What we collect,
and why.

This policy covers Reauris Studio (“Studio”) at studio.reauris.com, a tool that writes, renders, schedules and publishes social media posts and videos to accounts you connect. It is operated by Reauris (reauris.com), India. Contact: [email protected].

In short: we collect only what is needed to publish for you, we never sell it or use it for advertising, and you can delete all of it at any time.

1. Information you give us

• Account: email address, display name, time zone, and a password hash (scrypt with a per-user salt; we cannot see or recover your password).
• Your work: projects (brand name, colours, fonts, voice notes, logo and images you upload), post drafts, captions, scripts, schedules, and the images and videos rendered from them.
• Messages you send us by email.

2. Information from accounts you connect

When you connect a social account, you sign in on that platform and choose what to allow; you never give us its password. We receive an access token and store it encrypted with AES-256-GCM, with the key kept on the server and never in the database. Tokens are never sent to any browser, and no screen or API shows them.

2.1 Google: YouTube

When you connect a YouTube channel, Studio requests these Google permissions, and uses each only as described:

• youtube.readonly (view your YouTube account): to read your channel’s id, title, handle and thumbnail, so we can show which channel is connected; and to read the view, like and comment counts of videos that Studio uploaded for you.
• youtube.upload (manage your YouTube videos): to upload the videos you created or scheduled in Studio to your channel, with the title, description and tags you set.
• youtube.force-ssl (manage your YouTube account): only to post one comment under a video Studio uploaded for you, containing your own website link.
• yt-analytics.readonly (view YouTube Analytics reports): to read, for videos Studio uploaded, the average percentage viewed, average view duration, engaged views and shares, and show them to you next to each video for 28 days after it is published.

We store: your channel id, title, handle and thumbnail URL; an encrypted refresh token; the ids of videos we uploaded for you; and, for those videos only, the figures listed above. We do not read your other videos, playlists, subscribers, subscriptions, comments by others, messages, Google profile, email or contacts, and we request no other Google scopes.

Limited Use. Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features above to you; it is not sold, not used for advertising, not used to build profiles, not used to train AI or machine-learning models, and not read by people except with your permission for support, for security, or where the law requires.

Studio uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. You can revoke Studio’s access at any time at myaccount.google.com/permissions.

2.2 Meta: Facebook, Instagram and Threads

• Facebook Pages (pages_show_list, pages_read_engagement, pages_manage_posts): to list the Pages you manage so you can choose one, read the chosen Page’s id, name, picture and access token, and publish the posts you create to it.
• Instagram professional account (instagram_basic, instagram_content_publish, instagram_manage_insights): to read the linked account’s id, username and picture, publish your images, carousels and Reels to it, and read views, reach, likes, comments, shares, saves and average watch time for posts Studio published.
• Threads (threads_basic, threads_content_publish): to read your profile’s id, username and picture and publish your posts to it.

We store the ids, names and pictures of the connected accounts, encrypted tokens, the ids of posts we published, and the figures above for those posts only.

2.3 X and LinkedIn

To publish your posts: the account’s id, name and picture, and an encrypted token. We read nothing else from them.

3. How we use information

• To provide Studio: render, schedule and publish what you create, and show you how it performed.
• To keep the service secure: sign-in, rate limits, an audit log of account actions, and checking that connections still work.
• To reply when you contact us, and to send account emails (password resets, your weekly Autopilot summary if you turn Autopilot on).

We do not use your information for advertising, sell or rent it, or use it to train machine-learning models.

4. Who else receives information

• The platforms you publish to receive the posts and videos you send them, under their own terms.
• Hostinger hosts our server and database (India). Cloudflare carries traffic to the site and protects it.
• Optional AI services: voice-overs are normally made on our own server. Only if a cloud voice (OpenAI) or AI copywriting (Anthropic) is switched on for your workspace is the script or topic text sent to that provider to produce it. No Google or Meta user data is ever sent to them.
• Public image links: Instagram and Threads fetch images and videos from a public link at the moment of publishing. Treat anything you render as public once you publish it.
• Authorities, only where the law requires it.

5. Keeping it safe

HTTPS everywhere; tokens encrypted at rest; passwords hashed; each workspace can reach only its own data; the operator console sits behind a separate password; backups are encrypted. No system is perfectly secure, and if a breach ever affects your data we will tell you.

6. How long we keep it

• Connected-account tokens: until you disconnect the account or delete your workspace.
• Performance figures: refreshed for 28 days after a post goes out. YouTube figures are deleted 30 days after their last refresh; figures from other platforms are kept with the post until you delete it.
• YouTube channel name, handle and picture: re-read from YouTube regularly while connected, deleted when you disconnect.
• Your account and work: until you delete them or ask us to.
• Encrypted backups: 14 days, then destroyed.

7. Your choices and rights

• Disconnect any account in Connections; its token and details are deleted at once.
• Revoke access from the platform too: Google (myaccount.google.com/permissions), Facebook, Instagram or Threads settings.
• Access, correct or delete your data: email [email protected]. Deletion is completed within 30 days. Step by step: data deletion.

These rights apply wherever you live, including under India’s Digital Personal Data Protection Act, 2023.

8. Cookies

One sign-in cookie (httpOnly, so page scripts cannot read it) and one anti-forgery cookie. No advertising or analytics cookies, and no third-party tracking scripts.

9. Children

Studio is for businesses and adults. It is not directed at anyone under 18, and we do not knowingly collect their data.

10. Changes

If this policy changes in a way that affects what we collect or where it goes, the date above changes and we tell account holders by email before it takes effect.

11. Contact

Reauris · [email protected] · reauris.com