Privacy Policy
Last updated: October 22, 2026
1. Introduction
IndReelForge ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.
2. Information We Collect
2.1 Personal Information
When you register for an account, we may collect:
- Email address
- Name or username
- Payment information (processed securely through third-party payment processors)
- Social media account connection tokens (OAuth)
2.2 Usage Data
We automatically collect certain information when you use the Service:
- IP address and browser type
- Pages visited and time spent on pages
- API usage patterns and request logs
- Device information and operating system
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Process your uploads and distribute content to your connected platforms
- Process payments and manage your subscription
- Send you technical notices, updates, and support messages
- Monitor and analyze usage patterns to improve the Service
- Detect, prevent, and address technical issues and security threats
- Comply with legal obligations
4. Data Storage & Security
Files you upload (videos, photos, documents) are stored in a private Backblaze B2 storage bucket so we can publish them to your selected platforms, deliver scheduled posts at the scheduled time, and show them in your upload history. Stored files are never publicly accessible: they are served only through our authenticated proxy, which checks that the requester owns the file.
Uploaded files are retained, with no automatic expiry, until you delete the corresponding upload from your history, at which point the stored file is deleted from storage. Files from uploads rejected during submission (for example, a file too large for the selected platform) are deleted immediately. Temporary copies made on our servers while processing or publishing a file are deleted once that step completes. To request deletion of any content still stored for your account, contact privacy@indreelforge.com.
We implement industry-standard security measures including:
- TLS/SSL encryption for all data in transit
- AES-256 encryption for sensitive data at rest
- OAuth 2.0 for secure platform authentication
- Regular security audits and penetration testing
- SOC 2 Type II compliant infrastructure
5. Connected Platforms and What We Access
IndReelForge connects to 16 platforms using their official APIs. When you connect an account you authorize IndReelForge to act on that platform only in the ways listed below, and only to publish, schedule and manage the posts you create in IndReelForge. We do not read your private messages, followers or other content, and we do not use platform data for advertising or sell it. Each platform's own privacy policy governs how that platform handles your data.
| Platform | What we can do (scopes / credentials) | What we store |
|---|---|---|
| instagram_business_basic, instagram_business_content_publish — read your professional account's basic profile and publish posts, reels and carousels. | Access token, account id, username, profile picture | |
| YouTube | youtube.upload, youtube, youtube.readonly — upload videos, set their metadata/thumbnails/playlists and read your channel name and picture. | Access and refresh tokens, channel id, channel name, picture |
| pages_show_list, pages_manage_posts, pages_read_engagement, business_management — list the Pages you choose and publish to them. We never post to personal profiles. | User and Page access tokens, your user id, Page ids, names and pictures | |
| TikTok | user.info.basic, video.upload, video.publish — read your display name and avatar, and post videos and photos with the privacy setting you choose for each post. | Access and refresh tokens, open id, display name, avatar |
| X | tweet.read, tweet.write, users.read, media.write, offline.access — post and thread on your behalf, upload media, read your username. | Access and refresh tokens, user id, username, picture |
| openid, profile, email, w_member_social — read your name and picture and post on your behalf (company-page scopes w_organization_social and r_organization_admin only if enabled for our app). | Access token (and refresh token if LinkedIn issues one), member id, name, picture | |
| Threads | threads_basic, threads_content_publish, threads_manage_replies — read your profile, publish posts and post reply chains/first comments. | Access token, user id, username, picture |
| user_accounts:read, boards:read, boards:write, pins:read, pins:write — read your account and boards, create boards you ask for, and create pins. | Access and refresh tokens, user id, username, picture | |
| identity, submit — read your username and submit posts and comments. | Access and refresh tokens, user id, username, icon | |
| Bluesky | You sign in with an app password; we exchange it for a session and do not store the app password. | Session (access and refresh) tokens, DID, handle |
| Google Business Profile | business.manage — list your business locations and publish local posts. | Access and refresh tokens, Google account id, business name, picture |
| Discord | A channel webhook URL you create — we can only post messages to that channel. | Webhook URL |
| Telegram | A bot token from @BotFather and the channel/chat id — we post as that bot to that chat. | Bot token, chat id |
| Slack | An Incoming Webhook URL — we can only post messages to its channel. | Webhook URL |
| Mastodon | Your instance URL and an application access token (write:statuses, write:media) — post statuses with media. | Instance URL, access token |
| WordPress | Your site URL, username and an application password — create posts and upload media through the REST API. | Site URL, username, application password |
Tokens and credentials are encrypted at rest (AES-256-GCM) and are only decrypted on our servers to make the API calls you request. We also use third-party services for payment processing (Razorpay), file storage (Backblaze B2), email delivery, analytics and infrastructure hosting.
6. YouTube API Services and Google User Data
IndReelForge uses YouTube API Services to upload videos to your YouTube channel and to read your channel's name and picture. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
IndReelForge's use and transfer to any other app of information received from Google APIs (YouTube and Google Business Profile) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the posting features you use, we do not use it for advertising, we do not sell it, and no person reads it except where you ask us to for support, for security, or where the law requires.
You can revoke IndReelForge's access to your Google account at any time from the Google security settings page (or by disconnecting YouTube / Google Business Profile in IndReelForge). Once revoked, we can no longer access your channel, and the stored tokens stop working; disconnecting in IndReelForge also deletes them.
7. Data Deletion
7.1 How to delete your data
- Disconnect one platform: in the dashboard open Users (your profiles), click the connected platform and confirm Disconnect. The stored tokens or credentials, platform account id, username and picture for that connection are deleted immediately.
- Delete a profile: deleting a profile under Users deletes all of its platform connections immediately.
- Delete your account: go to Profile & Settings → Danger Zone → Delete account (cancel any active subscription first). Your sign-in is disabled at once, every session and API key is revoked, and all connected-platform tokens and credentials are deleted immediately. Uploaded files and the rest of your account data are erased within 30 days of your request, except records we must keep by law (for example invoices and tax records).
- By email: write to support@indreelforge.com from your account email and we will delete your data within 30 days and confirm when it is done.
- Individual uploads: deleting an upload from your history deletes its stored file from storage.
7.2 Removing IndReelForge from a platform
You can also revoke our access from the platform itself. When Meta notifies us that you removed IndReelForge from Facebook, Instagram or Threads, our deauthorization callback immediately marks the connection revoked and deletes its tokens; when you ask Meta to delete your data, our data-deletion callback deletes the whole connection record and returns a confirmation code you can quote to us. For Google (YouTube, Google Business Profile), TikTok, X, LinkedIn, Pinterest and Reddit, revoking access in that platform's app settings makes our stored tokens unusable at once; the connection is flagged for reconnection and its tokens are deleted when you disconnect it or delete your account. Bot tokens, webhook URLs and application passwords for Discord, Telegram, Slack, Mastodon and WordPress stop working as soon as you delete or regenerate them on that platform.
7.3 Deletion request status
If you received a confirmation code from a Meta data-deletion request, the data was deleted when the code was issued. To check on any deletion request, email support@indreelforge.com with your confirmation code or account email.
8. Data Sharing
We do not sell your personal data. We may share information only in the following circumstances:
- With your consent or at your direction
- With service providers who assist in operating our Service (under strict confidentiality agreements)
- To comply with legal obligations, court orders, or government requests
- To protect the rights, property, or safety of IndReelForge, our users, or the public
- In connection with a merger, acquisition, or sale of assets (with prior notice)
9. Your Rights (GDPR & CCPA)
Depending on your location, you may have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you
- Right to Rectification: Request correction of inaccurate personal data
- Right to Erasure: Request deletion of your personal data
- Right to Portability: Request transfer of your data in a machine-readable format
- Right to Object: Object to processing of your personal data
- Right to Restrict: Request restriction of processing of your personal data
To exercise any of these rights, please contact us at privacy@indreelforge.com. We will respond to your request within 30 days.
10. Cookies
We use essential cookies to maintain your session and preferences. We also use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings. For more information, see our cookie consent banner when you first visit our site.
11. Data Retention
We retain your account information for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. API logs are retained for 90 days for debugging and security purposes, after which they are automatically purged.
12. Children's Privacy
The Service is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.
14. Contact Us
If you have any questions about this Privacy Policy, please contact us at privacy@indreelforge.com