Privacy Policy

What ReeLoop does

ReeLoop is a subscription tool for YouTube creators: it researches keywords, drafts optimized video titles, descriptions and tags, and cross-posts YouTube Shorts to Instagram Reels. This page explains what data we collect to provide that service, who we share it with, and how we protect it.

Information we collect

• Your email address, to create your account and send sign-in links.
• A Google OAuth refresh token and access token, obtained when you connect your YouTube channel. ReeLoop requests a single scope, https://www.googleapis.com/auth/youtube.force-ssl, and uses it only to read your channel and your own uploaded videos, update those videos' titles, descriptions and tags when you approve a change, and set a thumbnail you have chosen.
• An Instagram access token, obtained when you connect your Instagram Business account, used to publish Reels to that account on your behalf.
• YouTube data synced from your connected channel: channel id and title, and for your own videos the id, title, description, tags, publish date, view count and thumbnail URL.
• The content niche and preferences you configure during onboarding and in Settings.
• Billing information, handled entirely by Stripe. We store your Stripe customer and subscription identifiers. We never receive or store your card details.

How we use this information

Solely to operate the features described above: researching keywords, generating metadata suggestions, applying changes to your YouTube videos when you approve them, and publishing Shorts to Instagram when you request or schedule it. ReeLoop never deletes your videos and never uploads new videos to your YouTube channel.

Who we share, transfer or disclose your data to

We do not sell your data, and we do not use it for advertising. We share Google user data only with the service providers below, only to the extent each one needs it to perform its function for ReeLoop, and only for the purposes described here:

• Google LLC (YouTube Data API) — receives your OAuth token in order to return your channel and video data and to apply the metadata and thumbnail changes you approve. This is the source of the data, not an onward transfer.
• Anthropic PBC — receives the video metadata being optimized (title, description, tags) and, for regular videos, the public thumbnail image URL, in order to generate the suggested replacements you review. Anthropic does not train its models on data submitted through its API. Your email address, tokens and billing data are never sent to Anthropic.
• Meta Platforms, Inc. (Instagram Graph API) — receives the video file and caption for a Reel you have chosen to cross-post, in order to publish it to your own Instagram account. No Google account data is sent to Meta.
• Fly.io, Inc. — hosts the ReeLoop application and its database, and therefore stores the data described above on our behalf as our infrastructure provider.
• Stripe, Inc. — processes subscription payments and receives your email address and billing details. No YouTube or Instagram data is sent to Stripe.
• Resend, Inc. — receives your email address in order to deliver sign-in links and account notifications. No YouTube or Instagram data is sent to Resend.

We do not transfer Google user data to data brokers, advertising networks, or any other third party for their own purposes. We do not use Google user data to train machine learning models. Beyond the providers listed above, we disclose data only where legally required, for example in response to a valid legal process, or to you at your request.

Limited Use disclosure

ReeLoop's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

• Encryption at rest. Google and Instagram OAuth tokens — the most sensitive data we hold — are encrypted in the database using AES-256-GCM authenticated encryption. The encryption key is held in the server environment and is never stored in the database alongside the data it protects.
• Encryption in transit. All traffic to ReeLoop is served over HTTPS with HTTP connections redirected to TLS, and every request we make to Google, Meta, Anthropic, Stripe and Resend is made over TLS.
• Least privilege. ReeLoop requests a single YouTube scope, the narrowest one that permits the metadata and thumbnail updates the product performs.
• Tenant isolation. Every record is scoped to the account that owns it, and every request is authorized against the signed-in user before any data is returned.
• No tokens in logs. Access and refresh tokens are never written to application logs or error reports.
• Payment data isolation.Card details are collected and stored by Stripe and never reach ReeLoop's servers.

Data retention and deletion

You can disconnect your YouTube or Instagram account at any time from within the app. Disconnecting deletes the stored tokens immediately, along with the synced videos, keyword research, scheduled posts and generated thumbnails associated with that channel. Video files downloaded temporarily in order to cross-post a Reel are deleted as soon as the upload completes.

To delete your account and all associated data entirely, follow the instructions on our data deletion page or email us at the address below. You can also revoke ReeLoop's access to your Google account directly at myaccount.google.com/permissions.

Contact

Questions about this policy or your data: kirklanddigital522@gmail.com