Creare Privacy Policy

Creare is published by Stack Labs LLC. It helps users prepare and review social posts from video they choose to import, with separate workspaces for their brands.

Optional AI connectors: You may grant Muse or ChatGPT access to one Creare workspace and selected capabilities. When you use that connector, the selected assistant service receives authorized tool results, which may include connected account names, saved draft captions, video metadata, publishing results, available post metrics and account follower or subscriber counts. Social-provider passwords and authorization tokens are not returned to the assistant. Connector credentials and pending authorization records are encrypted in Creare's token vault. Pending authorization expires within ten minutes; granted access expires within at most 90 days. Revoke access in Accounts > AI connectors to stop future access. Revocation does not retract data already received by the assistant or posts already sent to social platforms; those services handle their copies under their own privacy policies. Only grant publishing access to an assistant you intend to authorize to approve and publish your explicitly requested content.

Sign in supports Apple and Google when enabled. Creare stores your verified provider subject, workspace membership, and app-session information to authenticate you and manage account deletion. Apple sign-in also stores an encrypted Apple authorization record for revocation. Google sign-in does not store Google access or refresh tokens on the backend and does not connect a YouTube publishing account. Apple and Google identities remain separate; matching email addresses do not merge accounts. App-session credentials are stored securely on your device. Creare does not use tracking pixels, advertising SDKs, or analytics SDKs.

Imported videos, transcripts, captions, drafts, and connection records are processed and stored on the Creare backend for your publishing workflows. Social authorization tokens are encrypted at rest. Pending account selections expire within ten minutes; connecting an account does not publish a post. Providers receive the content and authorization needed when you approve publishing through their service.

Creare uses YouTube API Services for its optional YouTube integration. Google's handling of information is described in the Google Privacy Policy.

Google and YouTube data accessed: Connecting YouTube is a separate, optional authorization from signing into Creare. The YouTube connection receives OAuth access and refresh tokens and reads your authorized channel ID, channel title and custom channel URL using youtube.readonly. When you approve an upload, Creare sends your selected video and its title, description, tags and privacy setting to YouTube using youtube.upload, and receives the upload result, including the video ID. These permissions do not give Creare access to Gmail or Google Drive.

Optional account and own-video reporting: When an authorized workspace requests a report, the backend can read view, like and comment counts for its own videos published through Creare, plus available follower or subscriber counts for its connected accounts. It verifies each video's channel and each exact connected account before returning counts. YouTube subscriber counts are rounded by the provider. These counts support reports and exploratory comparisons of that account's posts, not viewer profiles or a complete channel history. Counts are fetched for the requested report, not stored as a separate historical statistics database. The Analytics tab shows available post counts and account follower or subscriber totals; Activity shows publishing results.

How Google and YouTube data is used: Creare uses channel information to display and bind the destination you selected, and checks channel identity before uploading to avoid posting to the wrong account. Authorization tokens enable that connection and its renewal. Your approved video and metadata are used to carry out your requested upload; the returned video ID and publishing result support the result shown in Creare. Google sign-in alone does not authorize any of these YouTube actions.

Sharing Google and YouTube data: Stack Labs LLC operates Creare's backend. Google receives the authorization requests and approved YouTube uploads. Cloudflare, Inc. provides hosted backend infrastructure, storage, AI processing and network delivery through Workers, Containers, Durable Objects, private R2 storage and Workers AI. Imported media and derived content are processed by these services for your publishing workflow. Your channel connection and tokens are not shared with another social network to connect that network. Publishing the same content elsewhere requires a separate destination and your approval. Creare does not sell Google user data or share it with advertisers.

Protecting Google and YouTube data: The public service and Google API connections use HTTPS. Stored social authorization tokens are encrypted at rest. Authenticated requests and workspace ownership checks restrict access to connection records and publishing workflows. These protections do not mean that all stored videos and draft metadata are encrypted at rest, or that any system can guarantee absolute security.

Retention and deletion of Google and YouTube data: Creare periodically revalidates your YouTube authorization and refreshes saved channel information and video-status data. When authorization is no longer valid, or retained API data cannot be revalidated within its retention window, the corresponding stored provider data is scheduled for removal. Disconnecting YouTube starts removal of that connection's stored grant and YouTube-derived destination and publishing-result data, and attempts to revoke the authorization at Google. If a cleanup step is delayed or remote revocation cannot be confirmed, Creare reports that status rather than treating it as complete. Your original uploaded media and user-authored captions remain available separately; old YouTube approvals cannot publish after disconnection. These actions do not delete videos already published on YouTube. Delete Account removes your owned backend data and stored grants and attempts supported remote authorization revocation. You can also remove Creare's access in your Google Account permissions. Creare detects authorization loss during subsequent checks; revoking at Google does not itself delete your original Creare uploads or videos on YouTube. Manage published videos in YouTube. Contact malik@stack-labs.net for deletion assistance.

Creare does not sell personal information. Delete Account in Accounts removes your owned workspaces, drafts, uploaded media, sessions, and stored social grants. Posts already published on external platforms are not deleted. If a provider cannot confirm remote revocation, Creare tells you how to remove authorization there. Shared Mastodon application registrations contain application credentials, not a user's social grant, and may remain for other users.

Contact Stack Labs LLC at malik@stack-labs.net for privacy questions.