) runs our website and servers, so this data passes through Vercel’s systems while we handle your requests.
• Slack receives your first name (or, if we don’t have one, a short code made from your account ID) with feedback you send us, because that is where our team reads feedback. Nothing else from your Google account goes to Slack, and a screenshot you attach stays in our private storage.
• PostHog (analytics, only when analytics are on for you; see Cookies and your choices): its session recordings show what is on your screen, except where it shows your workspace’s name, your accounts’ handles (the handle field too, as you type), a channel, Page or account you connected (its name, handle and picture), or your name on the feedback board: those parts show as an empty box. Email addresses are always hidden. Anything else you type into the product’s own fields is recorded.
• Sentry (error reports): when something breaks, the report notes what you clicked. A click on your workspace’s name, an account or a connected channel reads only “private element”. Reports carry your VyneCraft account ID, never your email address, and their screen replays hide all text and pictures.

Your access tokens never reach your browser, so neither PostHog nor Sentry can receive them. When you upload a video, our server sends the file and the details you chose straight to YouTube, and nowhere else. We never send Google user data to our AI provider.

We may also disclose Google user data when the law requires it, such as for a valid court order, or when it is needed to protect the security of VyneCraft and the people who use it. If VyneCraft is ever merged into or sold to another company, we will ask for your permission before any of your Google user data moves to the new owner.

Data from TikTok, Instagram and Facebook goes to the same providers in the same way: Supabase stores it, Vercel’s servers handle it, and the notes on PostHog and Sentry apply. There is one difference: posts you publish to these platforms from VyneCraft are saved in your workspace with the account’s handle and the post’s link, and if you ask the assistant about your posts it can read them, so those details go to our AI provider to answer you. We never sell this data or use it for advertising either.

How we protect your data

These are the protections in place for sensitive data, including Google user data and the access tokens of the accounts you connect:

• Encrypted in transit: VyneCraft only works over HTTPS (TLS), and we tell browsers never to connect to it any other way. Our servers use HTTPS too when they talk to Google, TikTok, Meta and our providers, and our YouTube, TikTok, Instagram and Facebook connections send your tokens only to that platform’s own servers.
• Encrypted at rest: our database provider, Supabase, encrypts all the data it stores (AES-256; see Supabase security). On top of that, we encrypt every access token and refresh token we get from Google, TikTok and Meta ourselves before it is stored (AES-256-GCM). The key is kept outside the database, in our hosting provider’s settings, so a copy of the database alone can’t open the tokens. Each encrypted token is tied to its workspace, account and type, so a copy pasted anywhere else won’t open, and the database refuses to store a token that isn’t encrypted.
• Tokens stay on our servers: they are never sent to your browser, shown in the app or written to our logs. Only our server code can decrypt a token, and it does so only to carry out something you asked for, like an upload or a post, or to end our access when you disconnect.
• Access control: what you make and the accounts you connect stay in your own workspace, and other VyneCraft users can’t see them. The table that holds connected accounts is closed to browsers entirely: row-level security is on and browser access is turned off, so only our servers can read it. Connecting an account uses a signed request that is tied to your workspace, your account and the browser you started in, and it expires after 10 minutes, so a forged or replayed sign-in is refused.
• Only the access we need: sign-in asks Google for your email address and basic profile, and YouTube asks for uploading and read-only access to your account, nothing broader.
• People: only the team that runs VyneCraft can get into our database and hosting accounts, and we don’t look at Google user data unless you ask us to for support, it’s needed for security, or the law requires it.
• Deletion: Disconnect asks Google and TikTok to end VyneCraft’s access (Facebook too, once none of your other Pages stay connected; Instagram gives apps no way to do this), and deletes the tokens and the account details we stored right away. When we delete your workspace, its connections go with it. Emailed requests are handled within 7 days for data from these platforms and within 30 days for your whole account (see Deleting your data). Our providers’ server logs and backups can hold some records for a short time, until they expire on their own schedule.

Deleting your data

Email support@vynecraft.com from your account address with the subject “Delete my account” and we will delete your workspace, your content, and your account within 30 days. You can also ask for a copy of your data at the same address.

To disconnect a social account, or to remove only the data we received from TikTok, Meta or Google, follow the steps on our data deletion page: Disconnect deletes it right away, and an emailed request is handled within 7 days.

Early access

VyneCraft is in early access. Features can change or go away. If a change affects how we use your data, we update this policy and the date at the top of this page.

During early access we study how people use VyneCraft (the usage records and session recordings described above) and we read the feedback you send, so we can fix and improve the product.

We may email you about your account, about early access, and to ask for your feedback. To stop the early-access and feedback emails, write to support@vynecraft.com; the emails your account needs, like sign-in links, keep coming.