Privacy Policy

What we collect

Account information: your name, email address and password hash (or your Google account identity if you sign in with Google).

Content you create in the product: ideas, packaging directions, scripts, research notes, calendar entries and your creator profile (what you make, who for, tone).

Creative decisions: when you save, select, edit or reject AI-generated options, we record those decisions to personalize future suggestions. This is the product's core feature ("Creator Brain").

Usage analytics: we use Vercel Analytics (page views), Google Analytics (traffic sources and page views) and Microsoft Clarity (anonymized session interactions such as clicks and scrolls, to find usability problems). These help us improve the product; we do not sell this data or use it to build advertising profiles.

YouTube data

WhatToUpload uses the YouTube API Services. By connecting your YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy applies at https://policies.google.com/privacy.

If you choose to connect your YouTube channel for stats, we request read-only access and import: your channel name, avatar, subscriber count, your uploaded videos' titles, descriptions, thumbnails, publish dates and public statistics (views, likes, comments). That connection cannot upload, edit, delete or comment on your behalf. Posting is a separate connection, described below.

This data is used solely to personalize your own workspace, for example by learning your title patterns and suggesting follow-up ideas. It is never shared with other users or third parties, and is not used for advertising.

You can disconnect at any time from the Channel page, which revokes our access with Google and stops all further syncing. You can also revoke access from your Google security settings at https://myaccount.google.com/permissions. Upon disconnection you may request deletion of previously imported YouTube data (see Your rights below); stored API data is refreshed or deleted in line with the YouTube API Services policies.

Posting to YouTube, Instagram and TikTok

On plans that include posting, you can connect posting accounts from the Channels page. Each connection is made only when you press Connect, and we publish only when you press Post or schedule a video. We never post on our own initiative.

• YouTube posting: through Google sign in we request permission to upload videos (youtube.upload) and to read your channel (youtube.readonly), so we can upload the video you chose, with the title, description, tags and privacy you set, and report its processing status.
• Instagram posting: through Facebook Login for Business we request instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement and business_management. We use them to list the Facebook Pages you select and the Instagram Business or Creator accounts linked to them, read each account's id, username, name and profile picture, publish the Reels you choose with the caption you wrote, and read back each Reel's status and link. We do not read your messages, comments, followers, insights or ads, and we do not post to your Facebook Page.
• TikTok posting: through TikTok Login Kit we request user.info.basic and video.publish. We use them to read your TikTok account's id, display name and avatar, read the posting options TikTok allows for your account (privacy levels, whether comments, Duets and Stitches are available, the longest video you can post), post the video you chose with the caption, privacy, interaction and disclosure settings you picked for that post, and read back its status and link. We do not read your videos, followers, messages or analytics.
• Tokens: the access tokens Google and Meta issue are encrypted with AES-256-GCM before they are stored, held server side only, never sent to the browser, never logged and never shared.
• Data we keep: the account id, name, username and picture, the encrypted tokens, the granted permissions, the Facebook Page id and name an Instagram account is reached through, and a record of each post (time, status, caption, link).
• Disconnecting deletes our copy of the tokens at once. For YouTube we also revoke the grant at Google, and for TikTok at TikTok. For Instagram, remove WhatToUpload in Facebook under Settings, Business integrations, which revokes Meta's grant for every Page and Instagram account you shared.

Data received from Meta or TikTok is used only to provide the posting features above. It is not sold, not used for advertising, not shared with third parties except the platforms you post to, and not used to train any AI model.

How we use your data

• To provide the product: generating ideas, titles, packaging, scripts and research personalized to you.
• To power your Creator Brain: your decisions inside the app are converted into preferences with confidence scores, visible and editable by you.
• AI processing: content you submit (ideas, briefs, profile context) is sent to our AI model providers to generate results. Providers process it as data processors and it is not used to train their public models per their API terms.
• We do not sell your data. We do not share it with advertisers.

Your rights and controls

• Inspect and correct: every learned preference is visible on your Creator Brain page, with controls to correct, delete or confirm it.
• Disable learning: you can pause decision recording entirely at any time.
• Delete: you can request deletion of your account and all associated data (including imported YouTube data) by emailing us; deletion completes within 30 days.
• Export: you can request an export of your data.

How we protect your data

We treat your YouTube data and your account credentials as sensitive data, and protect them with the following mechanisms.

• Encryption in transit: every connection to whattoupload.com is served over HTTPS using TLS 1.2 or higher. The application's connection to its database also requires TLS (sslmode=require); unencrypted database connections are refused.
• Encryption at rest: all data, including imported YouTube data and OAuth tokens, is stored in managed PostgreSQL (Neon, AWS us-east-1) which encrypts data at rest using AES-256. Backups and snapshots are encrypted with the same mechanism.
• Credential handling: account passwords are never stored in plaintext. They are salted and hashed with scrypt, and the hash is all we retain. We cannot recover or read your password.
• OAuth token handling: Google, Meta and TikTok access and refresh tokens are held server-side only, and posting tokens are additionally encrypted with AES-256-GCM before storage. They are never sent to the browser, never written to logs, never exposed through any API response, and never shared with third parties.
• Access control: production database access is restricted to the single operator of the service, authenticated separately from the application. Administrative access to the app requires Google sign-in from an explicit email allowlist; a password session is not sufficient to reach any administrative view. Passwords, sessions, verification tokens and OAuth tokens are never rendered in any administrative interface.
• Revocation: disconnecting your channel calls Google's token revocation endpoint, so our access is withdrawn at Google rather than merely forgotten locally, and syncing stops immediately.
• Retention and deletion: imported YouTube data is retained only while your channel is connected and your account is active. On disconnection you may request its deletion, and account deletion removes all associated data, including imported YouTube data, within 30 days. Stored YouTube API data is refreshed or deleted in line with the YouTube API Services policies.
• Minimization: the stats connection uses read-only YouTube scopes only. Upload and publish permissions are requested only by the separate posting connection, only when you press Connect, and never include edit, delete or comment permissions.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, email polostudio.brand@gmail.com and we will respond.

Limited Use of Google user data

WhatToUpload's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Concretely, this means we use Google user data only to provide and improve the user-facing features described in this policy; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with your consent; we do not use it for advertising, and we do not sell it; and no human reads it except with your explicit consent, to comply with applicable law, or where it has been aggregated and anonymized for security or abuse investigation.

Google user data is never used to train any AI model, ours or a third party's.

Delete your data

You can delete data at any of three levels, and none needs a reason.

• One posting account: open Channels in WhatToUpload and press Disconnect next to the account. Its tokens are deleted immediately.
• Everything Meta gave us: remove WhatToUpload in Facebook under Settings and privacy, Settings, Business integrations, then disconnect the account in Channels. On request we also delete the post records and account details we hold.
• Your whole account: email polostudio.brand@gmail.com from the address you sign in with and ask for deletion. We delete your account and all associated data, including YouTube, Instagram and TikTok data and tokens, within 30 days and confirm by email.

Contact

Data controller: WhatToUpload. For privacy requests, deletion or questions: polostudio.brand@gmail.com.