Privacy Policy

Social Studio is a private tool operated by Leon Aurelius Taira to plan, publish and measure posts on his own social media accounts. It is not offered to the public. Only Google accounts added by an owner can sign in.

What the studio stores

• People who sign in: Google account email, name, profile photo and Google account identifier. Session records hold a hash of the session token, the browser's user agent and a keyed hash of the IP address, never the address itself.
• Connected social accounts: the account identifier, handle, display name, profile picture link and the permissions granted, plus the access and refresh tokens the platform issues. Tokens are encrypted with AES-256-GCM before they are stored.
• Content: drafts, scheduled and published posts, ideas, monthly plans and the photos and videos uploaded to the library.
• Analytics: numbers the platforms report for the connected accounts and their posts, such as followers, reach, impressions, views, likes, comments, shares and saves.
• Activity log: security-relevant actions (sign-ins, connections, publishing) with the time and the acting account.

What it does not do

• No advertising, no data sales, no sharing with data brokers.
• No tracking or analytics scripts. Cookies are limited to the sign-in session and short-lived sign-in and connection state.
• No posting without a person writing or approving the post and choosing when it goes out.

How data is used

Data is used only to run the studio: to sign people in, publish and schedule posts to the accounts they connected, show results, and power the writing and planning features. Platform data is never used for any other purpose.

Services that process data

• Vercel hosts the application and stores media in a private store (Singapore region).
• Neon runs the database (Singapore region).
• Google provides sign-in.
• AI model providers receive the text, images or summary numbers sent with an AI request, such as a draft to adapt or a photo to describe, and return a result: Anthropic (Claude) for writing, planning and photo descriptions, directly or through Vercel AI Gateway; OpenAI through Vercel AI Gateway for search indexing and generated images, when enabled. Access tokens and account credentials are never sent to them.
• Social platforms (Instagram, Facebook, Threads, LinkedIn, X, TikTok, YouTube) receive the posts and media published to them and provide account and post data back, under their own terms.

Google user data

The studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google sign-in data is used only to identify the person signing in.

YouTube

When a YouTube channel is connected, the studio uses YouTube API Services to upload videos and read channel and video statistics. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of the data is covered by the Google Privacy Policy. Access can be revoked at any time from Google account permissions or by disconnecting the channel in the studio.

Keeping and deleting data

• Disconnecting an account deletes its tokens and its imported analytics immediately. Drafts written for it keep their text.
• Sign-in sessions end after at most seven days, or after two days without use.
• The activity log is kept for one year. Rate-limit counters are kept for one day.
• Content and media stay until a person deletes them in the studio.
• Meta (Instagram, Facebook, Threads) deletion requests are handled automatically. See Data deletion.

Security

All traffic uses HTTPS. Platform tokens are encrypted at rest. Media is stored privately and shared with platforms only through links that expire. Access requires a Google sign-in from an invited account, and every action that reads or changes data checks that sign-in on the server.

Contact

Questions or requests about this policy: leon.taira@studio-taira.com.