Privacy Policy

This Privacy Policy explains what information Profaily collects when you use the service, why we collect it, who we share it with, and how you can delete it. Profaily lets you upload a video once and schedule or publish it across platforms you connect, including TikTok, YouTube, Facebook, and Instagram.

1. Information we collect

Account information. The name and email address you register with, or the name and email your identity provider (Google, TikTok, Facebook, or Instagram sign-in) shares with us when you sign in that way. If you register with a password, we store a salted hash of it — never the password itself.

Connected-platform information. When you connect a channel, we store the account identifier, handle, and avatar the platform returns, and the access and refresh tokens needed to post on your behalf. Tokens are held server-side and are never exposed to the browser or to other users.

Your content. The videos, captions, thumbnails, and scheduling choices you upload or create in Profaily, stored in private cloud storage until you delete them or your scheduled posts publish.

Technical information. Session cookies that keep you signed in, and ordinary server logs (timestamps, error traces, request metadata) used to operate and secure the service. Profaily does not use third-party advertising trackers.

Product analytics and session recordings, only if you accept. With your permission, Profaily uses PostHog, hosted in the EU, to count which features are used and to record sessions: clicks, scrolling and page layout. Every text field is masked, your captions and titles are masked wherever they appear, and videos, thumbnails and avatars are replaced with blank boxes. Network requests are not recorded, and nothing is recorded on the sign-in or account-deletion pages. None of it loads until you press Accept, and you can change your mind at any time.

Privacy choices

Usage events from our servers. Separately from that choice, our servers record a few facts about how Profaily is used — that an account was created, a channel connected, a video uploaded, a post scheduled or published — tied to your account ID only, with sizes and times rounded into ranges. They never include your captions, titles, file names, handles or links, and they set nothing on your device.

Error reports. When something in Profaily breaks, we send a report of the error to Sentry, our error-monitoring provider, with your account ID and without your content. We do this because we have a legitimate interest in keeping Profaily working, so it is not affected by your analytics choice.

Error reports. When something in Profaily breaks, we send a report of the error to Sentry, our error-monitoring provider: the error itself, the page address without its query string, your account ID, an ID that links it to our server logs, your browser’s user agent, your language and timezone, and a short trail of recent clicks and page changes (with any text removed). Reports never include your captions, titles, videos, or passwords, and we do not send session or usage pings to Sentry. We send them because we have a legitimate interest in keeping Profaily working, so they are not controlled by the cookie or analytics settings.

2. How we use it

• To authenticate you and keep your session secure;
• To publish or schedule Your Content to the platforms you connect, at the times you choose;
• To maintain the connection to each platform (for example, refreshing an expiring token, or noticing when you’ve revoked access on the platform’s own side so we can prompt you to reconnect);
• To respond when you contact support; and
• To meet legal obligations and enforce our Terms of Service.

We do not sell your information, and we do not use Your Content to train models.

3. Cookies

Profaily sets one session cookie to keep you signed in. It is HttpOnly (not readable by page scripts), marked Secure outside local development, and scoped SameSite=Lax to the Profaily domain. If you accept analytics, PostHog keeps an identifier in a first-party cookie and in local storage; if you reject, only your choice itself is stored. We do not use advertising cookies.

4. Who we share it with

The platforms you connect. When a scheduled post is due, Profaily sends your video and caption (with #profaily added at the end, as our Terms describe) to the specific platform (TikTok, YouTube, Facebook, or Instagram) you selected for that post — and only that platform. Each platform then handles that content under its own privacy policy.

Infrastructure providers. We use third-party infrastructure to run the service — cloud storage for your uploaded video files, a database host, and a hosting provider for the application itself. These providers process data only to deliver that infrastructure to us and do not use it for their own purposes.

We do not share your information with advertisers or data brokers.

5. How long we keep it

We keep your content and account data for as long as your account is active. If you disconnect a platform, we delete the tokens for that platform immediately. If you delete your account, deletion is immediate and complete: we revoke every connected platform’s tokens, delete your uploaded media from storage, and remove your account, posts, and sessions. This cannot be undone.

6. Deleting your data

You can delete your account at any time from account settings inside Profaily. If you disconnect Profaily from a platform’s own app settings page (for example, Facebook’s or Instagram’s “Apps and websites” settings), that platform notifies us automatically and we remove the corresponding connection and stop posting to it. You can also request deletion by emailing [email protected].

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to certain processing. You can exercise most of these directly from account settings; for anything else, contact us at the address below and we will respond within a reasonable time.

8. Children

Profaily is not directed at children under 13, and we do not knowingly collect information from them.

9. Security

We encrypt data in transit, store connected-platform tokens server-side only, and keep uploaded media in a private storage bucket accessible only via short-lived, signed URLs. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy as the service changes. We will update the date at the top of this page when we do.

11. Contact

Questions about this policy or your data: [email protected]. See also our Terms of Service.