Privacy Policy

Who we are

ReelButler (“we”, “us”) provides an AI service that creates and publishes short-form faceless videos on our users’ behalf, available at reelbutler.com. For any privacy question, contact us at support@reelbutler.com.

What we collect

• Account data — your email address and a salted hash of your password (we never store the password itself).
• Content settings — the niches, prompts, styles, voices and schedules you configure for your video series, and the videos we generate for you.
• Payment data — handled entirely by our payment provider. We never see or store your card details; we receive only your subscription status and plan.
• Connected social accounts — when you connect TikTok, Instagram or YouTube, we store the access tokens those platforms issue so we can publish videos on your behalf, plus the profile details that let you tell your accounts apart. We can only do what you authorized, and you can revoke access at any time from the platform’s own settings. Each platform gets its own section below, naming exactly what we take from it.
• Usage & device data — the actions you take in the product, plus the IP address and browser type that arrive with any web request. We set one cookie: the one that keeps you signed in. There are no advertising or tracking cookies on this site.

How we use it

To provide the service (generating and publishing your videos), to process payments, to secure accounts, and to improve the product. Product analytics tell us which generations ran and what they cost so we can keep the service working and priced honestly; they are recorded on our servers rather than by a tracker in your browser. We do not run advertising pixels on this site, we do not sell your personal data, and no data from a connected social account is ever used for advertising.

Who we share it with

Service providers that power ReelButler, acting on our instructions. Each receives only what it needs to do its job:

• Supabase — the managed Postgres database holding your account, projects, series settings, video records and the encrypted access tokens for your connected social accounts.
• Cloudflare — object storage (R2) for the videos, voiceovers, scene images and any music you upload, and the network that serves them back to you.
• Fly.io — runs our API, the generation pipeline and the renderer.
• Vercel — hosts this website and the dashboard, and so handles your requests and IP address.
• Upstash — the Redis queue that carries a video between generation stages, which briefly holds the text of the video being made.
• fal.ai — our single AI vendor. It receives the prompts, niches and scripts behind your videos, and routes them on to the model providers behind it (currently OpenRouter and Anthropic for writing, ElevenLabs for voiceover, and image and video models for the visuals). We hold no account with those providers directly.
• Stripe — subscriptions and payments. Your card details go to Stripe, never to us.
• Resend — transactional email: sign-in codes, verification, password resets, project invitations, and the finished videos when you choose email as a destination.
• PostHog — product and AI-usage telemetry (which generations ran, what they cost), on their EU infrastructure, keyed to your user ID.
• Sentry — error reports when something breaks, which can include the request that failed and the account it belonged to.
• Google — for “Sign in with Google” if you use it, and for publishing to YouTube if you connect a channel.
• The social platforms you connect — TikTok, Instagram and YouTube receive the videos, their captions, and the token authorizing the post. Nothing is sent to a platform you have not connected.

We do not sell personal data to anyone, and we do not share it with data brokers or advertising networks.

Your videos and social accounts

Videos we generate for you belong to you. Publishing happens only to the accounts you connect, on the schedule you set. Disconnecting an account stops all publishing to it immediately, and you may also revoke ReelButler’s access from TikTok, Instagram or YouTube directly.

YouTube data

ReelButler uses YouTube API Services. Connecting a channel sends you through Google’s consent screen and grants us two permissions: read access to your YouTube account (“youtube.readonly”) and permission to upload (“youtube.upload”).

• What we access — your channel’s ID, title and avatar image, the access and refresh tokens Google issues, and the videos ReelButler itself uploaded to the channel along with their public performance figures.
• Why — the channel details label the connection in your dashboard so two channels are told apart; the tokens let us upload on the schedule you set, unattended; the performance figures are shown back to you so you can see how a series is doing. Nothing else is read, and nothing is posted that is not a video from one of your series.
• How long — for as long as the channel stays connected. Disconnecting it in ReelButler destroys the stored tokens immediately and stops all publishing to that channel; we keep a record of which posts went where, so the question “where did this video get published” still has an answer. Deleting your ReelButler account removes the rest, within 30 days.
• What we never do — we do not sell YouTube data, and we never use it for advertising or ad targeting of any kind, nor hand it to anyone who would. It goes only to the infrastructure providers listed above that store and process it on our instructions.

Your use of YouTube through ReelButler is also governed by the YouTube Terms of Service, and Google’s own handling of your data is described in the Google Privacy Policy. You can revoke ReelButler’s access to your Google account at any time from the Google security settings page — that works independently of us, even if you no longer have a ReelButler account.

Instagram data

Connecting an Instagram professional account grants us Instagram’s “business basic” and “content publish” permissions. From those we access your Instagram user ID and username, the access token Meta issues, and the reels ReelButler publishes for you — including each post’s ID, permalink and the delivery status Instagram reports while it processes the upload.

The username labels the connection in your dashboard; the token publishes your reels on your schedule; the post details are what lets us show you where a video ended up and tell you when a publish failed. We keep this while the account is connected. Disconnecting in ReelButler, removing ReelButler from inside Instagram, or asking Instagram to delete the data it shared with us all do the same thing: the token is destroyed, the account stops being a publishing destination, and every schedule pointing at it is removed. You can check the status of a deletion request on our data deletion page, using the confirmation code Instagram gives you. Instagram data is never sold, and never used for advertising or ad measurement.

TikTok data

Connecting a TikTok account grants us permission to publish videos and to read basic account information: your account ID, username, display name, profile picture and follower count, plus the posts published through ReelButler and their metrics. The profile fields label the connection so you can tell several accounts apart, the publish permission posts the videos in your series, and the post metrics are reported back to you in your dashboard. We ask for all of these at connect time rather than adding them later, because a scope added later forces every existing customer through consent again.

We keep this data while the account is connected. Disconnecting destroys the stored token immediately and stops all publishing to that account; you can also revoke ReelButler’s access from TikTok’s own app settings. TikTok data is never sold, and never used for advertising or ad measurement.

How we protect your data

The most sensitive thing we hold is the set of access and refresh tokens for the social accounts you connect, because those are what let ReelButler post on your behalf. They are treated accordingly.

• Encrypted in transit — every connection to ReelButler, and every call we make to Google, Meta, TikTok, Stripe and our infrastructure providers, runs over HTTPS with TLS. There is no unencrypted path in or out.
• Encrypted at rest — social access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, and the key is held separately from it. A copy of the database alone therefore yields no usable tokens. Tokens issued by Google for signing in are encrypted at rest by the same rule. The database and file storage behind them are managed services that additionally encrypt their contents at rest.
• Separated by account — every request is scoped to the project it belongs to before any data is read. A signed-in person can only reach the series, videos and connected accounts of a project they are a member of; there is no path in the product that reads across that boundary.
• Least privilege — we request the smallest set of permissions that makes the product work, and no more. On YouTube that is two scopes, of which exactly one can write, and the only write it performs is uploading a video to your own channel. We cannot edit, delete or manage anything else on your channel, and we do not ask for the ability to.
• Destroyed on disconnect — disconnecting a social account deletes its stored tokens immediately, not on a schedule, and publishing to that account stops at once. Revoking access from Google’s or the platform’s own settings has the same effect and does not depend on us.
• Limited internal access — access to production systems is restricted to the people who operate ReelButler, is used only to run and support the service, and is authenticated individually.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability in ReelButler, please write to support@reelbutler.com and we will respond.

Google user data and Limited Use

ReelButler’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means the data described in the YouTube section above is used only to provide and improve the features you connected your channel for; it is never sold, never used for advertising or ad targeting, and never used to train generalised artificial intelligence or machine learning models. Humans do not read it, except where you have asked us for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and de-identified.

Retention & deletion

We keep your data while your account exists. Email support@reelbutler.com to delete your account and associated data; we honor deletion requests within 30 days, except records we must keep for legal or billing reasons. Prompts and model responses from the generation pipeline are pruned on their own clock — 30 days for a successful generation, 180 days for a failed one, which is how long a bad output stays useful as evidence. Data a social platform shared with us has its own shorter life, described in the three sections above: disconnecting an account destroys its token there and then, and for Instagram you can follow a deletion request through our data deletion page.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have rights to access, correct, export, delete, or object to processing of your personal data. Exercise them by emailing support@reelbutler.com.

Changes

We’ll post any changes to this policy here and update the date above. Material changes will be announced in the product or by email.