Privacy Policy

Information you provide

• Account information: email address, name, and password (hashed, never stored in plain text)
• Profile information: display name, bio, avatar URL (for your media kit)
• Payment information: handled entirely by Stripe — we never see or store your card details

Information from connected platforms

When you connect YouTube, Instagram, or TikTok, we receive and store:

• OAuth access tokens and refresh tokens (encrypted at rest)
• Public profile information (channel/account name, follower count)
• Analytics data: views, likes, comments, subscriber counts, engagement metrics
• Post and video metadata: titles, descriptions, thumbnails, publish dates
• Comment data: comment text, author names, timestamps (for comment inbox feature)

Automatically collected information

• Log data: IP address, browser type, pages visited, timestamps
• Session cookies for authentication (HttpOnly, Secure)
• Timezone, detected automatically to display your data in local time

• To provide, operate, and improve creatorbox.app
• To display your analytics data and power dashboard features
• To process payments and manage your subscription via Stripe
• To send transactional emails (account creation, password reset, subscription notices)
• To send product emails (weekly digests, sync failure alerts) — you can opt out
• To generate AI script suggestions via the Anthropic Claude API — the text you submit is sent to Anthropic
• To classify your synced comments by sentiment using the Anthropic Claude API — comment text is sent to Anthropic
• To generate AI analytics insights using the Anthropic Claude API — aggregated analytics data (platform stats, post titles, and metrics) is sent to Anthropic
• To detect and prevent fraud and abuse
• To comply with legal obligations

We do not sell your personal data. We do not use your data for advertising purposes.

We share data only with the following categories of third parties:

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Amazon Web Services (AWS SES) — email delivery. Emails you receive from us are routed through AWS.
• Anthropic — AI script generation. Text you submit for AI generation is sent to Anthropic's API. Subject to Anthropic's Privacy Policy.
• Google / YouTube — OAuth and data sync. Subject to Google's Privacy Policy.
• Meta / Instagram — OAuth and data sync. Subject to Meta's Privacy Policy.
• TikTok — OAuth and data sync. Subject to TikTok's Privacy Policy.
• Sentry — error monitoring and performance tracking. Error context and session replays (sampled) are sent to Sentry. Subject to Sentry's Privacy Policy.

We may disclose your information if required by law, court order, or to protect the rights and safety of our users or the public.

We retain your account data for as long as your account is active. When you delete your account, we permanently delete your live data immediately, including platform tokens, analytics data, saved scripts, and comments. Encrypted database backups may retain a copy of your data for up to 90 days before being automatically purged by our backup lifecycle policy. Billing records may be retained for up to 7 years as required by law.

We protect your data using industry-standard measures: HTTPS/TLS encryption in transit, encrypted storage for OAuth tokens, hashed passwords (bcrypt), and regular security reviews. No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate data via your account settings
• Deletion — delete your account and all associated data from Settings → Danger Zone
• Portability — request an export of your data
• Objection — object to certain processing activities

To exercise these rights, email us at [email protected]. We will respond within 30 days.

creatorbox.app uses the following cookies:

• Authentication session cookie — required for you to stay logged in (HttpOnly, Secure, SameSite=Lax)
• CSRF and OAuth state tokens — short-lived cookies used for form security and to protect the OAuth connection flow when linking YouTube, Instagram, or TikTok (HttpOnly, Secure, SameSite=Lax, expire within 10 minutes)

We do not use tracking, advertising, or analytics cookies. Third-party services (Stripe) may set their own cookies when you visit checkout pages.

creatorbox.app is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

creatorbox.app is operated from the United States. If you access the service from outside the US, your data may be transferred to and processed in the US. By using creatorbox.app, you consent to this transfer.

For users in the European Economic Area (EEA), our legal basis for processing is: contractual necessity (to provide the service), legitimate interest (security, fraud prevention), and your consent (where required).

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

Questions about this Privacy Policy or your data? Contact us at [email protected] or by mail at: