Privacy Policy

1. Introduction

Welcome to CatCaster (“we,” “our,” or “us”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy or our practices with regards to your personal information, please contact us.

When you visit our website and use our services, you trust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our privacy policy. We seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it.

2. Information We Collect

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when registering at the Services, expressing an interest in obtaining information about us or our products and services, when participating in activities on the Services, or otherwise contacting us.

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect can include the following:

• Credentials: We collect passwords, password hints, and similar security information used for authentication and account access.
• Mobile number: If you turn on text message codes, we collect the mobile number you enter so we can text you a one-time sign-in code.
• Social Media Login Data: We provide you with the option to register using social media account details, like your Facebook, Twitter, or other social media account.
• Connected social accounts: When you connect a platform (including TikTok and YouTube), we store OAuth tokens and account identifiers needed to publish on your behalf, along with profile information returned by that platform (such as display name, username, and avatar).

3. How We Use Your Information

We use personal information collected via our Services for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations.

• To facilitate account creation and logon process: If you choose to link your account with us to a third-party account (such as your Google or Facebook account), we use the information you allowed us to collect from those third parties to facilitate account creation and logon process.
• To send administrative information to you: We may use your personal information to send you product, service, and new feature information and/or information about changes to our terms, conditions, and policies.
• To manage user accounts: We may use your information for the purposes of managing our account and keeping it in working order.
• To send sign-in codes: When you request a code, or sign in with text message codes turned on, we text a one-time passcode to the mobile number you provided.
• To publish to connected social platforms: When you choose to post or schedule content, we use your connected account credentials and the publishing settings you select (such as caption, visibility, and interaction options) to send content to that platform's APIs on your behalf.

4. Automated Processing and Artificial Intelligence

CatCaster uses automated systems and artificial intelligence to help you create, repurpose, and manage social content. Depending on the features you use, this may include generating or adapting posts for connected platforms, analyzing brand voice and Brand Memory, processing items in your Knowledge base, suggesting content ideas, assisting compose and editorial workflows, and supporting inbox and comment-related features.

To provide these features, content you upload or connect to your workspace—such as drafts, captions, documents, brand materials, media metadata, and (where you enable those features) comments or other platform data imported into CatCaster—may be sent to third-party AI providers to produce outputs for your workspace only.

CatCaster is configured to use OpenAI and Google (Vertex AI and Gemini models via our server-side integrations). Which provider handles a given request depends on your workspace or deployment settings and the AI_PROVIDER environment configuration when set. We do not route your workspace content to AI providers you have not connected through these integrations.

Training and shared models. As a product commitment, we do not use your workspace content to train shared or public foundation models for CatCaster or for our AI vendors' general-purpose models. Your Brand Memory, Knowledge base, and uploads are used to serve your workspace—not to build a cross-customer training dataset. Provider terms may still apply to how they process requests; we configure commercial API access intended for customer data processing rather than model-training programs.

5. Service Providers and Subprocessors

We share personal information and workspace content with service providers only as needed to operate CatCaster, secure the service, and fulfill your instructions. We do not sell personal information. Categories and key providers include:

• Hosting and infrastructure: Vercel (application hosting and related edge services).
• Database and authentication: Supabase (database, authentication, and private object storage for workspace media).
• Artificial intelligence: OpenAI and Google Cloud Vertex AI / Gemini (content generation, analysis, embeddings, and related AI features).
• Payments and subscriptions: Stripe (web billing) and, for CatCaster iOS companion subscriptions, Apple (App Store in-app purchase and subscription management).
• Text message delivery: Twilio (delivery of one-time sign-in codes you request).
• Background jobs and scheduling: Upstash QStash (signed webhooks that trigger publishing, media processing, editorial, and other asynchronous jobs).
• Social platforms you connect: When you link an account or publish content, we exchange data with that platform's APIs—for example TikTok, Google/YouTube, Meta (Facebook and Instagram), LinkedIn, X (Twitter), Threads, Pinterest, and other networks supported in the product—solely to provide the connection, publishing, analytics, or inbox features you use.
• Optional editorial research: When enabled for your deployment, Apify may fetch public social posts you configure as editorial sources (server credentials only; not sold or used for advertising).

Each provider processes data under its own terms and privacy policies. We require or select providers appropriate for the processing purpose and limit sharing to what is reasonably necessary for that purpose.

6. TikTok

If you connect a TikTok account to CatCaster, we access TikTok only as you authorize through TikTok's login and the permissions you grant (including posting and profile-related scopes required for Direct Post and analytics).

Data we receive from TikTok may include your TikTok open identifier, username, display name, avatar URL, follower or profile statistics (when you grant the relevant scope), and current posting capabilities (such as allowed privacy levels and interaction settings) when you open the TikTok publishing experience.

Data we send to TikTok includes the video or image content you choose to publish, the caption or title you edit, and the TikTok-specific settings you confirm before posting (including privacy, comment/duet/stitch options, and commercial content disclosure choices, when applicable).

We store OAuth access and refresh tokens securely on our servers to maintain your connection and publish when you request it. We do not sell your TikTok data. TikTok's own privacy practices are described in TikTok's Privacy Policy.

You can disconnect TikTok at any time from your CatCaster channel settings, which stops future API access using stored tokens. Disconnecting does not delete content already published on TikTok.

7. Google and YouTube

CatCaster connects to YouTube using Google OAuth. This YouTube connection is separate from any Google sign-in you may use to create a CatCaster account. When you connect YouTube, we request only https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/youtube.upload.

Why we access this data. We use read access to identify the YouTube channel you selected, keep its name and avatar current, and show channel and video statistics in CatCaster. We use upload access to send videos you choose to publish or schedule to that channel. CatCaster does not read, post, edit, or delete YouTube comments, and does not edit or delete your existing videos.

Data we receive from YouTube may include your YouTube channel ID, channel title or name, thumbnail or avatar, channel and video statistics (such as subscriber, view, and video counts), and Google OAuth access and refresh tokens.

Data we send to YouTube includes the video file you choose to publish, plus the title, description, and privacy status you confirm. CatCaster uploads content only at the user's direction: when you publish immediately or when a scheduled post you created becomes due. We do not upload videos without that action.

What we store. While YouTube remains connected, we store your YouTube channel ID, display name, avatar URL, OAuth tokens, copies of the content and metadata you compose or schedule, and analytics snapshots needed to operate Channels, Compose, and Analytics.

AI processing of YouTube data. When you ask CatCaster's AI features about your workspace, for example asking the assistant to summarize your analytics, the YouTube data relevant to that request (channel name, video titles, and channel and video statistics) can be sent to OpenAI or to Google Cloud Vertex AI / Gemini to produce the answer for your workspace. We use these providers' commercial APIs, whose terms do not allow them to use that data to train their models. CatCaster does not use Google or YouTube user data to develop, improve, or train AI or machine-learning models.

How we protect YouTube data. Google OAuth access and refresh tokens are encrypted by CatCaster with AES-256-GCM before they are written to our database, using a key kept outside the database, and are decrypted only on our servers at the moment we call YouTube APIs on your behalf. The database itself is also encrypted at rest, all traffic uses TLS, and row-level access controls keep each workspace's channels and analytics visible only to members of that workspace. The encryption key never leaves our servers, so stored token values cannot be used anywhere else, and tokens are not exposed to other CatCaster workspaces.

Sharing and subprocessors. We do not sell Google or YouTube user data, we do not use it for advertising, and we do not transfer it to data brokers or other social platforms. We share it only with service providers that operate CatCaster for you: Vercel (hosting) and Supabase (database and storage), and, for the AI features described above, OpenAI and Google Cloud Vertex AI / Gemini. Video files and metadata you publish are sent to YouTube and Google as you directed.

How long we keep YouTube data.

• OAuth tokens: kept only while the channel is connected. The access token is replaced roughly every hour; both tokens are deleted as soon as you disconnect the channel or delete your account.
• Channel and video statistics: daily snapshots kept while the channel is connected to show trends in Analytics, and deleted when you disconnect the channel or delete your account.
• Channel profile: after you disconnect, CatCaster keeps only the channel ID, name, and avatar so your post history stays readable, until you remove the channel or delete your account.
• Posts you created: the videos, titles, and descriptions you compose follow the media retention rules in section 10 and stay until you delete them or your account.
• Backups: deleted data can remain in encrypted database backups until those backups expire, no later than 30 days after deletion.

CatCaster's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube's and Google's own practices are described in the YouTube Terms of Service and the Google Privacy Policy.

How to disconnect YouTube. Open Channels in CatCaster and disconnect the YouTube channel. Disconnecting revokes CatCaster's Google grant, deletes stored YouTube tokens, and deletes that channel's analytics, as described above. Disconnecting does not delete videos already published on YouTube.

How to request deletion. Disconnect YouTube as described above, delete your CatCaster account from account settings, or email us at privacy@catcaster.com. We will delete stored Google and YouTube data associated with that connection except where we must retain records to comply with law.

You can also revoke CatCaster's access at any time from your Google account connections. Revoking access in Google stops future API calls; disconnect in CatCaster if you also want stored tokens and channel data removed from CatCaster.

8. Will Your Information Be Shared With Anyone?

We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

We may process or share data based on the following legal basis:

• Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose.
• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.
• Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.

9. Account Deletion, Brand Memory, and Connected Channels

Deleting your CatCaster account. You can delete your account from Settings → Account in the CatCaster app (confirm with your account email) or by emailing privacy@catcaster.com. Deletion removes your authentication record, profile, workspaces you own, connected channels, posts, Brand Memory and Knowledge base content, uploaded documents, and related workspace data from active CatCaster systems, subject to the retention notes below. You must cancel active paid subscriptions (Stripe or Apple) before deletion when billing is still active; the app will prompt you if checkout or a non-cancelled subscription blocks deletion.

Brand Memory, Knowledge base, and uploads. You can delete individual knowledge items, editorial sources, and uploaded documents from your workspace at any time. Deletion removes them from active systems used to serve your workspace. Account deletion removes remaining workspace-owned knowledge and uploads as part of the cascade described above.

What we may retain. We may retain limited records where required by law, to resolve disputes, enforce our terms, or meet accounting and payment obligations (for example Stripe or Apple transaction records). Certain administrative audit logs may be retained after account deletion as described in our internal retention practices.

Disconnecting social channels. You can disconnect any connected platform from your channel settings at any time. Disconnecting stops future API access using stored tokens and removes that channel's connection data from CatCaster (including OAuth tokens and channel-specific data we store to operate the connection), consistent with the platform-specific sections above. Disconnecting does not delete content already published on that social network.

10. Media Data Retention and Storage

Workspace media (images, graphics, and video uploads) is stored in private Supabase storage buckets protected by access controls—not in publicly listable buckets. You can delete posts and associated media from your workspace; automated retention schedules also apply to full-resolution source files:

• Automated Retention Schedules: Full-resolution source media files are retained for thirty (30) days for Free workspaces and sixty (60) days (or up to 365 days when cold archival is enabled) for paid workspaces. Following expiration, original files are permanently deleted from primary storage.
• Metadata & History: High-level post metadata, copy text, engagement metrics, and lightweight preview thumbnails are retained to maintain your workspace historical log until you explicitly delete the post or close your account.
• Security & Archival: Where long-term archival is utilized, archived media is encrypted at rest and in transit. Access is strictly scoped to authenticated workspace members.

11. Text Messages

Altronica LLC operates CatCaster. If you add a mobile number in CatCaster account security settings and agree to receive texts, Altronica LLC sends one-time sign-in codes to that number for the CatCaster app. You opt in on the form at catcaster.com/sms (the same form shown in Settings after you sign in) by entering your mobile number, checking the sign-in codes box, and choosing “Yes, text me a code.” That box is not pre-checked. We send a code only after you submit the form. We do not send marketing texts.

Message frequency varies with how often you sign in or request a code. Message and data rates may apply. Reply STOP to opt out and HELP for help, or remove the number in settings. Consent to receive these messages is not a condition of purchase.

We use Twilio to deliver these texts. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.