Privacy Policy

Effective date: September 15, 2026

1. Overview

Proliferate is a publishing tool operated by Automates. Anyone can register an account, connect their own social media accounts, and publish content to them. Each registered user’s data is kept separate from every other user’s. This policy describes what data the application handles, where it is stored, and how it can be removed.

2. Data we handle

• Account. For each registered user: the email address they signed up with and a password stored only as a cryptographic hash. The password itself is never stored and cannot be recovered from the hash.
• Platform authentication tokens. Access and refresh tokens issued by a platform (such as TikTok) when a user authorizes the connection through that platform’s official OAuth flow, together with the account identifier the platform returns. Each user’s tokens are stored against their account only.
• Content submitted for publication. Video files and captions a user uploads in order to publish them to their own connected account.
• Operational records. Timestamps and status of each user’s publishing attempts, used to enforce the daily posting limit described in section 7 and to keep an operational record of activity on the account.

3. How data is stored

• The application is hosted on Vercel, and its database is a managed PostgreSQL instance. Both are operated by those providers as processors on our behalf.
• Password-reset email is sent through Resend, which receives the email address a reset was requested for and the one-time reset link, for the sole purpose of delivering that message. Resend acts as a processor on our behalf.
• Platform authentication tokens are encrypted at rest using AES-256-GCM, with a random initialization vector per token, before they are written to the database. The encryption key is held in the application environment and is not stored in the database.
• Every user’s platform tokens, content, and operational records are stored against that user’s account and are not readable by other users of the application.
• The login session is a signed, HTTP-only cookie. It contains no personal data beyond the signed-in user’s email address and expires automatically after eight hours.
• Uploaded video is transmitted to the connected platform and is not retained by this application after the upload completes.

4. What we do not do

• We do not sell, rent, or share personal data with third parties.
• We do not collect data about other users of connected platforms. The application publishes content to, and reads the connection status of, accounts each user owns and has explicitly authorized.
• We do not run advertising, tracking, or analytics services.
• We do not use submitted content to train machine learning models.

5. Platform data

Where a platform grants access to its API, the application requests only the permissions required to identify the connected account and publish content to it. Data received from a platform is used solely to operate the features the connecting user has asked for, is never sold or shared, and is handled in accordance with that platform’s developer terms.

6. Retention and deletion

• Authentication tokens are retained only while a connection is active. Removing a connection in the application deletes the stored tokens for that platform.
• Access can also be revoked at any time from the platform’s own security or connected-apps settings, which invalidates the tokens immediately.
• Signed-in users can delete their own account from the Accounts page at any time. Deleting an account permanently removes that user’s platform tokens, post history, and any outstanding password-reset requests, and cannot be undone.
• To request deletion without signing in, contact us at the address below and it will be removed.
• Short of deletion, post history and other operational records are kept for as long as the account exists. A password-reset link stops working one hour after it is requested, or as soon as it is used once, whichever happens first; an expired, unused link is not deleted early, but it can no longer be used.

7. Service limits

The free tier allows each user one post per connected platform per day. The day resets at midnight UTC. This limit protects the application’s shared platform API quota; it is not a paid feature.

8. Changes

We may update this policy. The current version is always available at this page with the effective date shown above.

9. Contact

Privacy questions and deletion requests: automatesgen@gmail.com

Terms of Service · Back to the app