Last updated: 20 May 2026 · Effective: 20 May 2026
This Privacy Policy explains what information the YAPIC platform (yapic.tech, the “Service”) collects, how that information is used, and the choices you have. It complies with the disclosure requirements of the EU GDPR, the UK GDPR, and the California Consumer Privacy Act (CCPA).
The Service is operated by the YAPIC project. For privacy enquiries contact privacy@yapic.tech.
| Category | Examples | Source |
|---|---|---|
| Authentication credentials | HTTP Basic Auth username/password hash for the operator UI | Configured by the operator at deployment |
| OAuth tokens | access_token, refresh_token, scope, expires_at, account_id, account_handle for each connected TikTok / YouTube / Instagram account | Provided by the respective platform when you authorise the connection |
| Generated content metadata | Job records (title, hook, prompt, score, file URL pointing to Cloudflare R2) | Created by you when you trigger a generation job |
| Operational logs | Backend access logs (timestamps, IP address, request path, response code) retained for diagnostic purposes | Generated automatically by the server |
| Connection alerts | Channel auto-pause and publish-failure events, optionally pushed to a configured Telegram chat | Generated automatically |
We do not collect: contact lists, location, advertising identifiers, biometric data, payment card data (the Service does not handle payments), or analytics beacons.
TELEGRAM_BOT_TOKEN is configured).We do not use any of this information for advertising, profiling unrelated parties, training third-party AI models, or selling to data brokers.
We share data only with the providers necessary to operate the Service. Each provider acts as an independent processor or controller under its own terms:
user.info.basic, video.upload,
video.publish).youtube.upload, youtube.readonly).We will disclose information if required to do so by law or in response to a valid legal request (subpoena, court order).
| Data | Retained |
|---|---|
| OAuth tokens | Until you disconnect the integration or revoke access at the provider |
| Generated job records | Indefinitely, until manually deleted by the operator |
| Backups (R2) | 30 days for daily snapshots; 90 days for monthly snapshots |
| Access logs | 30 days, rolling |
| System alerts | 90 days after acknowledgement |
max-age=63072000; includeSubDomains; preload).No system is 100% secure. If we become aware of a breach affecting your data we will notify you without undue delay where required by law.
Depending on where you live (EEA, UK, California, etc.), you have the right to:
To exercise these rights, email privacy@yapic.tech. We will respond within 30 days. To disconnect a social-media integration, click Disconnect next to the relevant account in Studio → Settings → Social Auth, or revoke access directly at the provider’s account settings.
The Service is hosted on infrastructure that may transmit data across international borders (e.g., Cloudflare’s global edge network). Where we transfer personal data outside the EEA / UK, we rely on Standard Contractual Clauses or equivalent safeguards published by the sub-processors.
The Service is not directed at and not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors.
The public site (yapic.tech) does not
set tracking cookies. The operator UI uses localStorage
only to remember UI preferences (language toggle). HTTP Basic Auth
credentials are cached by the browser — they are not stored by us.
We do not run any analytics or advertising trackers, so Do-Not-Track is effectively respected by default.
We may update this Policy. The “Last updated” date at the top reflects the most recent version. Substantive changes will be announced on the site for at least 14 days before they take effect.
Privacy enquiries: privacy@yapic.tech
Legal: legal@yapic.tech