Privacy Policy

1. Information We Collect

We collect information only to the extent necessary to provide AI video generation, workspace management, and authorized YouTube publishing:

• User Profile & Authentication Data: When you register or sign in via Supabase Auth or Google OAuth, we collect your name, email address, profile avatar image, and user identifier.
• Generative Video Inputs: Creative text prompts, style descriptors, reference image files, aspect ratio configurations, and audio settings provided by you to synthesize video media.
• Generated Media Assets: Video MP4 files, preview GIF animations, thumbnail stills, and generation metadata generated on cloud GPU inference clusters and saved to your personal library.
• Google & YouTube OAuth Credentials: When you link your YouTube channel, we receive OAuth access_token and refresh_token tokens, the associated YouTube Channel ID, and Channel Title. All OAuth credentials are encrypted at rest using AES-128 Fernet authenticated encryption (SEC-013).
• Payment & Transaction Details: App Coin pack purchases, subscription tier status, and transaction identifiers processed through Razorpay. We do not store raw credit card numbers, debit card numbers, CVVs, or UPI banking PINs.
• Technical Diagnostics & Logs: IP address, browser user-agent, operating system, and request timestamps, collected strictly for rate limiting, distributed denial-of-service prevention, and operational debugging.

2. How We Use Your Information

We process your data strictly for legitimate operational purposes:

• Synthesizing and rendering requested AI videos across cloud inference servers;
• Uploading, tagging, and scheduling video publications to your authorized YouTube channel upon your direct request;
• Maintaining and updating your App Coin account balance and daily generation quotas;
• Displaying post-publishing performance analytics and audience retention insights on your studio dashboard;
• Protecting against fraud, abuse, automated scraping, and unauthorized system access;
• Providing technical customer support and notifying you regarding video generation completions.

3. Google API Services & YouTube Data Handling (Granular Scope Disclosure)

FeedCrafts requests only the narrowest, minimum OAuth permissions necessary to deliver our user-facing video publishing and analytics features. Below is a comprehensive breakdown of each Google OAuth scope requested, why it is needed, how data is processed, and how it is secured:

Affirmative Google Limited Use Guarantees

In accordance with the Google API Services User Data Policy, FeedCrafts strictly abides by the following principles:

• No Generalized AI/ML Model Training: FeedCrafts does NOT use any data received from Google APIs (including uploaded videos, channel titles, descriptions, or YouTube analytics) to train, fine-tune, or develop generalized Artificial Intelligence (AI) or Machine Learning (ML) models. Your YouTube data is never added to AI training datasets.
• No Sale of Google User Data: FeedCrafts does NOT sell, rent, lease, trade, or transfer Google user data to any third parties, brokers, or marketing platforms under any circumstances.
• No Advertising or Retargeting: Google user data is never used to display advertisements, build advertising profiles, or retarget users across third-party websites.
• Restricted Human Review: No human personnel at FeedCrafts are permitted to read or inspect your Google user data, except under the following strict conditions:
  1. With your explicit, prior written consent to troubleshoot a specific technical support issue;
  2. When strictly necessary for security purposes, such as investigating abuse, fraud, or system compromise; or
  3. To comply with applicable laws, court orders, or governmental regulations.

4. Data Sharing & Third-Party Sub-Processors

We do not share your personal information or Google user data with any third party, except the following essential sub-processors required to deliver our service:

• Google LLC / YouTube: Service provider for executing user-requested video uploads and retrieving analytics via the official YouTube Data API v3.
• Supabase Inc.: SOC 2 Type II compliant cloud database and authentication provider. Stored credentials and records are protected by PostgreSQL Row-Level Security (RLS).
• Razorpay Software Pvt. Ltd.: PCI-DSS Level 1 compliant payment gateway for processing App Coin credit purchases and subscription billing.
• AI Inference Infrastructure: Cloud GPU inference clusters used solely to render user video prompts over TLS encrypted connections. Prompt text and reference images are processed in memory and not retained for public models.

5. Data Retention, User Control & Deletion (Revocation)

You have full, autonomous control over your data, credentials, and video assets at all times:

How to Disconnect YouTube Access

You can disconnect your YouTube channel at any time directly within the FeedCrafts dashboard by going to Settings → Disconnect Channel. When you disconnect, all stored Google OAuth access tokens and refresh tokens are immediately and permanently erased from our database.

How to Revoke Permissions via Google Security Settings

You can revoke FeedCrafts’ access to your Google account at any time through the official Google Security Settings portal:

👉 https://myaccount.google.com/permissions

Once revoked via Google, FeedCrafts immediately loses all access to your Google account and can no longer publish videos or retrieve analytics.

Data Retention Period

• OAuth Credentials: Retained only while your YouTube channel remains actively linked. Immediately purged upon disconnection.
• Cached Analytics Metrics: Retained for a rolling maximum of 30 days before being automatically refreshed or cleared.
• Generated Video Media: Retained in your personal workspace library until you delete them.

Account Erasure & Complete Data Deletion Request

To permanently erase your entire FeedCrafts account, stored profile data, generated videos, and associated records, send an email to mailto.hellow@feedcrafts.in or mailto.hellow@feedcrafts.in with the subject line "Data Deletion Request". Our team will permanently and irreversibly purge all personal data and credentials from our systems within 48 to 72 hours and send written confirmation.

6. Security Standards & Credential Protection

FeedCrafts implements rigorous defense-in-depth technical and organizational safeguards:

• Authenticated Encryption at Rest: All Google OAuth access tokens and refresh tokens are encrypted at rest using AES-128 Fernet authenticated encryption (SEC-013).
• End-to-End Transport Security: All client-to-server and server-to-API communication is enforced over TLS 1.3 encryption.
• Tenant Isolation: PostgreSQL Row-Level Security (RLS) ensures that no user can access, query, or modify another creator's tokens or media.
• Server-Side Protection: Strict rate limiting, SSRF URL validation (SEC-023), and anti-tamper guards to block automated attacks.

7. Your Privacy Rights (GDPR, CCPA & Indian DPDP Act)

Depending on your jurisdiction, you possess the following statutory data rights:

• Right to Access: You may request a complete export of personal data held about you;
• Right to Rectification: You may correct inaccurate or incomplete account details;
• Right to Erasure (“Right to be Forgotten”): You may request complete erasure of your data;
• Right to Withdraw Consent: You may withdraw consent for YouTube publishing or marketing at any time without penalty.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. When changes occur, the updated policy will be published on this page with an updated “Last Updated” date. We encourage you to review this policy periodically.