Information we collect
We collect account details, product settings, generated content, billing records, service logs, and information you choose to provide. When you connect a social account, we store encrypted OAuth access and refresh tokens and the account identifiers needed to provide publishing features.
YouTube API Services and Google data
FacelessReels uses YouTube API Services. By using our YouTube features, you also agree to the YouTube Terms of Service and should review the Google Privacy Policy.
With your authorization, we access your YouTube channel identity and upload videos and thumbnails to the channel you select. We store channel identifiers, display information, encrypted OAuth tokens, upload status, YouTube video identifiers, URLs, visibility choices, and errors. We do not sell Google user data or use it for advertising.
FacelessReels' use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the user-facing YouTube connection and publishing features that you request. We do not use Google user data for advertising, creditworthiness, surveillance, or training generalized AI or machine-learning models.
Instagram data
When you connect an Instagram professional account, FacelessReels uses the Instagram API with Instagram Login and requests instagram_business_basic and instagram_business_content_publish. We access the professional account ID, username, display name, profile picture, granted permissions, and an OAuth access token so you can identify the selected account and publish Reels that you create or approve.
We store the Instagram account identifiers, profile display information, granted scopes, token expiration, encrypted OAuth token, publishing status, media container and Reel identifiers, permalink, caption settings, and publishing errors. We use this data only to maintain the connection, show the selected account, and publish or troubleshoot content at your request. We do not sell Instagram data, use it for advertising, or publish without your configured authorization.
How we use and share data
We use data to authenticate you, create and render videos, publish content you request, operate subscriptions, prevent abuse, provide support, and improve reliability. We share only the minimum data needed with infrastructure, payment, AI, media-storage, email, analytics, and connected social-platform providers acting on our behalf or when required by law.
Storage, security, and retention
We apply technical and organizational safeguards designed to protect Google user data, OAuth credentials, generated content, and other sensitive information against unauthorized access, alteration, disclosure, or destruction.
- Encryption in transit: production traffic between your browser, FacelessReels, Google, YouTube, and our service providers is transmitted over HTTPS using TLS.
- Encryption at rest: OAuth access and refresh tokens are encrypted before database storage using authenticated AES-256-GCM encryption with a unique initialization vector. Tokens are decrypted only when an authorized server-side process must call the connected provider.
- Key and secret isolation: encryption keys, OAuth client secrets, and service credentials are kept in protected server-side environment configuration, separated from application data, and are never embedded in public client code.
- Access control and data minimization: authentication and authorization checks restrict connected-account data to the account owner and the minimum server processes required for connection, token refresh, and publishing. OAuth tokens are not returned to the browser or exposed through the user interface.
- Operational protection: we limit the data fields and OAuth scopes requested to those needed for visible product features, monitor service failures and suspected abuse, maintain dependency and platform updates, and investigate reported security events.
- Service-provider controls: infrastructure and processing providers receive only the minimum information needed to perform contracted services and are required to protect that information consistently with their contractual and legal obligations.
We retain connected-account identifiers, encrypted credentials, and publishing records only while needed to provide the connection and publishing features, resolve failures, meet security requirements, or comply with law. When you disconnect a social account, revoke authorization, or delete your FacelessReels account, we revoke provider access where supported and delete active copies of the corresponding tokens and connected-account data. Residual encrypted copies may remain temporarily in access-restricted disaster-recovery backups and expire through the applicable backup lifecycle unless longer retention is legally required.
If we identify a security incident affecting personal or Google user data, we will investigate, contain and remediate the incident, preserve necessary records, and notify affected users or authorities when required by applicable law. Security concerns can be reported to support@facelessreels.co.
Control and deletion
You can disconnect YouTube, Instagram, or TikTok in Dashboard Settings. Disconnecting removes the connection and associated local data and requests revocation from the applicable provider. You can also revoke FacelessReels from your Google security permissions or Instagram connected-app settings. Meta deauthorization and data-deletion callbacks are processed automatically. You may delete your entire FacelessReels account from Settings or request deletion by emailing support@facelessreels.co.
Your rights and contact
Depending on your location, you may request access, correction, export, restriction, objection, or deletion. Contact support@facelessreels.co. See also our Terms of Service.