Privacy Policy

This Privacy Policy describes how MakerStreet (“we”, “us”) handles personal data when you use MakerStreet Publisher at https://publisher.makerstreet.in (the “Service”). The product may also appear in the application as “Social Publisher”.

We wrote this policy to match how the Service actually works. We do not sell personal data, run advertising pixels, or use Instagram data to build advertising profiles.

1. Who this applies to

This policy applies to people who visit the public pages of the Service and to people who create an account. Connecting Instagram or YouTube is optional and happens only after you sign in and start an OAuth flow.

2. Account and workspace data

You create an account with a name, email address, and password. We store the name and email in PostgreSQL. The password is stored as a hash, not in plaintext. Email verification is not currently required.

When you sign in, we create a session. Session records may include a session token, expiry time, IP address, and user-agent string. Sessions last seven days and are refreshed while you remain active. Sign-out ends the current session.

Signing up also creates a personal workspace. We store the workspace name, optional slug, and your membership and role so we can authorize access to that workspace’s projects and connected accounts.

3. Publishing projects and media

MakerStreet Publisher lets you create and manage social publishing content. When you select a video in the browser, we store metadata only (for example file name, MIME type, size, duration, dimensions, codecs, and checksums). The original video file stays on your device unless you later choose to publish.

If you transcribe or analyze a video, we store the resulting transcript, analysis, and generated social copy (captions, titles, descriptions, hashtags, and your edits) in PostgreSQL, scoped to your workspace project. You can delete a project in the application; that hard-deletes the project and cascaded rows (media metadata, transcripts, analyses, generated copy, and related publish jobs).

Transcript, analysis, and generation happen only after you start those actions. We do not silently upload original video for AI processing.

4. Instagram (Meta) data

If you connect Instagram, we use Instagram Login (Meta OAuth). We request only:

• instagram_business_basic — to identify the professional Instagram account you authorize
• instagram_business_content_publish — to publish content you submit to that account

After you authorize the app, we call Instagram’s Graph API for user_id, username, name, and account_type. We store those values, the granted scopes, token expiry, and connection status on a workspace social-account record. We do not request comment-management, messaging, or other Instagram Login scopes.

We store the Instagram access token on the server, encrypted at rest with AES-256-GCM in production. We do not return access tokens to the browser, put them in local storage, or log them. Instagram Login in this product does not issue a separate refresh token; we store the long-lived access token and may refresh an eligible, unexpired token when you publish.

We use the token only to operate the Service on the connected account: confirming identity, publishing Reels (and related publish options you choose, such as caption, cover, share-to-feed, people tags, and collaborators), refreshing an eligible token, and revoking access when you disconnect. We do not use Instagram data for advertising, resale, or unrelated profiling.

You can disconnect Instagram in the Service. Disconnect deletes the sealed token, marks the account disconnected, and best-effort revokes the token with Instagram. Content already published on Instagram remains on Instagram until you delete it there.

5. YouTube (Google) data

You may also connect a YouTube channel. That flow uses Google OAuth with channel-identity and upload scopes. We store channel id, title, custom URL if present, granted scopes, token expiry, and encrypted access and refresh tokens. YouTube publishing from this product is not currently offered in the publish UI. You can disconnect YouTube the same way as Instagram.

6. Temporary media storage (Cloudflare R2)

When you explicitly publish, the browser uploads the selected video (and, if you choose a custom cover, a JPEG) directly to Cloudflare R2 using a short-lived signed URL. The web application does not receive those file bytes. A background publishing worker then provides Instagram with a short-lived signed URL so Instagram can fetch the media.

Those objects are temporary publish files, not a media library. After a publish job finishes, a delayed cleanup job is intended to delete the video and uploaded-cover objects. Bucket lifecycle (default intended lifetime: 24 hours) is a backup. Signed URLs are not stored as permanent records.

7. Publish jobs and the background worker

Publish requests create job records in PostgreSQL, including a snapshot of the caption and publish options you submitted, job state, correlation identifiers, Instagram media/container identifiers when the provider returns them, and sanitized error codes if a job fails. A dedicated worker process performs the Instagram Graph calls. Worker heartbeat rows are operational (process liveness), not a user profile.

8. AI and speech-to-text providers

If you transcribe, we send derived audio (not the original video) to the configured speech-to-text provider (OpenAI or an OpenAI-compatible host). If you analyze or generate copy, we send structured metadata and transcript text to the configured AI provider (OpenAI or an OpenAI-compatible host). Those providers process that content under their own terms. We do not send OAuth tokens or original video files to AI providers.

9. Logs

The Service writes structured application logs (process stdout) for operations such as authentication, OAuth connect, publish, and worker activity. Logs may include user id, workspace id, project id, job id, correlation id, platform, and error codes. We do not log passwords, access tokens, authorization headers, signed media URLs, original media bytes, or full transcripts, captions, or prompts.

Log retention follows the hosting environment’s log drain. We do not operate a separate analytics, advertising, or error-tracking product in the application today.

10. Cookies

We use only cookies required to run the Service:

• An httpOnly session cookie from our authentication library, so you stay signed in.
• An httpOnly sp_oauth_state cookie during Instagram or YouTube connect (about 10 minutes) to protect the OAuth redirect.

We do not set advertising or third-party tracking cookies. The public Privacy, Terms, and Data Deletion pages do not require a session cookie.

11. Processors that handle data for us

Depending on how you use the Service, the following categories of processors may handle data on our behalf:

• PostgreSQL hosting (account, workspace, project, and job data)
• Application and worker hosting (the web app and publish worker)
• Cloudflare R2 (temporary publish media)
• Meta / Instagram (OAuth and publishing you initiate)
• Google / YouTube (OAuth if you connect YouTube)
• OpenAI or a configured OpenAI-compatible provider (transcription, analysis, and copy generation you initiate)

12. Legal bases and sharing

We process account data to provide the Service you request, to keep the Service secure, and to meet platform rules (including Meta Platform Terms when you connect Instagram). We share data with the processors above only as needed for those purposes. We do not sell personal information.

We may disclose information if required by law or to protect the Service, users, or others from abuse or security incidents.

13. Retention

• Account, workspace, and project data: until you delete the relevant project or we complete a deletion request for your account.
• Sessions: until expiry (seven days) or sign-out.
• Instagram/YouTube tokens: until you disconnect or we complete a deletion request.
• Temporary R2 objects: until delayed cleanup after a finished publish job, with bucket lifecycle as backup.
• Publish job records: retained with the project until the project is deleted or a broader deletion request is completed. There is no separate automated purge timer in the application today.

14. Your choices

• Update account details by using the Service while signed in.
• Disconnect Instagram or YouTube from Publishing accounts.
• Delete individual projects in the application.
• Request deletion of remaining application data as described on the Data Deletion page.
• Remove MakerStreet Publisher from your Instagram account settings, which stops new token use from Instagram’s side.

We do not currently offer an automated data-export (portability) download.

15. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13.

16. Changes

We may update this policy as the Service changes. The “Last updated” date at the top will change when we do. Material changes will be reflected on this page.

17. Contact

Privacy and deletion requests: privacy@makerstreet.in. Please use the email address on your MakerStreet Publisher account so we can verify the request.