Privacy · draft dated 23 October 2026

Data used for the workflow.

Who operates ClipHeat

ClipHeat is operated by the owner of the official @clipheathq accounts. It currently runs locally for the operator. Contact the operator through @clipheathq on Instagram for access, deletion or disconnection requests. No company registration, postal address, or public service availability is claimed here.

Information the local application handles

Depending on the connected platform, ClipHeat handles authorized account identifiers, usernames, account type, granted permissions, access and refresh tokens, token expiry information, selected video files, captions, campaign metadata, publication identifiers and status, and owner notification settings. The operator's Telegram chat identifier is used to deliver operational alerts. No password or token should be submitted through this public information website.

Purpose and disclosure

This information is used to verify the intended account, maintain its authorization, prepare approved content, check status and notify the operator. Platform API requests necessarily transmit the relevant credential and request data to Google/YouTube, Meta/Instagram, or TikTok. Operational messages are transmitted through Telegram. Media is sent to a platform only for an authorized upload. ClipHeat does not sell this data or use it for advertising profiling.

Storage and security

Platform tokens are stored in an encrypted local vault with operating-system access restrictions. Platform requests use HTTPS. Runtime diagnostics are designed to omit secrets. Local backups may contain encrypted credentials. No security measure can guarantee that a compromised operating system or operator account is safe.

Retention and deletion

Operational records and media remain in the operator's local project and backups until the operator removes them. Credentials are retained while the connection is needed and may become unusable on expiry or revocation. A temporary unverified token intake is retained for at most one hour by the intake service; verified credentials use the main vault. The operator can revoke access in the connected platform and request removal of local credentials, records and backups. Deleting local records does not remove previously published platform content; platform deletion and retention follow that platform's controls.

This website and hosting

The prepared site contains static pages and a local image, with no analytics script, advertising tracker, contact form, login form or application-token field. A hosting provider may process IP addresses and technical request logs to serve and secure the site; the deployed provider and its privacy notice must be identified before this draft is adopted. Links to social platforms open services with their own privacy practices.

Availability and changes

There is no public signup or service aimed at children. If ClipHeat later opens to other users or changes its data processing, the policy must be updated before that change. The final published version will identify its effective date after operator approval.