Privacy Policy

TL;DR

We store your email, the YouTube URLs you submit, the clips we generate, and billing info. We share data only with providers that make the Service work (Google Cloud, OpenAI / Deepgram, Stripe, and a few opt-in analytics tools — see Subprocessors) and never sell it. You can download or delete everything from your account settings.

1. Who we are

ReUpload is operated by Noah Johnston, a sole proprietor doing business as “ReUpload,” based in Wisconsin, United States. For privacy questions or data-subject requests (including EU/UK GDPR access, correction, deletion, and portability requests), email noahjj1350@gmail.com. As a sole proprietor below GDPR Art. 37 thresholds, we have not appointed a formal Data Protection Officer; Noah Johnston serves as the privacy contact for all data-subject and supervisory-authority inquiries.

2. What we collect

Account data: name, email, hashed password (if credentials signup), profile picture URL (if OAuth). Stored in Firestore.

Usage data: YouTube URLs you submit, transcripts, AI-generated clip metadata, rendered video files, which platforms you post to. Stored in Firestore + Google Cloud Storage.

Billing data: Stripe customer id, subscription status. Card numbers are handled directly by Stripe — we never see or store them.

Technical data: IP address, browser type, pages viewed (for security + fraud prevention; retained 30 days).

AI-derived data: machine-generated transcripts of your source videos, AI-scored clip rankings, and AI-generated titles / descriptions / tags. Under CCPA 2026, AI-derived personal data inferred from your content (e.g. inferred topics or speech content) may qualify as sensitive personal information; see the ADMT section below.

3. How we use it

• Run the video-processing pipeline you asked for.
• Keep you signed in and send account-critical email (password resets, verification, billing receipts).
• Post clips to third-party platforms on your behalf when you authorize it.
• Detect fraud and abuse (rate limits, payment disputes).
• Send product updates (you can opt out anytime).

4. Automated decision-making (ADMT) and AI disclosures

Under the California Consumer Privacy Act (CCPA, including the 2026 ADMT and AI updates) and the EU AI Act (notably Article 50, applicable from 2 Aug 2026), we are required to clearly disclose where AI is involved in our Service. Here is what our AI actually does:

• Whisper / Deepgram — speech-to-text transcription of the audio in your source video. The transcript may include any words spoken in the video.
• GPT-4 (OpenAI) — proofreads transcripts, picks candidate highlight moments, and generates clip titles, descriptions, and tags.
• Internal clip-virality scoring model — ranks candidate clips by predicted short-form performance. This is purely advisory; you decide which clips to publish.

No legal or similarly significant automated decisions. ReUpload does not use automated processing to make decisions that produce legal effects on you or that are similarly significant (such as denying you access to services, employment, credit, housing, or insurance). The AI outputs are content recommendations; the final publish decision is always yours. This means our ADMT use is outside the scope of CCPA § 7220's “significant decisions” opt-out, but we still disclose it for transparency.

Opt-out: if you do not want your content processed by our AI pipeline at all, do not submit videos to ReUpload — AI processing is core to how the Service works. For EU users, you may also email noahjj1350@gmail.com to request an explanation of any AI-derived output that affects you.

No model training on your data: OpenAI's API terms (which we rely on) state that data submitted via their API is not used to train OpenAI models. We do not train our own models on your videos, transcripts, or clips.

5. Who we share with (subprocessors)

We use the third-party subprocessors listed in full on our Subprocessors page. In summary:

• Google Cloud Platform — Firestore (database), Cloud Run (compute), Cloud Storage (clip files), Pub/Sub (job queue).
• OpenAI and/or Deepgram — transcription + AI text generation.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Sentry — error tracking (when enabled).
• PostHog and/or Microsoft Clarity — product analytics and session replay (consent-gated; off by default).
• YouTube Data API — search and (when you connect) publishing.
• Platform APIs you explicitly connect (TikTok, Instagram, YouTube, etc.) — publishing clips on your behalf.

Google user data (Limited Use disclosure):ReUpload's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect a YouTube channel, we access it only to upload the clips you tell us to publish, read back the status and performance of those uploads, and show you which channel is connected. We never use Google user data for advertising, never sell it, and no humans read it except with your consent, for security purposes, or to comply with law.

We never sell your personal data. We do not share it for cross-context behavioral advertising.

6. Where your data lives and international transfers

Account data and clip files are stored in Google Cloud's US region (us-central1) by default. Transcription sends audio to OpenAI / Deepgram infrastructure in the United States. If you are in the EU, UK, or Switzerland, this involves an international transfer of personal data. We rely on the EU Commission's Standard Contractual Clauses (SCCs) with each subprocessor (the UK addendum and Swiss equivalent where applicable) to provide appropriate safeguards under GDPR Chapter V.

7. How long we keep it

• Source videos downloaded for processing: deleted within 30 days.
• Rendered clips: retained indefinitely while your account is active; deleted on request or within 30 days of account deletion.
• Account data: as long as your account is active + 30 days after a deletion request for backups.
• Transcripts: 90 days unless part of an active project.
• Access logs / technical data: 30 days.
• Billing records: 7 years, to meet U.S. accounting and tax regulations.

8. Your rights (GDPR / CCPA)

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (“right to be forgotten”).
• Export / port your data in a machine-readable format.
• Object to, or restrict, certain processing.
• Withdraw consent for optional processing (e.g. analytics).
• Opt out of the “sale” or “sharing” of personal information (CCPA — see Do Not Sell or Share).
• Limit use of sensitive personal information (CCPA 2026).
• Lodge a complaint with your local supervisory authority (e.g. your EU data-protection authority, or the California Privacy Protection Agency).

Most of these are self-serve under Settings → Privacy. For anything that is not, email noahjj1350@gmail.com — we will respond within 30 days (or 45 days for CCPA, with one possible 45-day extension as the statute allows).

9. Security

We use TLS 1.2+ for data in transit, Google Cloud's at-rest encryption for data at rest, bcrypt for passwords, and Secret Manager for API keys. We apply least-privilege IAM on service accounts and rotate credentials. No system is 100% secure; if we discover a breach involving your data, we will notify you and the appropriate supervisory authorities within 72 hours of becoming aware, as required by GDPR Art. 33 and applicable U.S. state breach-notification laws.

10. Cookies and tracking

By default we set only essential cookies: session authentication, CSRF tokens, and a cookie-consent preference. We do not set analytics, advertising, or session-replay cookies unless you explicitly accept them in the cookie banner shown on your first visit. You can change your choice anytime from Settings → Privacy.

11. Children's privacy (COPPA)

ReUpload is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that a child under 13 has provided us personal information, we will delete it promptly. This policy reflects updated COPPA requirements that take effect April 22, 2026, including stricter data-minimization, verifiable parental consent obligations for any future child-directed feature, and explicit retention limits for any data inadvertently collected from minors.

If you are a parent or guardian and believe your child under 13 has provided us personal information, email noahjj1350@gmail.com and we will delete it. Users between 13 and the age of majority should have parental or guardian consent before creating an account.

12. Changes

We will update this policy when practices change. Material changes are announced in-app and by email at least 30 days before taking effect.

13. Contact

Questions, concerns, data-subject requests: noahjj1350@gmail.com.

ReUpload is operated by Noah Johnston, a sole proprietor based in Wisconsin, United States.