Privacy Policy

1. Who we are

ClipStream ("we", "us", "our") is a short-form content automation service operated as an independent product based in the United States. Our primary contact email is gymaneie763@gmail.com.

This Privacy Policy explains how we collect, use, and protect personal information when you visit our website, sign up for the waitlist, or use the ClipStream Telegram bot. It is written to comply with applicable United States privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable state privacy laws.

2. What data we collect

2.1 Waitlist sign-ups (website)

• Email address — collected when you submit the waitlist form on our website. This is the only personal data collected on the website.
• We do not use tracking cookies, analytics pixels, or fingerprinting on our website.

2.2 Telegram bot usage

When you interact with the ClipStream Telegram bot, Telegram's platform automatically provides us with:

• Telegram User ID — a numeric identifier assigned by Telegram
• Display name — your first and/or last name as set in Telegram
• Username — your @username if you have one set (optional in Telegram)

Through your use of the bot, we also collect:

• YouTube URLs you submit for processing
• Video files you upload directly to the bot
• Posting preferences (clip length, caption settings, scheduling preferences)
• Scheduling data — dates and times you set for scheduled posts
• Analytics data — aggregated TikTok channel statistics fetched with your permission

2.3 TikTok account connection

When you choose to connect your TikTok account to ClipStream, we use TikTok's official Login Kit (OAuth 2.0) to request your permission. We request the following TikTok API scopes:

• video.publish — to upload and publish video clips to your TikTok account on your behalf
• video.list — to retrieve your published video list for analytics and performance tracking
• user.info.basic — to read your TikTok username and profile information for display within the service

We collect and store:

• TikTok Access Token — an OAuth token that authorises us to act on your behalf. Stored securely on our server, never shared with third parties.
• TikTok Refresh Token — used to renew your access token when it expires, so you don't need to reconnect frequently.
• TikTok User ID and username — used to identify your account within the service.

We use your TikTok access only to perform actions you explicitly trigger within the bot — posting videos, reading your video list for analytics, and displaying your username. We never post content, access messages, or perform any action without your direct instruction.

You can revoke ClipStream's access to your TikTok account at any time by going to TikTok → Settings → Security → Connected Apps and removing ClipStream. You may also contact us to delete your stored tokens immediately.

2.4 Automatically collected data

• Usage logs — timestamps and actions taken within the bot (e.g., "video processed", "post scheduled"), stored locally for debugging and service improvement. No message content is logged beyond URLs and file metadata.

2.5 What we do NOT collect

• Payment card details (we do not process payments directly)
• Location data
• Browser cookies or tracking data (our website has none)
• The actual video content of clips after they are posted — rendered files are stored temporarily and can be auto-cleaned

3. How we use your data

We use the personal data we collect solely to:

• Provide the service — process videos, generate clips, schedule and publish posts on your behalf
• Communicate with you — send you a launch notification email when ClipStream opens (waitlist only), or send you Telegram messages as part of the bot service
• Improve the service — anonymised usage logs help us understand which features are used and where the pipeline fails
• Security and fraud prevention — access logs help us detect abuse of the invite system

We do not use your data for advertising, profiling, or sale to third parties.

CAN-SPAM Act compliance

The only email we send to waitlist subscribers is a launch notification. Every email includes an unsubscribe mechanism. We do not send unsolicited commercial email. We do not use deceptive subject lines or sender information.

Legal basis (for EEA / UK visitors — GDPR)

If you are accessing the Service from the European Economic Area or United Kingdom, the following legal bases apply:

• Waitlist email: Consent (Article 6(1)(a) GDPR)
• Bot service data: Contract performance (Article 6(1)(b) GDPR)
• Usage logs: Legitimate interests (Article 6(1)(f) GDPR)

4. Third-party services

ClipStream uses the following third-party services. Each has its own privacy policy.

Formspree

We use Formspree to receive waitlist email submissions. When you submit the form, your email address is transmitted to Formspree's servers and forwarded to our inbox. Formspree's privacy policy is available at formspree.io/legal/privacy-policy.

Telegram

The ClipStream bot runs on the Telegram Bot API. All messages you send to the bot pass through Telegram's infrastructure. Telegram's privacy policy is available at telegram.org/privacy.

YouTube (yt-dlp)

When you submit a YouTube URL, our service downloads the video using yt-dlp, an open-source tool. Your URL is processed by Google/YouTube's servers. YouTube's privacy policy is available at policies.google.com/privacy.

Upload-Post.com

ClipStream uses the Upload-Post API to publish videos to TikTok, Instagram, and YouTube on your behalf. Videos and captions are transmitted to Upload-Post's servers during the upload process. Upload-Post's privacy policy is available at upload-post.com/privacy.

TikTok

ClipStream integrates directly with TikTok's Content Posting API and Login Kit. When you authorise ClipStream via TikTok's OAuth flow, we receive an access token that allows us to post videos and read your video list on your behalf. This token is stored securely on our server and used only for actions you initiate. TikTok's privacy policy is available at tiktok.com/legal/privacy-policy. You can revoke our access at any time from TikTok's Connected Apps settings.

ClipStream's use and transfer of information received from TikTok APIs adheres to the TikTok Developer Terms of Service and TikTok's Platform Guidelines. We access, use, and store TikTok user data only to provide the features you explicitly request, never for advertising or resale, and we delete it upon your request or when you disconnect your account.

Instagram / YouTube (posting targets)

When we post on your behalf to Instagram or YouTube, the video is transmitted to Meta (Instagram) and/or Google (YouTube) per their respective APIs. Your account credentials are used solely for posting and are not stored beyond what is necessary to operate the service.

Apify (optional)

If you use the analytics or shadow-ban detection features, anonymised data requests may be sent to Apify's platform to retrieve public TikTok statistics. No personally identifiable information beyond your TikTok handle is involved.

5. Data retention

• Waitlist emails — retained until you unsubscribe or request deletion. We will not contact you for any purpose other than the ClipStream launch notification.
• Bot session data — retained while your account is active. Deleted within 30 days of account termination or deletion request.
• Rendered video files — stored on our server temporarily. Auto-cleanup removes rendered files older than 30 days by default (original source files may be retained longer if needed for re-rendering).
• Usage logs — retained for up to 90 days for debugging purposes, then purged.
• API keys / credentials — stored on the server running the bot. Deleted immediately upon your request or account removal.

6. Your rights

All users

• Unsubscribe — reply "unsubscribe" to any email or contact us to be removed from the waitlist at any time.
• Account deletion — contact us to delete your bot account and all associated data.

California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purpose, and any third parties we share it with.
• Right to delete — request deletion of personal information we hold about you, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to limit use of sensitive personal information — we do not use sensitive personal information beyond what is necessary to provide the service.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To submit a verifiable consumer request, email gymaneie763@gmail.com. We will respond within 45 days as required by law (extendable by an additional 45 days with notice).

Other US state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws have similar rights including access, deletion, correction, and portability. Contact us to exercise these rights. We will respond within the timeframe required by your state's law.

EEA and UK residents (GDPR / UK GDPR)

If you access the Service from the EEA or UK, you also have rights under the GDPR including access, rectification, erasure, restriction, portability, and the right to object. Contact us to exercise these rights; we will respond within 30 days.

7. Security

We take reasonable technical measures to protect your data, including:

• API keys and credentials stored in environment variables, not in publicly accessible files
• Access to the bot is restricted by an invite code system
• Rendered video files are stored in a non-public server directory

No system is 100% secure. If you believe there has been a security incident involving your data, please contact us immediately at gymaneie763@gmail.com.

8. Children's privacy

ClipStream is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will notify active bot users via Telegram message.

Continued use of the service after changes are posted constitutes acceptance of the updated policy.

10. Contact us

For any privacy-related questions, data access requests, or deletion requests:

Any disputes regarding this Privacy Policy are governed by the laws of the United States and the State of Florida. See our Terms of Service for full dispute resolution terms.