Privacy Policy

Bract is a social media management tool that lets you write a post once and publish it to the networks you have linked — currently TikTok and YouTube. This policy explains what we collect, why, and how to get rid of it. Questions go to bractservices@gmail.com.

• Account details — Your name, email address and a password that is stored only as a salted scrypt hash. We never hold your password in a readable form.
• Verification codes — The six-digit codes we email during sign-up, stored as a hash and deleted once used or expired.
• Network access tokens — When you link a network, that network gives us an access token. It is what lets us publish on your behalf and read the impression counts for posts we published. We request only the permissions needed for that — for YouTube, the ability to upload videos to your channel, read its name and subscriber count, and read its daily view and engagement figures; for TikTok, the ability to post to your account, read your profile and follower count, and read the view, like, comment and share counts of your public videos.
• Your content — The posts you compose, their scheduled times, publication status, and the per-network results returned after publishing.
• Engagement metrics — View and engagement figures for each account you link, covering the last 90 days, so the overview page can chart them. We do not read anybody else’s data.
• Subscription status — Your plan, its renewal date and its state. Card details are handled entirely by our payment provider and never reach our servers.

We do not collect analytics on your browsing, we do not run third-party trackers or advertising pixels, and we do not build a profile of you. The few cookies we do set, and what each one is for, are listed in our Cookie Policy.

Every item above exists to deliver a feature you asked for: to sign you in, to publish what you wrote where you told us to publish it, to show you how those posts performed, and to bill the correct plan. We do not repurpose any of it. We do not sell, rent or trade personal data, and we do not share it with advertisers.

Only where the feature requires it, and only the part required:

• The networks you link — The content of a post is sent to the networks you selected for that post, which then handle it under their own terms.
• Our email provider — Your address, so verification codes and account notices can reach you.
• Our payment provider — Whatever the provider needs to take a subscription payment. They are the controller of your card details, not us.
• Our hosting and database providers — Who store the data on our behalf under contract.

We will also disclose data where the law compels it, and will tell you when we are permitted to.

A network token is the most sensitive thing we hold, so it gets its own section. Tokens are stored server-side and are never sent to your browser or exposed through our API. We use them only to publish posts you created and to read metrics for those posts.

You can disconnect any network from Settings at any time. Disconnecting deletes the stored token and the linked account record immediately, and Bract loses all access to that network. You can also revoke our access from the network’s own settings — for TikTok, under Settings and privacy › Security › Apps and services in the TikTok app; for YouTube, on your Google Account’s security settings page. If you revoke from their side, the token we hold stops working and we discard it the next time we try to use it.

Bract uses YouTube API Services to publish to YouTube. When you link a YouTube channel, Google’s handling of your data is governed by the Google Privacy Policy, and your use of YouTube by the YouTube Terms of Service.

From YouTube we access your channel’s id, name, handle and subscriber count, and its daily views, likes, comments and shares. We use them to show which channel is linked and to chart how it performs on your overview. We store them alongside your account, share them with no one, and delete them when you disconnect YouTube or close your account. The videos you upload are sent to YouTube and nowhere else.

Bract’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting a single post removes it and its metrics from our database. Disconnecting a network removes that network’s token and linked account.

You can delete your account from Settings. Doing so signs you out everywhere and you cannot sign in to it again. It cancels any paid plan straight away, revokes Bract’s access to every linked network, and deletes the stored tokens and the metrics pulled from those networks immediately. Posts that were scheduled but not yet sent are not sent.

We keep a closed record of the account: your name, email address, the posts you wrote and your billing history, marked as deleted. We keep it to answer billing questions and payment disputes, and so that one email address gets one free trial. To have that record erased as well, email bractservices@gmail.com from the address that was on the account and we will erase it within 30 days, except where the law requires us to keep payment records.

Posts already published to a network stay on that network — they belong to your account there, and only that network can remove them.

Backups are retained for a further 30 days before being overwritten in the ordinary rotation.

• Verification codes — Ten minutes, then deleted automatically.
• Sessions — Thirty days, or until you log out, whichever comes first.
• Posts — Until you delete them. After you delete your account they stay on its closed record until you ask us to erase it.
• Metrics — Until you delete the post, disconnect the network or delete your account.
• Tokens — Until you disconnect the network, revoke access from the network’s side, or delete your account.
• Deleted accounts — The closed record described above, until you ask us to erase it.

Passwords are salted and hashed with scrypt. Session cookies are HTTP-only, same-site and marked secure in production, and hold an opaque random identifier rather than your user id. Incoming webhook deliveries are rejected unless they carry a valid signature from the sending network. No system is perfect, and we will notify affected users promptly if a breach ever puts personal data at risk.

Depending on where you live you may have the right to access, correct, export, restrict or erase your personal data, and to object to how we process it. Write to bractservices@gmail.com and we will respond within 30 days. You will never be charged or penalised for exercising any of them.

Bract is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.

If we change anything material we will update the date at the top of this page and email account holders before it takes effect. Continuing to use Bract afterwards means the revised policy applies. See also our Terms & Conditions.