Viral Garden Privacy Policy

We collect the information needed to provide our service:

• Your email address
• If you sign in with Google, the basic profile Google shares with us: your user ID, name and profile picture
• If you sign up with an email address, a password held by our authentication provider. We never store or see it in plain text.
• What you create: projects, brand details, posts, uploaded images, templates and chat messages
• Details of the accounts you connect, as described in sections 3, 6 and 7
• Billing, which runs through Stripe: we store your plan and Stripe customer ID, never card numbers

We use your information only to:

• Provide the service and tie what you create to your account
• Generate text and images with AI providers from your prompts and images
• Publish to TikTok, YouTube and Instagram, only when you publish a post or schedule one (with an automation or Schedule Post)
• Bill you for your plan
• Send you email about the service

When you connect a TikTok account, we read its display name, avatar, username and account ID; its follower and like counts; and the list and metrics of videos posted through Viral Garden, which power the Analytics page. We use this access to show which account is connected, to publish the posts you publish or schedule, and for Analytics. We do not:

• Like, follow, or view videos on your behalf
• Edit or delete existing videos
• Post anything without your explicit permission

Removing a TikTok account in Viral Garden deletes its stored access tokens. The record of posts published through it is kept in your post history.

Viral Garden uses Google Authentication to provide its functionality. By using our service, you agree to the following:

• By signing into Viral Garden with Google, you are subject to Google's Privacy Policy.
• Signing in with Google grants us your email address and basic profile (name and picture) only. It does not grant access to any other Google service.
• Access to YouTube is separate and optional. It is requested in its own consent screen, only if you choose to connect a channel, and is described in section 6 below.

Data Deletion and Revoking Access

You can revoke Viral Garden's access to your data at any time through the Google security settings page. If you request to remove your authentication, we will promptly delete all associated tokens and data.

When publishing to TikTok we ask you to choose the caption, who can view the post, comment/duet/stitch settings and any commercial-content disclosure.

Viral Garden uses YouTube API Services to publish videos to a channel you connect. Connecting a channel is optional. We upload a video only when you publish it, or when an automation you set up publishes it on the schedule you chose.

By using this feature you agree to the YouTube Terms of Service. Google's handling of your information is governed by the Google Privacy Policy.

What we access

We request only the permissions needed to upload on your behalf and to show you which channel is connected:

• Uploading videos you create in Viral Garden to your channel
• Reading your channel's name, ID and avatar, so you can confirm the right channel is connected
• Reading back the status of a video we uploaded, so we can show you whether it published

We do not:

• Read your watch history, subscriptions or private data
• Like, comment, subscribe or view videos on your behalf
• Edit or delete videos that Viral Garden did not upload
• Upload anything you did not publish yourself or schedule with an automation you set up
• Sell, share or transfer YouTube data to third parties

What we store

We store your channel ID, channel name and avatar URL, and an encrypted copy of the access and refresh tokens Google issues. Tokens are encrypted at rest and are never exposed to your browser or to any other user. We also keep a record of each video we uploaded for you, including its title, description, channel, YouTube video ID, and the visibility and upload status returned at that time.

How long we keep YouTube data

We check connected channels daily to confirm that Google still authorizes our access and to refresh the stored channel name and avatar. We delete local YouTube upload records after 29 days. These records describe the upload at the time it happened; manage the video's current settings in YouTube.

Encrypted tokens are used only to maintain your connection and carry out uploads you publish or schedule. If you have not connected or attempted a YouTube upload for 29 days, our daily cleanup removes the connection and its stored data. You can reconnect when you next want to publish.

The TikTok analytics page uses TikTok data. Its publication-date filters and engagement calculations do not use YouTube data. We do not collect YouTube analytics or calculate YouTube engagement scores.

Revoking access and deleting data

You can disconnect a channel from within Viral Garden at any time: choose Remove in the channel's ⋮ menu on your project's Accounts tab, or Disconnect in the Publish to YouTube dialog. A successful disconnect revokes our tokens with Google, deletes the channel information and associated YouTube upload records from our database, and pauses any automation that posted to the channel. If Google is temporarily unavailable, publishing through that connection is disabled and cleanup is retried daily. Local deletion is completed within seven calendar days of your request. You can also revoke access directly from the Google security settings page. Our daily checks detect revoked access and delete its stored tokens and associated YouTube data. You can also request deletion by emailing support@viral.garden; we fulfill deletion requests within seven calendar days. Deleting your Viral Garden account removes the stored tokens and upload records. Videos already published to your channel remain on YouTube. To delete those videos, use YouTube itself.

Connecting an Instagram account is optional and needs an Instagram Business or Creator account. We publish only when you publish a post, or when an automation or scheduled post you set up publishes it.

By using this feature you agree to the Instagram Terms of Use. Meta's handling of your information is governed by the Meta Privacy Policy.

What we access

We request two permissions:

• instagram_business_basic: the account ID, username, name and profile picture, to show which account is connected and to check the connection. The account type is checked at connection, to confirm the account is professional, and is not stored.
• instagram_business_content_publish: to publish the photo and carousel posts you create.

We do not:

• Read your messages, comments, insights, followers or your other posts
• Like, comment or follow on your behalf
• Edit or delete posts
• Publish anything you did not publish or schedule
• Sell Instagram data, or share it with anyone other than the service providers in section 8

What we store

We store the Instagram account ID and app-scoped ID, username, name, profile picture URL, and an encrypted long-lived access token with its expiry. We never see or store your Instagram password.

To publish, slide images are placed at a temporary web address for Instagram to download, and are deleted automatically within a few hours.

The access token is renewed about once a month, and the username and profile picture are refreshed daily. If Instagram stops accepting the token, we stop using it and pause the automations that post to the account.

Revoking access and deleting data

Removing an Instagram account in Viral Garden deletes its Instagram access token and account details from Viral Garden right away. Posts already on Instagram stay there. To also remove Viral Garden's access on Instagram's side, open Instagram's settings, then Apps and websites, and remove Viral Garden.

When you remove Viral Garden on Instagram, Instagram tells us, and we delete the token and account details immediately.

Your Instagram username can still appear in posts made for the account and in your past chat messages until you delete them.

We never sell your data. We share it only with the providers that run the service:

• Supabase, for our database, file storage and sign-in
• Vercel, for hosting
• Stripe, for payments
• Resend, for email
• The AI providers Google (Gemini), xAI, fal.ai and Replicate, to generate text and images from your prompts and images
• ScrapeCreators, to fetch public TikTok and Instagram posts you ask us to import

We also share content with the platforms you publish to, and information where the law requires it.

Your data is stored with Supabase. Access tokens for connected accounts are encrypted at rest, with a separate key for each platform. Our database is backed up daily, and backups are kept for 7 days.

We use strictly necessary cookies and your browser's local storage to keep you signed in and to remember your preferences in the app. We do not use advertising cookies, third-party tracking cookies, or analytics that follow you across other sites.

• Remove a connected account on your project's Accounts tab: choose Remove in its ⋮ menu. What that deletes for TikTok, YouTube and Instagram is described in sections 3, 6 and 7.
• Removing Viral Garden on Instagram deletes its data immediately, so it is already gone when Instagram shows you a confirmation code. Email support@viral.garden with any question.
• To delete your Viral Garden account or any of your data, email support@viral.garden. We fulfill requests within seven calendar days.
• Deleted data rolls off our backups within 7 days.

You can ask us to access, correct, export or delete your data by emailing support@viral.garden. See Deleting Your Data for how deletion works.

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page.

If you have any questions about this Privacy Policy, please contact us at:

Email: support@viral.garden