Privacy

Privacy Policy

This policy explains what personal information ViewTracker collects, including information from TikTok, Instagram, YouTube and Facebook accounts you connect to publish videos, how we use and protect it, and the choices you have.

Last updated 2026-10-18

Draft pending legal review

This text describes how ViewTracker works today but has not yet been reviewed by legal counsel. Items in [brackets] are still to be filled in.

1. Who we are

ViewTracker (viewtracker.ai) is operated by [Legal entity name], [Registered address] (“ViewTracker”, “we”, “us”). This policy covers the ViewTracker website, web application, API and mobile app (together, the “Service”).

Questions about this policy or your data: hello@viewtracker.ai.

2. Information we collect

Your account. Your name, email address and password. Passwords are stored only as a salted hash. If you choose “Continue with Google”, Google shares your name, email address and profile picture with us. We also store which workspaces you belong to, your role in each and invitations you send or receive.
Billing. Payments are processed by Stripe. Card details are entered on Stripe's pages and never reach us. Stripe shares with us your plan, subscription status, invoices, billing address, VAT or tax ID and the country of your payment card, which we use to apply regional prices.
What your team adds. Links to the videos and profiles you track, creator profiles (name, optional email address and notes), campaigns, spend and payout records, report branding, alerts and the Slack, Discord, Telegram or webhook destinations you configure, API keys (stored only as a hash) and saved views.
Public data from social platforms. For each video you track: its link, caption, thumbnail link, length, the author's handle and display name, its publish time and its public view, like, comment, share and save counts over time. For tracked profiles: public profile statistics over time. We do not collect comment text, private messages or anything that is only visible after logging in.
Accounts you connect for publishing. When an owner or admin connects a TikTok, Instagram, YouTube or Facebook account (see section 3), we store the platform's account ID, username or handle, display name, profile picture link and profile link, the access and refresh tokens the platform issues with their expiry times, and the permissions granted. We also store the videos you upload to publish, their captions and titles, the schedule and post settings you choose (for example TikTok privacy and content disclosure settings) and the outcome of each post (its ID, link, status and any error message from the platform).
Usage and device data. Our hosting providers record technical logs such as IP address, browser type and the pages requested, for security and troubleshooting. We measure visits to our website with Know (know.am) without analytics cookies.
Messages to us. When you email us, we keep the conversation so we can help you.

3. Connected accounts and publishing

The Publish section lets a workspace upload a video once and post it to TikTok, Instagram, YouTube and Facebook Pages, now or on a schedule. Accounts are connected through each platform's own sign-in and consent screen (OAuth). You never give us your social media password. We request only the permissions below and use them only for the purpose listed:

TikTok (user.info.basic, user.info.profile, video.upload, video.publish): to show which account is connected (name, username, profile picture), to read the posting options TikTok allows for that account, and to send a video to your TikTok drafts or post it with the settings you chose.
Instagram (instagram_business_basic, instagram_business_content_publish): to show which professional account is connected and to publish the Reels you create in ViewTracker.
Facebook (pages_show_list, pages_read_engagement, pages_manage_posts): to list the Pages you manage so you can choose which to connect, read the Page's name and picture, and publish Reels to the Pages you connected.
YouTube (youtube.upload, youtube.readonly): to show which channel is connected (name, handle, picture) and to upload the videos you publish from ViewTracker to that channel.
Access and refresh tokens are encrypted with AES-256-GCM before they are stored. They are used only to publish the posts your workspace creates or schedules, to check their status and to refresh the connection. We do not use them to read your messages, followers or analytics, to post anything you did not schedule, or for advertising.
Videos you upload are stored privately in Cloudflare R2. To publish to Instagram and Facebook, we give Meta a signed link that expires after a few hours so it can fetch the file; TikTok and YouTube receive the file directly from us. Each file is deleted seven days after every post that uses it has finished. Files that were uploaded but never posted are deleted automatically after 90 days.
When a post is published, the video, caption and settings you chose are sent to that platform and are then governed by the platform's own terms and privacy policy. If tracking is switched on for the post, its public link is added to your tracked videos and its public metrics are collected like any other tracked video.
We do not sell data received from these platforms, use it for advertising, use it to train AI models, or share it with anyone except the service providers listed in section 6 that we need to run the Service.
You can disconnect an account at any time in Publish → Accounts. This deletes its stored tokens and profile details at once and cancels its scheduled posts. ViewTracker also asks TikTok, Google or Facebook to revoke its access, unless another connected account still uses the same login (for example another Facebook Page you shared through it). Instagram does not let apps do this. You can always revoke ViewTracker's access in each platform's own settings; see Data deletion for the steps.
Google and YouTube. ViewTracker uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data. You can revoke ViewTracker's access at any time on Google's security settings page. ViewTracker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

To provide the Service: collect public metrics for the videos and profiles you track, build dashboards, reports and alerts, and publish the posts you create.
To run your account and workspaces, process payments and send invoices.
To send service emails, such as email verification, password resets, invitations, alerts you set up and important changes to the Service.
To keep the Service secure, prevent abuse and fraud, and enforce our Terms of Service.
To answer support requests and to understand, in aggregate, how the Service is used so we can improve it.
To meet legal, tax and accounting obligations.
We do not sell personal information and we do not show ads.

5. Legal bases (EEA and UK)

Contract: to provide the Service you signed up for, including publishing the posts you schedule and billing.
Legitimate interests: to collect publicly available metrics our customers ask us to track, to secure the Service and to improve it. We weigh these interests against your rights and collect only public data.
Consent: where the law requires it, for example when you connect a social account. You can withdraw consent at any time by disconnecting the account.
Legal obligation: to keep billing records and respond to lawful requests.

7. International transfers

Our providers may process data in the United States, the European Union and other countries. Cloudflare chooses the data center; no EU-only jurisdiction is set today. Where the law requires it, transfers rely on [transfer safeguards, such as the EU Standard Contractual Clauses, to be confirmed with counsel].

8. How long we keep data

Account and workspace data is kept while the account or workspace exists.
A tracked video or profile and its metric history are kept until you delete it or delete the workspace.
Tokens for connected accounts are kept until you disconnect the account or delete the workspace.
Videos uploaded for publishing are deleted seven days after every post that uses them has finished, or after 90 days if they were never posted. The post's caption, status and link stay in the workspace's publishing history until the workspace is deleted.
Billing records are kept as long as tax and accounting law requires. Records of our own staff actions are kept for audit purposes without the link to a deleted workspace.
Database recovery points expire within 30 days, so deleted data leaves our backups within 30 days.

9. Security

Data is encrypted in transit. Tokens for connected accounts and Google Sheets are encrypted with AES-256-GCM, passwords and API keys are stored only as hashes, workspaces have owner, admin, member and viewer roles, and staff access to a workspace is read-only, time-limited and logged. See Security and GDPR for details. No method of transmission or storage is completely secure, but we work to protect your data and will notify you of a breach where the law requires.

10. Your rights and choices

Depending on where you live, you can ask to access, correct, export, delete or restrict the use of your personal information, object to its processing, or withdraw consent you gave.
You can export your data as CSV, disconnect publishing accounts, and (as an owner) delete a workspace yourself. For anything else, write to hello@viewtracker.ai from your account email. We respond within 30 days. The Data deletion page explains every way to remove your data.
If you are in the EEA or UK, you can also complain to your local data protection authority.
California residents: we do not sell or share personal information for cross-context behavioral advertising, and we will not treat you differently for exercising your privacy rights.

11. Data our customers control

For the data a workspace adds, such as creator names and emails, notes and spend, and the public data collected on its behalf, the customer is the controller and ViewTracker processes it on the customer's instructions. A data processing agreement (DPA) is available on request. If you are a creator whose public videos a customer tracks and you do not have a ViewTracker account, you can write to hello@viewtracker.ai with the links concerned. We will remove them or pass your request to the workspace that added them.

12. Cookies and similar technologies

We use cookies that are needed for the Service to work: to keep you signed in and your session secure, and to remember settings such as the sidebar state. Your theme choice is stored in your browser. We do not use advertising cookies, and our website analytics work without analytics cookies.

13. Children

The Service is meant for businesses and people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We will update the date at the top of this page when we change this policy. If a change is material, we will tell account owners by email or in the app before it takes effect.

15. Contact

[Legal entity name], [Registered address]. Email: hello@viewtracker.ai. [EU or UK representative, if required]