Skip to content
Where Google or Apple sign-in is offered, you can create your account through that provider instead. In that case the provider shares your name and email address with us and we store those; we do not receive or store a password for such an account.
When you sign in, we create a session. Session records may include a session token, expiry time, IP address, and user-agent string. Sessions last seven days and are refreshed while you remain active. Sign-out ends the current session.
Signing up also creates a personal workspace. We store the workspace name, optional slug, and your membership and role so we can authorize access to that workspace’s posts and connected channels.
MakerStreet Publisher lets you create and manage social publishing content. When you select a video in the browser, we store metadata only (for example file name, MIME type, size, duration, dimensions, codecs, and checksums). The original video file stays on your device unless you later choose to publish.
If you transcribe or analyze a video, we store the resulting transcript, analysis, and generated social copy (captions, titles, descriptions, hashtags, and your edits) in PostgreSQL, scoped to your workspace post. You can delete a post in the application; that hard-deletes the post and cascaded rows (media metadata, transcripts, analyses, generated copy, and related publish jobs).
Transcript, analysis, and generation happen only after you start those actions. We do not silently upload original video for AI processing.
4. Instagram (Meta) data
If you connect Instagram, we use Instagram Login (Meta OAuth). We request only:
instagram_business_basic: to identify the professional Instagram account you authorizeinstagram_business_content_publish: to publish content you submit to that account
After you authorize the app, we call Instagram’s Graph API for user_id, username, name, and account_type. We store those values, the granted scopes, token expiry, and connection status on a workspace social-account record. We do not request comment-management, messaging, or other Instagram Login scopes.
We store the Instagram access token on the server, encrypted at rest with AES-256-GCM in production. We do not return access tokens to the browser, put them in local storage, or log them. Instagram Login in this product does not issue a separate refresh token; we store the long-lived access token and may refresh an eligible, unexpired token when you publish.
We use the token only to operate the Service on the connected account: confirming identity, publishing Reels (and related publish options you choose, such as caption, cover, share-to-feed, people tags, and collaborators), refreshing an eligible token, and revoking access when you disconnect. We do not use Instagram data for advertising, resale, or unrelated profiling.
You can disconnect Instagram in the Service. Disconnect deletes the sealed token, marks the account disconnected, and best-effort revokes the token with Instagram. Content already published on Instagram remains on Instagram until you delete it there.
5. YouTube (Google) data
You may also connect a YouTube channel. That flow uses Google OAuth with channel-identity and upload scopes. We store channel id, title, custom URL if present, granted scopes, token expiry, and encrypted access and refresh tokens. You can publish videos to that channel from this product. You can disconnect YouTube the same way as Instagram.
When you explicitly publish, the browser uploads the selected video (and, if you choose a custom cover, a JPEG) directly to Cloudflare R2 using a short-lived signed URL. The web application does not receive those file bytes. A background publishing worker then provides Instagram a time-limited HTTPS URL, or uploads the staged bytes to YouTube with a resumable binary session. Temporary objects are deleted after a delay or expire via bucket lifecycle.
Those objects are temporary publish files, not a media library. After a publish job finishes, a delayed cleanup job is intended to delete the video and uploaded-cover objects. Bucket lifecycle (default intended lifetime: 24 hours) is a backup. Signed URLs are not stored as permanent records.
7. Publish jobs and the background worker
Publish requests create job records in PostgreSQL, including a snapshot of the caption and publish options you submitted, job state, correlation identifiers, Instagram media/container identifiers when the provider returns them, and sanitized error codes if a job fails. A dedicated worker process performs the Instagram Graph calls. Worker heartbeat rows are operational (process liveness), not a user profile.
8. AI and speech-to-text providers
If you transcribe, we send derived audio (not the original video) to the configured speech-to-text provider (OpenAI or an OpenAI-compatible host). If you analyze or generate copy, we send structured metadata and transcript text to the configured AI provider (OpenAI or an OpenAI-compatible host). Those providers process that content under their own terms. We do not send OAuth tokens or original video files to AI providers.
9. Logs
The Service writes structured application logs (process stdout) for operations such as authentication, OAuth connect, publish, and worker activity. Logs may include user id, workspace id, project id, job id, correlation id, platform, and error codes. We do not log passwords, access tokens, authorization headers, signed media URLs, original media bytes, or full transcripts, captions, or prompts.
Log retention follows the hosting environment’s log drain. We do not operate a separate analytics, advertising, or error-tracking product in the application today.
10. Cookies
We use only cookies required to run the Service:
- An httpOnly session cookie from our authentication library, so you stay signed in.
- An httpOnly
sp_oauth_state cookie during Instagram or YouTube connect (about 10 minutes) to protect the OAuth redirect.
We do not set advertising or third-party tracking cookies. The public Privacy, Terms, and Data Deletion pages do not require a session cookie.
11. Processors that handle data for us
Depending on how you use the Service, the following categories of processors may handle data on our behalf:
- PostgreSQL hosting (account, workspace, post, and job data)
- Application and worker hosting (the web app and publish worker)
- Cloudflare R2 (temporary publish media)
- Meta / Instagram (OAuth and publishing you initiate)
- Google (Google sign-in if you use it, and YouTube OAuth if you connect a channel)
- Apple (Apple sign-in, if you use it)
- OpenAI or a configured OpenAI-compatible provider (transcription, analysis, and copy generation you initiate)
12. Legal bases and sharing
We process account data to provide the Service you request, to keep the Service secure, and to meet platform rules (including Meta Platform Terms when you connect Instagram). We share data with the processors above only as needed for those purposes. We do not sell personal information.
We may disclose information if required by law or to protect the Service, users, or others from abuse or security incidents.
13. Retention
- Account, workspace, and post data: until you delete the relevant post or we complete a deletion request for your account.
- Sessions: until expiry (seven days) or sign-out.
- Instagram/YouTube tokens: until you disconnect or we complete a deletion request.
- Temporary R2 objects: until delayed cleanup after a finished publish job, with bucket lifecycle as backup.
- Publish job records: retained with the post until the post is deleted or a broader deletion request is completed. There is no separate automated purge timer in the application today.
14. Your choices
- Update account details by using the Service while signed in.
- Disconnect Instagram or YouTube from Channels.
- Delete individual posts in the application.
- Request deletion of remaining application data as described on the Data Deletion page.
- Remove MakerStreet Publisher from your Instagram account settings, which stops new token use from Instagram’s side.
We do not currently offer an automated data-export (portability) download.
15. Children
The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13.
16. Changes
We may update this policy as the Service changes. The “Last updated” date at the top will change when we do. Material changes will be reflected on this page.
Privacy and deletion requests: privacy@makerstreet.in. Please use the email address on your MakerStreet Publisher account so we can verify the request.