OCTOBER 25, 2026

Your channel data,
under your control.

Social AI Manager is operated by SocialAIManager, based in California, United States. This Privacy Policy explains our practices regarding the collection, use, retention, and protection of information across the private account portal and its read-only YouTube and Instagram integrations. TikTok integration is deferred and not available in the active deployment. Access to this service is private and restricted to authorized users.

Information we collect

We collect only the information necessary to provide read-only analytics and manage your private account:

• Account & preferences: Your Site-specific sign-in identifier (OpenAI profile email and display name provided by host authentication), display timezone preference, and privacy policy acceptance timestamps and version (currently 2026-10-25).
• YouTube integration: When you authorize YouTube, we use YouTube API Services to read channel identifiers, channel titles, publication dates, video titles, video IDs, URLs, native lifetime views, likes, and comment counts, as well as native channel views and watch-time reports. To tell Google logins apart when you connect several channels, we also request the openid and email scopes and store the email address of the Google account you used and its Google account identifier. The email address is shown on the Connections page; the identifier is used to group channels that were authorized with the same Google login. A channel may be connected with more than one Google login, and several channels may be connected at once.
• Instagram integration: When you authorize Instagram with a professional Business or Creator account, we use the Meta Graph API / Instagram Graph API to read account identity, post metadata, native account insights, and post metrics. When you grant the optional comment permission, we can also retrieve a bounded page of comments on your own posts when you request a Spotlight report. Each Instagram account is authorized separately, so you can connect several accounts.
• Encrypted credentials: We store OAuth access and refresh tokens on the server encrypted at rest using AES-GCM encryption with a server-managed key. We never ask for, receive, or store your Google or Meta passwords. Tokens are never exposed to connected MCP clients, web pages, or operational logs.
• Scope limitations: We never download, stream, or store video or audio media files, direct messages, or revenue/monetization data, nor do we request write or publishing permissions. For channels you own and authorize, YouTube API Services return upload metadata and native counters (such as titles, publication dates, view counts, and like counts) which may include private or unlisted video uploads associated with your owned channel.

Cookies and browser storage

The hosting sign-in service may set session cookies required to authenticate your account and protect private pages. The portal also uses a first-party sidebar_state cookie for up to seven days to remember whether the navigation is open or closed. The dashboard stores your selected account and display preferences in session storage for the current browser tab; this data is cleared when that tab's session ends. It also remembers the account you used last, as a channel identifier only, in your browser's local storage, which stays until you clear site data. These items support sign-in or interface preferences. The portal does not use advertising cookies, analytics pixels, or cross-site tracking. You can block browser storage in your browser settings, but sign-in or saved interface preferences may not work as intended.

Purpose and sharing

We use this information to answer your analytics questions, display connection status, refresh metadata, and process disconnect requests.

Model Context Protocol (MCP) clients: When you connect an MCP client (such as ChatGPT, Codex, or Claude) and request analytics, requested reports and video metadata are returned to that client and handled in accordance with that client’s terms and privacy practices. Authentication tokens and encryption keys are never returned to MCP clients.

Comments: When requested for a video on your connected YouTube channel or an Instagram post on your connected account (where optional Meta comment permission has been granted), we retrieve a bounded page of published top-level comments and return each comment's provider ID, text, display name, publication time, and available provider counts to the requesting portal or MCP client. We do not store comment text in the portal database or request hidden, held-for-review, spam, or moderation data. Replies may not be included.

Optional server-initiated AI inference: When natural language query features or view selection are enabled by runtime configuration, the service evaluates queries using configured model providers (such as Cloudflare AI Gateway or TypeSafe API). In enabled mode, the transmitted payload includes the user query text, target account details (account ID, display name, provider, capabilities), display timezone, and the requested date window. The service does not use your channel data, queries, or results to train AI models. Transmitted queries are processed by external inference providers in accordance with their respective API privacy and data retention policies. When AI query features are disabled, queries are evaluated strictly in-memory using deterministic rule matching without outbound inference requests.

No sale or cross-context behavioral advertising: We do not sell your personal or channel information, nor do we share it with third parties for cross-context behavioral advertising.

Hosting and third-party services

OpenAI Sites hosts the application and manages sign-in authentication; its Cloudflare D1 infrastructure stores account records and other disclosed portal data. The operator can inspect database records through Sites Settings. Google Fonts supplies page fonts, which may involve a request to Google when a page loads. Hosting providers may maintain standard operational logs (e.g., IP addresses and request paths) under their own privacy policies.

By using YouTube features, you are also subject to the Google Privacy Policy. By using Instagram features, you are subject to the Meta Privacy Policy.

Retention and cleanup

Current maintenance status: Scheduled maintenance is currently paused. Request-history records are hidden after their 30-day logical expiry when history is read, and YouTube token authorization is checked when a provider token is used. Unattended cleanup, including stale YouTube connection removal, abandoned connection cleanup, and scheduled physical deletion, is not running. Eligible records may remain in storage until an applicable request-triggered cleanup removes them or a supported authenticated maintenance caller is configured and successfully runs. We do not promise a physical deletion deadline before that.

Credential and token lifecycles: Provider credentials remain stored in encrypted form while your channel or account connection is active. Token lifecycles and maintenance handling differ by provider:

• Google (YouTube): Access to stored YouTube tokens requires an authorization verification check within the previous 29 days; each successful token refresh with Google, and each reconnect, renews that check. If 29 days elapse without an authorization check, token access is suspended and reconnection is required. When scheduled maintenance is running, it automatically disconnects stale YouTube connections exceeding 29 days without an authorization verification, one channel at a time, deleting the stored credential and associated records. Maintenance removes the channel locally; it revokes the Google grant only under the same conditions as a manual disconnect (see “Google (YouTube) disconnect” below). Abandoned, unfinished connection attempts become eligible for deletion after 15 minutes and are removed the next time you add a connection or maintenance runs. Scheduled maintenance is currently paused and has no authenticated caller, so the unattended cleanup in this paragraph is not running. It will resume only after a supported caller is configured and a cleanup run succeeds.
• Meta (Instagram): Instagram issues long-lived tokens (~60 days of validity) without refresh tokens. Rather than a 29-day verification limit or automated connection sweep, Instagram tokens are refreshed proactively when accessed within the final 7 days of validity, exchanging the current token for a new long-lived token and recording an authorization check.

Cache and metadata retention: Report payloads are cached temporarily (up to 15 minutes) to avoid redundant provider API calls. Persistent channel metadata and lifetime snapshots are retained locally to support comparative reporting until eligible for removal after 29 days from retrieval. Post and video records have a refresh due timestamp set to one day following retrieval; they become eligible for deletion once their scheduled refresh due date is at least 28 days in the past (approximately 29 days following last refresh). Eligible records are physically removed by scheduled maintenance, which is currently paused; no physical deletion deadline applies until a supported authenticated caller is configured and a cleanup run succeeds. Any cleanup cadence will be stated after the caller and schedule are configured and a successful run is verified.

Account preferences, consent records, and deletion logs remain for administrative operation until account deletion.

Request history

When authenticated MCP tool requests are executed, summary records are captured for service operation and troubleshooting. Records include sanitized tool arguments, execution timing, completion status, and optional sanitized user query text provided by the client. Full HTTP headers, authentication tokens, and returned analytics payloads are excluded.

Request history records are limited to a maximum of 1,000 entries per account and have a 30-day logical expiration. Records older than 30 days are immediately hidden from query results. Expired rows are physically pruned upon subsequent request writes or by scheduled cleanup. Scheduled cleanup is currently paused and has no authenticated caller, so during idle periods expired rows may remain in physical storage until a subsequent request write prunes them or a supported authenticated maintenance caller is configured and successfully runs. We do not promise a physical deletion deadline before that. You may review or delete your request history at any time at Request history.

Disconnect and deletion

You can disconnect any single channel or account at any time on Your connection. Disconnecting one channel affects only that channel: it immediately blocks further reads for it and removes its local credential, channel metadata, cached reports, counters, and synchronization jobs from the database. Your other connected channels are not changed.

Google (YouTube) disconnect: Disconnecting a YouTube channel immediately blocks further reads and removes its local credential, channel metadata, cached reports, counters, and synchronization jobs. The Google grant is not necessarily revoked: Google access stays active until you remove it in your Google Account permissions, because one Google grant can be shared by other channels you connected with the same Google login. The one exception is when remote revocation is enabled for the service and the removed channel was the last connected channel for that Google login and no other connection attempt is in progress; then we also ask Google to revoke the grant. If Google’s revocation endpoint is unreachable, encrypted revocation material is queued for background retry with a six-day logical retry limit (after which retries cease), and the Connections page offers a retry. Scheduled maintenance retries revocation and removes expired retry material, but maintenance is currently paused and has no authenticated caller. A queued revocation may remain pending until you retry it from Connections or a supported authenticated maintenance caller is configured and successfully processes it. While a revocation is queued for a Google login, connecting a channel with that login is blocked until the retry finishes.

Instagram disconnect: The Meta / Instagram Graph API flavor utilized by this service does not offer a remote OAuth token revocation endpoint. When you disconnect Instagram, all local credentials, tokens, metadata, and cached metrics are permanently deleted from our database in an immediate fenced batch, and reads are blocked for that account only. Because remote revocation cannot be initiated via the API, you must remove the application’s authorization directly in your Instagram account settings (under Settings > Website permissions > Apps and websites) to terminate Meta-side access. Until you do, Instagram access for that account stays active on Meta’s side.

For complete account deletion or privacy inquiries, contact SocialAIManager at privacy@socialaimanager.ai.

California privacy disclosures

Statutory applicability: Social AI Manager is operated by SocialAIManager, a sole proprietorship of an individual residing in California. Under California Civil Code § 1798.140(d), statutory obligations under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) generally apply to for-profit businesses operating in California that satisfy one or more statutory thresholds: (1) annual gross revenues in excess of $26,625,000 (adjusted for inflation by the California Privacy Protection Agency, effective January 1, 2025); (2) annually buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or (3) deriving 50% or more of annual revenues from selling or sharing consumers’ personal information. Because Social AI Manager operates as a private, restricted-access tool without commercial advertising, data sales, or data brokerage, the operator does not anticipate meeting these commercial thresholds. Applicability is evaluated conditionally based on ongoing operational scale.

CalOPPA notice: In accordance with the California Online Privacy Protection Act, this policy discloses the categories of personally identifiable information collected (site user identifier, profile email and display name from host authentication, timezone preference, privacy consent timestamp and version, encrypted OAuth tokens, social channel/account identifiers, the email address and Google account identifier of each Google login used to connect YouTube channels, post and video metadata, and sanitized request history).

Do Not Track: The service does not track users over time across third-party websites or online services, and does not serve third-party behavioral advertising. Accordingly, the service does not alter its behavior or respond to browser “Do Not Track” (DNT) signals.

Global Privacy Control: The service does not sell personal information or share personal information for cross-context behavioral advertising. As no selling or sharing occurs, Global Privacy Control (GPC) opt-out mechanisms do not alter service operation.

Voluntary privacy requests: Regardless of statutory exemptions, California residents and all users may contact privacy@socialaimanager.ai to review, correct, or request deletion of their stored account data.

Your choices and consent

You choose the provider account and channel, grant only read permissions, and choose which analytics questions to submit. Connecting requires acceptance of this Privacy Policy and the Terms and Conditions. Your acceptance timestamp and policy version (currently 2026-10-25) are recorded. Material updates are posted to this page with an updated effective date. When material updates occur, connecting a new channel or reconnecting an existing channel requires renewed explicit consent in the interface before requests proceed. Users may review current legal terms at any time at /privacy and /terms.