Privacy Policy

Who this policy covers

• Our team, and creators or their assistants to whom we give a login.
• Creators who connect a Facebook Page, Instagram professional account, YouTube channel or Pinterest account.
• Creators who install our Chrome extension.
• People who comment on, or send a message to, a creator’s Instagram account where an automation is active.
• People who click one of our short links.
• People who join the waitlist on our home page or fill in the setup guide.

Information we handle

• Logins: the email address and password of each person with access. Passwords are stored by our authentication provider in hashed form; we never see them.
• Creator details: name, TikTok username, Amazon affiliate tag, time zone, disclosure text and the commission terms agreed with us.
• Connected accounts: the identifiers and names of the Facebook Pages, Instagram accounts, YouTube channels and Pinterest accounts and boards the creator chooses to share, and, when the creator authorizes it, their TikTok account identifier and display name; plus the access and refresh tokens the platforms issue for them.
• Content: the public videos, captions and cover images from the creator’s TikTok profile, which we import to republish them, plus the captions, titles, comments, schedules and links of the posts we prepare.
• Instagram comments and messages: when an automation is active, we receive from Meta the comments and direct messages sent to that account. For the ones that contain the automation’s keyword we use the sender’s Instagram-scoped identifier to send the requested reply, and we keep the identifier of the comment or message we answered so we never answer twice. A technical log of incoming events, which can include the first characters of a comment, is kept for 30 days to troubleshoot delivery.
• Link clicks: the time of the click, the type of device, the referring website, the app the link was posted on and the country the click came from. We do not store IP addresses, names or contact details of the people who click, and we set no cookies on them.
• Waitlist and setup guide: the details a person enters there, such as their name, email address, TikTok username, time zone and Amazon Store ID. To limit repeated submissions we also keep a counter tied to the IP address the form was sent from.
• Chrome extension: see the dedicated section below.
• Amazon reports: when a creator adds us as a user of their Amazon Associates account, we can view their earnings reports there. We copy only the monthly totals needed to calculate our commission.

How we use it

Only to run the service agreed with the creator: to import their videos, prepare and publish posts on the accounts they connected, post the first comment, answer comments and messages that ask for a link, build affiliate links with their own tag, show them which products and campaigns pay more, report clicks and earnings, and calculate our commission. We do not sell information, we do not use it for advertising, and we do not build profiles of the people who comment or click.

Meta platform data

We access Facebook and Instagram only through Meta’s official APIs and only with the permissions the creator grants on the Facebook Login screen. We use them to list the Pages and Instagram accounts the creator selects, publish videos to them, post and read comments on those posts, and send the replies and direct messages that the creator’s automations define. Our use of information received from Meta follows the Meta Platform Terms and Developer Policies.

YouTube and Google data

Republish uses YouTube API Services. We access YouTube only with the permissions the creator grants on the Google sign-in screen, to identify the channel, upload the videos agreed with the creator, set their title, description, tags and thumbnail, post a comment on them, and read the list of videos already on the channel (title, date, thumbnail and length) so the same video is never uploaded twice. If our comment fails to post, we look at the comments under that one video to see whether it is already there, and keep nothing from them. We do not read the creator’s email, contacts, files or any other Google data, and we do not use Google user data to develop, improve or train artificial intelligence or machine learning models. By connecting a channel the creator agrees to the YouTube Terms of Service, and the Google Privacy Policy applies to Google’s handling of their data. Republish’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, we do not use it for advertising, and we do not pass it to any other platform or third party: it stays with us and with the infrastructure providers named below, which store or process it for us. The creator can revoke our access at any time on the Google security settings page, myaccount.google.com/permissions.

Pinterest data

We access Pinterest only through its official API and only with the permissions the creator grants on the Pinterest sign-in screen, to identify the account, list its boards, and create Pins from the creator’s videos on one of those boards. The creator can revoke our access at any time from their Pinterest account settings.

TikTok data

When a creator connects TikTok, we use TikTok’s Login Kit and Display API only with the permissions they grant (basic profile information and the list of their public videos), to find the videos they post so we can prepare them for republishing. We then fetch those videos from their public links. The creator can revoke our access at any time from the TikTok app, under Settings and privacy, Security, Apps and services permissions.

The Chrome extension

The extension works only on amazon.com and on Amazon Associates Central, and only after the creator enters the personal key we give them. On those pages it reads what is shown (product details, affiliate commission rates, Creator Connections campaigns, report tables) to display it in its panel; this stays in the browser. It sends information to us only when the creator presses a button: a product or campaign link to save, a video marked as uploaded, or, with “Send this page to support” and after a confirmation, a copy of the visible page without scripts, hidden fields, cookies or passwords, which we use only to fix the extension and delete within 90 days. When the creator runs a campaign check, the extension opens Creator Connections searches in background tabs of their own browser and closes them again. It stores its settings and recent results in the browser’s own storage. It does not read other websites, and it does not collect browsing history.

Amazon

Our links point to amazon.com and carry the creator’s own affiliate tag. We are not affiliated with Amazon, and Amazon’s own privacy notice applies to anything that happens on its sites, including purchases.

Cookies

The tool uses only the cookies it needs to work: one that keeps a signed-in user logged in, one that remembers which creator they are working on, and short-lived ones that protect the sign-in with Facebook and Google. There are no analytics or advertising cookies, and none are set on people who click our short links.

How long we keep it

• Video files: deleted seven days after the last post made from them is published, or after 30 days if the video still has to go on the creator’s Amazon storefront.
• Access tokens: kept while the account is connected and deleted when it is disconnected in the app. If access is revoked on the platform’s side, the tokens stop working at once and we delete them within 30 days.
• The list of a YouTube channel’s videos: while the channel is connected; deleted when it is disconnected.
• Webhook log: 30 days. Pages sent to support: up to 90 days.
• Captions, post records, links, automations and click counts: while we work with the creator, so we can report on what was published, and deleted on request.

Withdrawing access and deleting data

A creator can revoke our access at any time without asking us: on Facebook under Settings, Apps and websites, remove Republish; on Google at myaccount.google.com/permissions; on TikTok under Settings and privacy, Security; the Chrome extension can be removed from the browser, and we can disable its key. Once access is revoked we can no longer publish to those accounts. To have everything we hold about you deleted, including tokens, videos, posts, links and click history, or to ask what we hold about you, email 0chrischap@gmail.com from an address linked to your accounts. We complete deletion within 30 days, and within 7 days for anything we received from YouTube, and confirm by email. People who commented on or messaged a creator can ask the same.

Where it is stored and who processes it

Data is stored with our infrastructure providers: Supabase (database, file storage and sign-in), Vercel (web hosting) and Trigger.dev (background jobs), which may process it in the United States. Tokens are kept on our servers and never sent to the browser. Each login sees only the creators it has been given access to. We share data only with the platforms themselves (Meta, Google and YouTube, Pinterest, TikTok, Amazon) when we act on the creator’s behalf, and with authorities when the law requires it.

How we protect your data

These measures apply to everything described in this policy, including Google user data: the identifier and name of a connected YouTube channel, the list of its videos, and the access and refresh tokens Google issues for it.

• Encryption in transit: every connection between a browser, our servers, our providers and the platforms’ APIs uses HTTPS (TLS).
• Encryption at rest: the database and the file storage, including the access and refresh tokens, are encrypted at rest with AES-256 by Supabase, the provider that stores them.
• Tokens stay on the server: access and refresh tokens are never sent to a browser or to the Chrome extension. No login, ours included, can read them through the app; only the server code that publishes on the creator’s behalf can.
• Access control: each login can read and change only the creators it has been given access to. This is enforced by the database itself (row-level security) on every table, not only by the screens of the app.
• Private files: video files are kept in private storage, and the app opens them through links that expire.
• Limited access for our team: only the people who operate the service can reach the production systems and the keys that run them, which are kept as encrypted secrets by our providers and never in the source code.
• Only what is needed: we ask each platform for the permissions the service uses and nothing more, and the sign-in with Google and Facebook is protected against forged requests.
• Revocation and deletion: the creator can revoke our access on the platform at any time, which makes the tokens we hold useless at once. Tokens are deleted when the account is disconnected in the app or when the creator asks for deletion, and the extension key can be revoked by us.

No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay.

Children

The tool is for adult creators and businesses. We do not knowingly handle information about children under 13.

Changes to this policy

We may update this policy as the tool evolves. When we do, we change the date at the top of this page and, for changes that affect creators, we tell them directly.