Privacy Policy

Genreach is a software-as-a-service tool that lets creators generate images, videos, scripts, and captions using AI, and — at the creator’s explicit request — publish that content to their own connected social media accounts.

We collect only what we need to run the Service:

• Account data — your email address and a securely hashed password. We never store your password in plain text.
• Content you create — the prompts you submit and the images, videos, scripts, and captions generated from them.
• Photos you upload for likeness features — some tools (e.g. AI Dance, Dream Journey, Talking Photo) let you upload a photo of yourself with your explicit consent. The uploaded photo is processed in memory to create your video and is not stored after the job finishes — only the finished video you created is kept, under the same retention rules as your other content. We never use your photo to train models, and we never claim any rights to your likeness.
• Connected social accounts — when you connect a TikTok or YouTube account, we receive and store OAuth access and refresh tokens, plus basic public account info (such as your display name / channel handle and ID). See section 4 for details.
• Billing data — if you purchase credits or a subscription, payments are processed by Stripe. We do not see or store your full card number; we keep a customer/subscription reference and your credit balance.
• Usage & technical data — job history, credit transactions, and standard server logs (IP address, request identifiers, timestamps) used for security, debugging, and abuse prevention.

• To provide the Service: generate content and run the jobs you request.
• To publish content to your connected social accounts — only when you explicitly choose to publish a specific piece of content.
• To manage your account, credits, and billing.
• To secure the Service, prevent abuse, and comply with legal obligations.
• To notify you about your jobs (e.g. completion) and important account matters.

We do not sell your personal data, and we do not use your content or connected-account data for advertising.

Connecting a social account is entirely optional and is initiated by you via the platform’s standard OAuth consent screen. When you connect an account:

• Scopes we request. For TikTok: user.info.basic (to show which account is connected) and video.publish (to upload videos you choose to publish). For YouTube: youtube.upload (to upload videos) and youtube.readonly (to read basic channel info).
• What we do with access. We use the granted access solely to publish the specific videos you explicitly choose to publish from your Genreach library. We never post, modify, or delete content on your behalf without a deliberate action by you.
• How tokens are stored. OAuth tokens are encrypted at rest and used only to perform the actions above.
• Revoking access. You can disconnect a social account at any time from your Genreach account, which deletes the stored tokens. You may also revoke access directly in your TikTok or Google account security settings.

Sharing, transfer, and disclosure of Google user data. “Google user data” means the data we receive through Google APIs when you connect a YouTube account — your basic channel info (channel name, handle, and ID) and the videos you choose to upload. We share, transfer, or disclose this data only as follows, and for no other purpose:

• YouTube / Google — we transfer the specific video and its metadata back to YouTube via the official YouTube Data API, solely to complete the upload you explicitly requested.
• Cloudflare R2 / CDN — our storage and content delivery provider, which holds the video file until you publish it and serves it within the Service.
• Cloud hosting & infrastructure — the servers and managed database that run Genreach store your connected-account tokens (encrypted) and channel info so the Service can operate.
• Legal & safety — we may disclose data if required by law, regulation, legal process, or to protect the rights, safety, or property of our users or the public.
• Business transfer — if Genreach is involved in a merger, acquisition, or sale of assets, data may be transferred subject to this Policy, and we will notify you of any change in how your data is handled.

We do not sell Google user data, transfer or disclose it to data brokers or advertisers, use it for advertising, or use it to train generalized AI/ML models. Humans do not read your Google user data except where you give explicit consent, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymized.

Genreach’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We share data with a small set of processors strictly to operate the Service:

• Cloudflare R2 / CDN — stores and serves your generated media files.
• AI generation providers (e.g. OpenRouter, Google Gemini) — receive your prompts to generate content.
• Stripe — processes payments.
• TikTok / YouTube — receive the videos you choose to publish, via their official APIs.
• Email delivery — sends transactional emails (account and job notifications).

We keep your account data for as long as your account is active. Server logs are retained for a limited period for security and debugging.

Generated media. On the free plan, the media you generate (images, videos, audio) is kept for 30 days, then automatically removed to keep free storage tidy — we email you a reminder before this happens so you can download it or upgrade. On a paid plan, your generated media is kept for as long as your subscription is active. Your job history and credit records are always preserved; only the downloadable media is removed when it expires.

When you delete your account, we delete or anonymize your personal data and connected-account tokens, and remove your generated media, except where we must retain certain records to comply with legal or accounting obligations.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. You can disconnect social accounts and delete your account from within the Service, or contact us at [email protected] to exercise any of these rights.

We protect your data with encryption in transit (TLS), encryption at rest for sensitive credentials such as social OAuth tokens, hashed passwords, scoped access controls, and rate limiting. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard practices.

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards for such transfers.

The Service is not directed to children. You must be at least the age of majority in your jurisdiction (and at least 13) to use it. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notifying you.

Questions about this policy or your data? Email [email protected] or [email protected].