Privacy Policy

Information you provide

• Account information: email address, name, and password (hashed, never stored in plain text)
• Profile information: display name, bio, avatar URL (for your media kit)
• Payment information: handled entirely by Stripe — we never see or store your card details

Information from connected platforms

When you connect YouTube, Instagram, or TikTok, we receive and store:

• OAuth access tokens and refresh tokens (encrypted at rest)
• Public profile information (channel/account name, follower count)
• Analytics data: views, likes, comments, subscriber counts, engagement metrics
• Post and video metadata: titles, descriptions, thumbnails, publish dates
• Comment data: comment text, author names, timestamps (for comment inbox feature)

Automatically collected information

• Log data: IP address, browser type, pages visited, timestamps
• Session cookies for authentication (HttpOnly, Secure)
• Timezone, detected automatically to display your data in local time

• To provide, operate, and improve creatorbox.app
• To display your analytics data and power dashboard features
• To process payments and manage your subscription via Stripe
• To send transactional emails (account creation, password reset, subscription notices)
• To send product emails (weekly digests, sync failure alerts) — you can opt out
• To generate AI script suggestions via the Anthropic Claude API (your input is sent to Anthropic; see their privacy policy)
• To detect and prevent fraud and abuse
• To comply with legal obligations

We do not sell your personal data. We do not use your data for advertising purposes.

We share data only with the following categories of third parties:

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Amazon Web Services (AWS SES) — email delivery. Emails you receive from us are routed through AWS.
• Anthropic — AI script generation. Text you submit for AI generation is sent to Anthropic's API. Subject to Anthropic's Privacy Policy.
• Google / YouTube — OAuth and data sync. Subject to Google's Privacy Policy.
• Meta / Instagram — OAuth and data sync. Subject to Meta's Privacy Policy.
• TikTok — OAuth and data sync. Subject to TikTok's Privacy Policy.

We may disclose your information if required by law, court order, or to protect the rights and safety of our users or the public.

We retain your account data for as long as your account is active. When you delete your account, we permanently delete your data within 30 days, including platform tokens, analytics data, saved scripts, and comments. Billing records may be retained for up to 7 years as required by law.

We protect your data using industry-standard measures: HTTPS/TLS encryption in transit, encrypted storage for OAuth tokens, hashed passwords (bcrypt), and regular security reviews. No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate data via your account settings
• Deletion — delete your account and all associated data from Settings → Danger Zone
• Portability — request an export of your data
• Objection — object to certain processing activities

To exercise these rights, email us at [email protected]. We will respond within 30 days.

creatorbox.app uses the following cookies:

• Authentication session cookie — required for you to stay logged in (HttpOnly, Secure, SameSite=Lax)
• CSRF token — required for form security

We do not use tracking, advertising, or analytics cookies. Third-party services (Stripe) may set their own cookies when you visit checkout pages.

creatorbox.app is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

creatorbox.app is operated from the United States. If you access the service from outside the US, your data may be transferred to and processed in the US. By using creatorbox.app, you consent to this transfer.

For users in the European Economic Area (EEA), our legal basis for processing is: contractual necessity (to provide the service), legitimate interest (security, fraud prevention), and your consent (where required).

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

Questions about this Privacy Policy or your data? Contact us at [email protected] or by mail at: