Privacy Policy

Account data — name, email, hashed password, optional phone number (for SMS alerts), plan and billing status.

Your content — posts, drafts, listings, voice profiles, photos you upload for listings, and scheduling data.

Connected-platform credentials — tokens you provide for live publishing (e.g., Bluesky, Mastodon), encrypted at rest with AES-256-GCM and never shown back to you or anyone else.

Usage data — activity logs (publishes, retries, exports), API request counts, and standard server logs.

To operate the Service: generating and adapting content with AI, publishing on your instruction, scheduling, billing, sending transactional email and SMS alerts, enforcing plan limits and rate limits, preventing abuse, and improving reliability. We do not sell personal data and we do not use your content to train AI models.

Data we access. When you connect YouTube, Blastopus requests only the Google OAuth scope youtube.upload. We receive encrypted OAuth access and refresh tokens so the connection can operate and the YouTube video ID and publishing status returned after an upload. We also process the video file and the title, description, audience setting, and privacy setting you explicitly choose to send to YouTube. We do not request Google identity or profile scopes.

How we use it. We use this data only to maintain the connection and upload a new video when you explicitly publish or schedule it. Blastopus does not use the connection to read, list, download, edit, or delete your existing YouTube videos, and it does not access your Google profile, Gmail, Drive, Photos, contacts, subscriptions, viewing history, or advertising data.

Sharing and AI restrictions. Google user data is shared only with service providers necessary to deliver the integration: Vercel for application and media hosting, Supabase for encrypted application storage, and Google/YouTube as the destination you selected. We do not sell Google user data, use it for advertising or lending, transfer it to data brokers, or send it to Anthropic or any other third-party AI service. Raw, derived, aggregated, and anonymized Google user data is not used to develop, improve, or train generalized AI or machine-learning models.

Protection, retention, and deletion. Google OAuth tokens are encrypted at rest with AES-256-GCM, protected in transit with TLS, and limited to workspace-scoped server operations. Tokens are retained only while the YouTube channel remains connected and are deleted from active storage immediately when you select Disconnect. Account deletion removes the remaining connected-account data, upload records, and operational records within 30 days, except records we must retain for legal, billing, fraud-prevention, or security obligations; backups expire on their normal rotation schedule.

Google Limited Use. Blastopus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share data only with processors needed to run the Service: Vercel (hosting), Supabase (database), Anthropic (AI processing of content you ask us to generate or adapt), Stripe (payments — we never store card numbers), Resend (email), and Telnyx (SMS). Each receives only what its function requires. Content is sent to the platforms you choose to publish to, under their terms.

We keep your data while your account is active. You can delete your account (or email hello@blastopus.com) and we will delete your data within 30 days, except records we must keep for legal, billing, or security reasons. Backups roll off on a schedule.

Encryption in transit (TLS) and at rest, encrypted platform credentials, hashed passwords (bcrypt) and API keys (SHA-256), row-level-security-locked database, and least-privilege access. No system is perfectly secure; notify us immediately of any suspected breach at hello@blastopus.com.

You may access, correct, export, or delete your data at any time from the app or by emailing us. Depending on where you live (e.g., EU/UK GDPR, California CCPA), you may have additional statutory rights — we honor verified requests under applicable law. We do not respond to Do-Not-Track signals; we use only essential session cookies, no advertising trackers.

The Service is for adults 18+; we do not knowingly collect children's data. We will announce material changes to this policy by email or in-app at least 14 days before they take effect. Contact: hello@blastopus.com.