Privacy Policy

This policy explains what personal data ReelNaut (reelnaut.com) collects, why, how long we keep it and how you control it. This website is operated by Goga Chokoraia. The data controller is Individual Entrepreneur Goga Chokoraia, operating ReelNaut as a registered business in Tbilisi, Georgia, reachable at support@reelnaut.com.

1. What we collect and why

• Account: name, email address and profile picture from your sign-in provider (Google or email link). Used to create and secure your account and to contact you about it. Legal basis: contract.
• Free video without an account: the niche, topic and language you choose, and the email address you type on the form. We use the address only to send you the link to that one video (or to tell you it could not be made) and to keep it to one free video per person; nothing is sent to it afterwards unless you create an account. Unclaimed free videos and their address are deleted after 30 days. Legal basis: your request (contract).
• Your series and videos: the topic, style, voice, schedule and custom instructions you enter, and the scripts, images and videos generated from them. Used to provide the Service. Legal basis: contract.
• Connected channels: the channel id, name and avatar of accounts you connect, and the OAuth access/refresh tokens, stored encrypted. Used only to upload the videos you scheduled and to read the statistics of those videos. Legal basis: contract.
• Statistics: view, like and comment counts of videos we published, read through the platform APIs, shown in your dashboard. Legal basis: contract.
• Billing: plan, invoices and payment status from our payment partner, Flitt (TBC Bank JSC, Georgia). Card numbers, Apple Pay and Google Pay details are entered on Flitt's PCI DSS-certified checkout and never reach us; we store only the last four digits and a payment token. Legal basis: contract and legal obligation (accounting).
• Technical: server logs with IP address, browser type and timestamps, kept up to 30 days for security and troubleshooting. Legal basis: legitimate interest.
• Site analytics and ad measurement (only if you press "Accept" in the cookie bar): Microsoft Clarity records how our public pages are used (clicks, scrolling, anonymised session replays; typed text is masked; never inside your account or on the sign-in page), and the Meta Pixel and Meta Conversions API tell Meta when a visitor who came from one of our ads started a free video or a checkout, so our ads reach people likely to be interested. Meta receives your IP address, browser details and its own cookie identifiers, never your name, e-mail or content. The Google Ads tag does the same for visitors who came from one of our Google search ads: Google receives your IP address, browser details and its own cookie identifiers, never your name, e-mail or content. Legal basis: consent, which you can withdraw at any time (see section 5).

We do not sell personal data, and without your consent nothing is collected for advertising.

2. AI providers

To generate content we send only the text prompts, settings and narration text needed for generation to our AI providers: OpenAI (scripts, images, content safety check), ElevenLabs (narration) and fal.ai (motion clips). They receive no account details and no social tokens. Their processing is governed by their own terms; they do not use API data to train models.

3. Google and YouTube data (YouTube API Services)

ReelNaut uses YouTube API Services to post the videos you create to the YouTube channel you connect. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of your data is described in the Google Privacy Policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, collect and store

• Permissions you grant: youtube.upload (to upload videos to your channel) and youtube.readonly (to read your channel details and the statistics of the videos we uploaded). We request nothing else.
• Channel details: your channel id, channel title, handle and avatar image URL. We store them to show you which channel is connected. When you connect, the API also returns the subscriber count; we use it only on that screen and do not store it.
• Access tokens: the OAuth access token and refresh token Google issues for your channel, stored encrypted. Used only by our servers to upload your videos and read their statistics.
• Your uploads: the YouTube video id and link of every video we uploaded for you, and the title, description and tags we sent with it.
• Statistics: view, like and comment counts of the videos we uploaded, to show you how your series performs.
• We do not access your other videos, playlists, comments, messages, subscribers' identities or watch history.

How we use, process and share it

• We use this data only to upload the videos you created and scheduled in ReelNaut, to show you which channel they post to, and to show you the statistics of those videos inside your account.
• Internal sharing: only the operator of ReelNaut can access it, for support at your request or to keep the service secure.
• External sharing: it is stored and processed by our hosting, database and storage providers (Vercel, Supabase, Cloudflare), who act only on our behalf. It is never sent to our AI providers. We do not sell it, share it with advertisers or data brokers, use it for advertising, or use it to train AI models. We disclose it only if the law requires it.

Third parties, content and advertisements

ReelNaut does not show advertisements inside the app, and no third party serves content or ads in your account. On our public pages (not in your account or on the sign-in page), and only if you accept cookies, we allow third parties to place and read cookies or similar technologies in your browser: Microsoft Clarity (site analytics), and Meta (Meta Pixel) and Google (Google Ads tag), which measure our own advertising and may use the information to show our ads to you on their platforms. They never receive your YouTube data. Details and how to withdraw consent are in section 5.

How often we refresh or delete it

• Channel details (title, handle, avatar) are refreshed from the YouTube API every 7 days. If they cannot be refreshed for 30 days, we delete them.
• Video statistics are refreshed hourly for 30 days after a video is published; daily statistics older than 30 days are deleted.
• When you disconnect your channel in ReelNaut, its tokens are deleted immediately, and its channel details and video statistics are deleted within 7 days. If you revoke access in your Google account permissions instead, the same data is deleted within 7 days of us noticing the revoked access (at the latest within 30 days).
• When you delete your account, all of this is deleted within 30 days.

You can revoke ReelNaut's access at any time from the Channels page or at myaccount.google.com/permissions. Questions about your YouTube data: support@reelnaut.com.

4. TikTok, Instagram and Facebook data

Connecting TikTok, Instagram or a Facebook Page works the same way: we store the account or Page id, display name and avatar plus encrypted tokens, upload only the videos you scheduled, and read only the statistics of those uploads. We never read your messages, friends, followers or other content. Disconnecting a channel deletes its tokens immediately; deleting your account removes every channel and token, and you can also revoke access at any time from the platform's own settings (Facebook: Settings → Business integrations; Instagram: Settings → Apps and websites). To request deletion of Meta-related data separately, email support@reelnaut.com and we will confirm within 7 days.

5. Cookies

Without your consent we set only strictly necessary cookies: the sign-in session cookie (so you stay logged in), a CSRF-protection cookie during sign-in and channel connection, and a cookie remembering your answer in the cookie bar. These are required for the site to work and do not need consent under the ePrivacy Directive and GDPR. Only if you press "Accept" do we load Microsoft Clarity (cookies _clck, _clsk; analytics, up to 1 year; Microsoft privacy statement) and the Meta Pixel (cookies _fbp, _fbc; ad measurement, up to 90 days; Meta privacy policy) and the Google Ads tag (cookies _gcl_au, _gcl_aw; ad measurement, up to 90 days; Google privacy policy). To change your answer at any time, use "Cookie settings" at the bottom of every page and the bar asks again. We keep anonymous, aggregated usage statistics (page visited, country, device type, referring site) to understand how the service is used; these are collected without cookies and IP addresses are stored only as a one-way hash. For security we log requests that look like attacks (scanners, floods, blocked networks) together with the IP address for up to 90 days. Our payment partner sets its own cookies on its checkout pages under its own privacy policy.

6. Storage, security and retention

• Data is hosted in the EU (Frankfurt) on Vercel, Supabase and Cloudflare. Generated videos and images are stored on Cloudflare R2 and served through public links so that platforms can fetch them.
• Tokens are encrypted at rest; all traffic uses HTTPS; access is limited to the operator.
• Account data is kept while your account exists. Delete a video and its files are removed; delete your account from Settings and all data, including channel tokens, is removed within 30 days. Invoices are kept as long as accounting law requires.

7. Sharing and international transfers

We share data only with the processors needed to run the Service (hosting, database, storage, email delivery, AI generation, payment processing by Flitt / TBC Bank) under agreements that limit them to processing on our behalf, and with the social platforms you connect. Some processors are outside the EU; transfers rely on standard contractual clauses or equivalent safeguards.

8. Your rights

You can access, export, correct or delete your data from the app or by emailing us. If you are in the EU/EEA or UK you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. We answer requests within 30 days.

8a. Deleting your data

You can delete everything we hold about you at any time, without contacting us:

1. Sign in and open Settings → Delete account. Confirm the deletion.
2. Your series, videos, generated files, connected channels and their access tokens (YouTube, TikTok, Instagram, Facebook) are removed within 30 days. Invoices are kept only as long as accounting law requires.
3. To disconnect a single platform instead, open Channels and choose Disconnect: the stored token for that platform is deleted immediately.

If you removed ReelNaut from your Facebook or Instagram account settings, or cannot sign in, email support@reelnaut.com with the email address of your ReelNaut account and we delete the data within 30 days and confirm by email.

9. Children

The Service is for adults (18+). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

10. Changes and contact

We will announce material changes to this policy in the app. Questions: support@reelnaut.com. See also our Terms of Service.