Privacy Policy

Genreach is a software-as-a-service tool that lets creators generate images, videos, scripts, and captions using AI, and — at the creator’s explicit request — publish that content to their own connected social media accounts.

We collect only what we need to run the Service:

• Account data — your email address and a securely hashed password. We never store your password in plain text.
• Content you create — the prompts you submit and the images, videos, scripts, and captions generated from them.
• Connected social accounts — when you connect a TikTok or YouTube account, we receive and store OAuth access and refresh tokens, plus basic public account info (such as your display name / channel handle and ID). See section 4 for details.
• Billing data — if you purchase credits or a subscription, payments are processed by Stripe. We do not see or store your full card number; we keep a customer/subscription reference and your credit balance.
• Usage & technical data — job history, credit transactions, and standard server logs (IP address, request identifiers, timestamps) used for security, debugging, and abuse prevention.

• To provide the Service: generate content and run the jobs you request.
• To publish content to your connected social accounts — only when you explicitly choose to publish a specific piece of content.
• To manage your account, credits, and billing.
• To secure the Service, prevent abuse, and comply with legal obligations.
• To notify you about your jobs (e.g. completion) and important account matters.

We do not sell your personal data, and we do not use your content or connected-account data for advertising.

Connecting a social account is entirely optional and is initiated by you via the platform’s standard OAuth consent screen. When you connect an account:

• Scopes we request. For TikTok: user.info.basic (to show which account is connected) and video.publish (to upload videos you choose to publish). For YouTube: youtube.upload (to upload videos) and youtube.readonly (to read basic channel info).
• What we do with access. We use the granted access solely to publish the specific videos you explicitly choose to publish from your Genreach library. We never post, modify, or delete content on your behalf without a deliberate action by you.
• How tokens are stored. OAuth tokens are encrypted at rest and used only to perform the actions above.
• Revoking access. You can disconnect a social account at any time from your Genreach account, which deletes the stored tokens. You may also revoke access directly in your TikTok or Google account security settings.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We share data with a small set of processors strictly to operate the Service:

• Cloudflare R2 / CDN — stores and serves your generated media files.
• AI generation providers (e.g. OpenRouter, Google Gemini) — receive your prompts to generate content.
• Stripe — processes payments.
• TikTok / YouTube — receive the videos you choose to publish, via their official APIs.
• Email delivery — sends transactional emails (account and job notifications).

We keep your account data and generated content for as long as your account is active. Server logs are retained for a limited period for security and debugging. When you delete your account, we delete or anonymize your personal data and connected-account tokens, and remove your generated media, except where we must retain certain records to comply with legal or accounting obligations.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. You can disconnect social accounts and delete your account from within the Service, or contact us at [email protected] to exercise any of these rights.

We protect your data with encryption in transit (TLS), encryption at rest for sensitive credentials such as social OAuth tokens, hashed passwords, scoped access controls, and rate limiting. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard practices.

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards for such transfers.

The Service is not directed to children. You must be at least the age of majority in your jurisdiction (and at least 13) to use it. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notifying you.

Questions about this policy or your data? Email [email protected] or [email protected].