Privacy Policy

The publishing tool is single-operator. David Trinidad connects his own social accounts to it in order to review and publish his own content — it is not a multi-tenant service, it does not offer sign-up to the public, and it does not collect information about people who merely view or interact with the resulting posts.

When the account owner explicitly connects a platform through that platform's own OAuth authorization screen, we receive and store the following — and nothing more:

• YouTube: OAuth access token, OAuth refresh token, the connected channel ID, and the channel's display name.

We never receive the account's password. We do not read direct messages, contacts, followers, or any content the account owner has not explicitly selected to publish.

This information is used for exactly one purpose: to publish a specific piece of content that the account owner has explicitly reviewed and confirmed, one item at a time, to that connected account. It is never used to auto-post, schedule content without confirmation, or take any action the account owner has not directly approved.

Access and refresh tokens are encrypted at rest (AES-256-GCM) before they ever touch the database. They are never returned in an API response, never logged, and never placed in a URL. Every stored credential is scoped to a single owner — there is no path in the system for one account's connected credentials to be read, used, or exposed by anyone else.

We do not sell this information. We do not share it with third parties. We do not use it — or anything derived from it — for advertising, audience analysis, or profiling of any kind. It exists solely to fulfill the specific, confirmed publish action described above.

Connection data is stored, encrypted, until the account owner asks for it to be deleted (see Data deletion requests). Revoking access on the platform (see below) makes the stored token stop working right away; the encrypted record itself is removed when deletion is requested.

Revoking access takes two steps, and both should be done for a complete revoke:

• Remove the connection from the platform's own app-permission settings — for YouTube, under your Google Account → Security → Your connections to third-party apps & services. The stored token stops working the moment access is removed there.
• Email info@davidtrinidad.com to have the stored credential deleted.

To request deletion of any stored connection data, contact info@davidtrinidad.com. Requests are honored promptly.

This service is not directed at children under 13, and we do not knowingly collect information from them. This policy may be updated from time to time; the date at the top always reflects the latest revision.