ReelsEngineReelsEngine — Privacy Policy
Last updated: July 16, 2026.
Who we are
ReelsEngine ("we", "us") is an AI video-creation service operated at reels-engine.com. Contact: support@reels-engine.com.
What we collect
- Account data: your email address and authentication identifiers when you sign in (via Google OAuth or email).
- Content you provide: series settings (niche descriptions, example scripts, schedules), video concepts, uploaded music, and generated videos.
- Connected platform tokens: if you connect a publishing account (YouTube, TikTok), we store the OAuth tokens needed to post videos on your behalf, plus the account's display name and avatar so you can see which account is connected. We request only the minimum scopes: YouTube `youtube.upload`; TikTok `user.info.basic`, `video.upload` and `video.publish`. We cannot read your messages, comments, analytics, followers, or other account data.
- Usage data: render counts, feature usage, and estimated processing costs, used for quotas, billing, and service improvement.
How we use it
To operate the service: generate scripts and images via third-party AI providers, synthesize voiceovers, assemble videos, and — only when you explicitly approve a video — upload it to the platform account you connected. We do not sell your personal data. We do not use your content to train AI models.
Third-party processors
Video generation relies on external AI APIs (script, image, and speech providers) and cloud hosting/storage. Your video concepts and scripts are transmitted to those providers solely to produce your videos, subject to their terms.
Google user data (YouTube)
ReelsEngine's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ReelsEngine uses YouTube API Services; by connecting a YouTube channel you also agree to the [YouTube Terms of Service](https://www.youtube.com/t/terms) and to [Google's Privacy Policy](https://policies.google.com/privacy).
What Google user data we receive. When you connect a YouTube channel we receive an OAuth refresh token for the `youtube.upload` scope, and your channel's display name and thumbnail so you can confirm which channel is connected. We do not receive, and cannot access, your videos, comments, messages, analytics, subscribers, or any other channel data.
Who we share, transfer, or disclose it to. We do not sell, rent, or share your Google user data with any third party for any purpose. In particular, your Google tokens and channel data are never sent to the third-party AI providers that generate your videos — those providers only ever receive the text prompts and media needed to produce a video, never anything obtained from Google. The only parties that ever store or process your Google user data are:
- Google itself, when we call the YouTube Data API on your instruction to upload a video you approved; and
- our own infrastructure provider (a cloud server and managed PostgreSQL database hosted with Hetzner in Germany), where the encrypted token is stored.
We disclose Google user data to no one else. We may disclose it only if compelled by valid legal process, and we do not transfer it to develop, improve, or train any AI or machine-learning model.
How you revoke it. Disconnect the channel from your ReelsEngine dashboard (which deletes our stored token immediately), or revoke ReelsEngine's access at [myaccount.google.com/permissions](https://myaccount.google.com/permissions).
Connected accounts & posting
Posting happens only on your explicit instruction: a video is uploaded to a connected account solely after you approve that specific video AND enable publishing for its series. One approval means one post, to your own account, and nothing else. You can disconnect any platform at any time from your dashboard (which deletes our stored tokens immediately), or revoke ReelsEngine's access from the platform's own settings — Google: [myaccount.google.com/permissions](https://myaccount.google.com/permissions); TikTok: Settings → Security → Apps and services.
Storage on your device
We store a small amount of information on your device, and we use it only to keep you signed in. Specifically:
- Your session token, kept in your browser's local storage. It is what tells us a request is yours. It expires after 30 days, you can revoke it at any time from Settings ("sign out everywhere"), and signing out deletes it.
- A short-lived media token, held in memory only for as long as the page is open (never written to disk). It lets your browser load your own video thumbnails and frames, which cannot send an authentication header.
- Cookies set by Google when you use "Sign in with Google". These are set by Google, not by us, and are governed by [Google's Privacy Policy](https://policies.google.com/privacy). We do not read them.
That is the complete list. We do not use cookies or any similar technology for advertising, analytics, profiling, cross-site tracking, fingerprinting, or recognising you across other websites. We run no third-party trackers, no advertising pixels, and no analytics scripts. We do not sell or share anything from your device with anyone, and we do not allow third parties to place or read anything on your device through our service — other than Google's own sign-in, above, which you initiate by choosing to sign in with Google.
You can clear this at any time by signing out, or by clearing site data in your browser. Doing so signs you out; it does not delete your account or your videos.
How we protect your data
We treat connected-account tokens as the most sensitive data we hold — a refresh token is, in effect, permission to act on your channel — and protect them accordingly:
- Encryption in transit. All traffic to and from ReelsEngine is served exclusively over HTTPS (TLS); there is no unencrypted endpoint.
- Encryption at rest for sensitive tokens. YouTube and TikTok OAuth tokens are encrypted before they are written to our database, using authenticated encryption (AES via the Fernet scheme). The encryption key is held only in the server's environment, never in the database, so a copy of the database alone cannot reveal any token.
- Private media storage. Your generated videos live in a private object store that is not publicly readable; they are served only through short-lived, signed URLs tied to your session, which expire automatically.
- Revocable, expiring sessions. Signing in creates a session token that expires and can be revoked at any time — individually, or across every device at once from your settings. We store only a hashed form of each session token, not the token itself.
- Least-privilege access. We request the minimum OAuth scopes needed to upload on your behalf (YouTube `youtube.upload`; TikTok `user.info.basic`, `video.upload`, `video.publish`) and nothing more.
- Deletion on disconnect. Disconnecting a platform, or deleting your account, removes the stored tokens promptly (see below).
No system is perfectly secure, and we do not claim otherwise; but sensitive credentials are never stored in plaintext and never leave our infrastructure in readable form.
Retention & deletion
Account data and content are retained while your account is active. Delete your account (or email support@reels-engine.com) and we remove your personal data, stored tokens, and content within 30 days, except records we must keep for legal or billing purposes.
Your rights
You may access, correct, export, or delete your personal data at any time by contacting support@reels-engine.com. If you are in a jurisdiction with specific data rights (e.g. GDPR, Australian Privacy Act), we honour those rights.
Changes
We will post any changes to this policy on this page with an updated date.
Pricing · Refunds · Privacy · Terms · support@reels-engine.com