Privacy Policy

• Member accounts. Name, email address, role and a password hash (passwords are never stored in plain text), plus sign-in sessions and a log of the actions members take in the studio.
• Connected social accounts. When a member connects an account through the platform's official login, we receive the data that platform returns for the permissions granted, together with access and refresh tokens. For TikTok (Login Kit, permission user.info.basic) this is the account's open ID, union ID, display name and avatar. For YouTube and Instagram it is the channel or account ID, name and profile picture.
• Extra permissions, only if granted. If the owner later reconnects an account with additional permissions (for example reading the account's own video list and statistics, or uploading a video), we receive the data those permissions cover, such as the account's own posts and their public counts. The platform shows these permissions on its consent screen before anything is granted.
• Studio content. Ideas, scripts, prompts, images, audio, videos, captions, publishing settings and approvals that members create or upload.
• Performance and business records. Figures for the owner's published posts, read through official platform APIs or imported by the owner, and cost and revenue records the owner enters.
• Technical data. IP address, browser details and request logs, used for security and troubleshooting.

We do not collect data about other TikTok, YouTube or Instagram users, and we do not read private messages.

• To sign members in and keep their sessions secure.
• To identify a connected social account and let the owner confirm that it is exactly the account they meant to connect.
• To prepare videos and, only after the owner has reviewed and approved the exact video, caption, account and timing, to deliver that video to the chosen account.
• To show the owner how their own published posts perform.
• To operate, secure and troubleshoot the service.

We do not sell data, use it for advertising, build profiles of platform users or share it for anyone else's marketing. We do not use platform data to train AI models.

• Platform data is read only through official APIs and only within the permissions the account holder granted. It is used only to manage that same account in the studio.
• Access and refresh tokens are encrypted (AES-256-GCM) on our server. They are never sent to the browser and never written to logs.
• Nothing is uploaded or published to an account without the owner's explicit approval of that exact item.
• Disconnecting an account in the studio deletes its stored tokens. Revoking access also asks the platform to revoke the authorization and removes cached profile data; a minimal record of the account's identity is kept so its history stays readable. When TikTok tells us that an authorization was removed, we delete the related tokens.
• You can also remove the app at any time in your TikTok, Google or Instagram account settings. For Google accounts, use Google account permissions.
• YouTube data is accessed through YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google handles data under the Google Privacy Policy. TikTok and Instagram data is likewise subject to the TikTok Privacy Policy and the Instagram Privacy Policy.

• Hosting. The service runs on a server located in the European Union (France).
• Cloudflare carries traffic to the site and protects it from attacks. It sees IP addresses and request data.
• AI and media providers that the owner chooses to enable (for example text, image, voice or video generation services) receive the prompts and inputs a task needs, and only when that task runs. They are off unless the owner turns them on.
• The social platforms receive what is needed to sign in, read the connected account's data and, after approval, deliver a video.
• Voice commands. If a member speaks to the studio's assistant, the browser's own speech recognition (for example Google's service in Chrome) turns the audio into text. We store the text of commands, never the raw audio.

We may disclose data if the law requires it.

We use one strictly necessary sign-in cookie. It is encrypted, holds only an internal user ID and session ID, and expires after 14 days or when you sign out. The sign-in system also sets short-lived security cookies. Cloudflare may set its own security cookie. We use no analytics or advertising cookies.

Passwords and access tokens are never kept in browser storage. The browser may keep display preferences, such as a collapsed sidebar.

• Member and studio data is kept while it is needed to run the service, or until the owner deletes it.
• Platform tokens are deleted when an account is disconnected or its access is revoked, or when the platform tells us the authorization was removed.
• Performance data can be deleted after a retention period the owner sets, and whenever a platform requests deletion.
• Technical request logs are kept only as long as needed for security and troubleshooting.
• Daily backups are stored on our server, so deleted data can remain in a backup until that backup is removed.

Traffic uses HTTPS. Passwords are hashed, platform tokens are encrypted, permissions are checked on the server, and important actions are logged. No system is perfectly secure, but we work to protect your data and will act promptly on any incident.

You can ask to see, correct, export or delete your personal data, or object to how it is used. If you are in the European Union or the United Kingdom you have these rights under the GDPR, including the right to complain to your data protection authority. To make a request, email [email protected]. We answer within 30 days.

If you connected a TikTok, YouTube or Instagram account and want its data removed, disconnect it in the studio or remove the app in that platform's settings, and email us if you want anything else deleted.

FRAMEPILOT is a tool for adults. It is not meant for anyone under 18, and we do not knowingly collect children's data.

If we change this policy, we update the effective date at the top of this page. Significant changes are announced to members in the studio.

Questions about privacy: [email protected]. See also our Terms of Service.