Privacy Policy

Information we handle

• Account information, including your email, profile name, and workspace memberships and permissions. Supabase provides authentication and processes your sign-in credentials.
• Workspace content you or your team provide, including creator and social-account details, reference links, notes, drafts, captions, uploaded videos, review decisions, and planned posting times.
• Information imported from social accounts that a workspace connects, as described in Connected social accounts below.
• Technical information needed to operate and protect the service, such as session identifiers, request information, and error logs processed by our infrastructure providers.

How we use information

We use this information to authenticate users, enforce workspace access, display and organize content, support collaboration and video review, maintain the service, investigate problems, and respond to requests. We do not sell personal information, share it with data brokers, or use it or imported platform data for advertising.

Who can access it

Workspace members can access shared references, notes and imported account content. Access to private projects and uploaded media depends on workspace roles and Creator assignments; workspace Admins have broader access. Only upload information you have permission to share with that team.

We use Supabase for authentication, database services, background processing and file storage, and Vercel to host the app. These providers process information on our behalf to operate the service. Information may also be disclosed where required by law or to address abuse and protect users.

Connected social accounts

A workspace Admin can connect YouTube, Instagram and TikTok accounts. The account owner signs in with the platform and approves access. Surfpoint imports the following and refreshes it in the background:

• YouTube (YouTube Data API, read-only youtube.readonly permission, and YouTube Analytics API, read-only yt-analytics.readonly permission): channel ID, name, handle and avatar; the channel’s subscriber, video and view counts and the number of channels it subscribes to; for each video, its title, description, thumbnail, publish date, duration, privacy, embedding and made-for-kids settings; view, like and comment counts; and, when the owner allows analytics access, its shares, engaged views, watch time, average view duration and percentage, and subscribers gained.
• Instagram (Instagram API with Instagram Login, instagram_business_basic and instagram_business_manage_insights permissions): account ID, username, name, account type and profile picture; its follower, following and post counts; for each post, its media type, caption, link, thumbnail and date; like and comment counts; and available views, reach, saves, shares, interactions and watch time insights.
• TikTok (Login Kit and Display API, user.info.basic, user.info.profile, user.info.stats and video.list permissions): account ID, display name, username, profile link and avatar; follower, following, like and video counts; for each video, its title, description, cover image, share link, date and duration; and view, like, comment and share counts.

Surfpoint uses this information only to show a workspace its creators’ content and performance in the Account Scanner, Video Library and related tools. The profile picture of the first account a member connects is also shown as that member’s picture in the workspace. Imported information is shared with current members of the connecting workspace who have accepted the required policy. It is not shared outside that workspace, except with the service providers named above to operate Surfpoint. Unavailable or delayed measurements are shown as unavailable, not estimated. Connection credentials are encrypted, handled only by our servers, and never shown to workspace members.

For YouTube and Instagram, connecting an account also asks the account owner to approve posting, where Surfpoint offers posting for that platform. The owner can decline it and still connect the account; an Admin can ask again later with Enable publishing. Without that permission, Surfpoint cannot post, comment, send messages or change anything on the platform. TikTok access is always read-only.

Surfpoint’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Posting to connected accounts

When an account is connected or reconnected, or an Admin chooses Enable publishing, Surfpoint requests the platform’s posting permission: youtube.upload for YouTube and instagram_business_content_publish for Instagram. Surfpoint uses it only to post a video your team approved, to the accounts an Admin chose, at the planned time, after an Admin confirms that post. It does not post anything else, and it does not comment, message or change other content.

To post, Surfpoint sends the platform the approved video file and its title, caption or description, and the settings the Admin chose, such as YouTube visibility, whether the video is made for kids, or whether an Instagram Reel is a trial reel. Instagram fetches the video from a private link that expires within about an hour. Surfpoint records the resulting post link and time in the workspace. Once a post is on the platform, it is governed by that platform’s terms and privacy policy, and deleting or changing it in Surfpoint does not remove it from the platform.

Removing posting permission, by declining it, disconnecting the account or revoking access on the platform, stops any post that has not yet been sent.

Disconnecting and deleting platform data

An authorized Admin can disconnect an account from Connected accounts at any time. Disconnecting immediately stops imports and starts deleting that account’s imported profile details, video information, measurements and thumbnails, along with the stored connection credentials. Deletion normally finishes within minutes and always within 7 days. Projects your team wrote independently remain in the workspace. Nothing is deleted from the platform account itself.

You can also remove Surfpoint’s access from the platform:

• YouTube: revoke access in your Google security settings. Surfpoint stops importing once the revocation is detected and deletes that account’s imported data within 30 days.
• Instagram: remove Surfpoint from your account’s apps and websites settings. This ends the connection and deletes its imported data; a status page confirms progress.
• TikTok: remove Surfpoint from your account’s app permissions. This ends the connection and deletes its imported data.

Imported information is refreshed regularly; anything not refreshed within 30 days is deleted automatically. To request deletion of imported data by email, contact playnicebeats@gmail.com. We will complete verified requests within 7 days.

Third-party videos and platform services

Surfpoint uses YouTube API Services. See the Google Privacy Policy, Instagram Privacy Policy, and TikTok Privacy Policy for how those platforms handle your information.

Surfpoint displays third-party media, including YouTube embedded videos. Loading thumbnails or playing embedded media sends requests to the provider, which may collect device information, set cookies, or serve content and advertising under its own policies.

Cookies and browser storage

We use essential cookies to keep you signed in and remember approval to enter the private preview. Preview approval lasts up to one year unless you clear cookies or we change the access settings. Signing out of your workspace does not clear that preview approval. Clearing browser storage may require you to enter the preview password and sign in again. We do not use analytics or advertising cookies. Third-party media providers may use their own cookies and similar technologies.

Retention, security, and your choices

We retain account and workspace information while your account or workspace is active, to provide the service and maintain review history. Imported platform data follows the shorter limits above. Deleted information may remain in restricted backups until they expire.

You can delete your account yourself from Account details. This deletes your profile and sign-in, the workspaces only you belong to with everything in them (including uploaded videos), and the social accounts you connected, with their imported data. Surfpoint asks each platform to revoke its access. In workspaces you share, you are removed and your team keeps its projects and notes without your name. If you are the only Admin of a workspace other people use, another member must become an Admin first.

You can also ask to access, correct, or delete your personal information or request closure of your account by emailing playnicebeats@gmail.com. We may verify your identity and workspace authority before acting. Some team records may need to be retained for other members, security, or legal obligations. A Surfpoint data request does not remove posts from a third-party platform.

We use access controls, encrypted connection credentials and private media storage to protect information. No online service can guarantee complete security. Keep your credentials private and contact us if you suspect unauthorized access.

Children and policy updates

Surfpoint is intended for adult professional teams, not children. Do not submit children’s personal information. We may update this policy as the service changes and will update the date above. Material changes to data use will be communicated before they take effect where required.

Read our Terms of Use for the rules that apply to the service.