Privacy Policy

Last updated: May 1, 2026

Postcast ("we," "us," or "our") operates the Postcast web application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Your first and last name
• Your email address
• A password (stored in hashed form; we never store plaintext passwords)

1.2 YouTube Data

If you choose to connect your YouTube account, we access the following data through the YouTube API Services:

• Channel information: your channel name, channel ID, and channel thumbnail image
• Video metadata: titles, descriptions, thumbnails, durations, and publication dates of videos on your channel
• Video captions/transcripts: subtitle and caption data associated with your videos

We access this data in read-only mode. We do not modify, upload, delete, or otherwise change any content on your YouTube channel. We request only the youtube.readonly scope.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1.3 Vimeo Data

If you choose to connect your Vimeo account, we access the following data through the Vimeo API:

• Account information: your Vimeo display name, user ID, and profile avatar
• Video metadata: titles, descriptions, thumbnails, durations, and publication dates
• Video files and captions: video file references and caption/transcript data

We access this data in read-only mode. We do not modify, upload, delete, or otherwise change any content on your Vimeo account.

1.4 Generated Content

When you submit a video for processing, we use artificial intelligence services to generate summaries, highlights, clip suggestions, and other derivative content ("Casts") based on the transcript data. This generated content is stored in association with your account.

1.5 Automatically Collected Information

When you use the Service, we may automatically collect:

• Log data (IP address, browser type, pages visited, time of visit)
• Cookies necessary for session management and authentication

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Retrieve and display your YouTube and Vimeo video libraries
• Fetch transcripts and captions from your videos
• Generate AI-powered summaries, highlights, and clip suggestions
• Generate podcast RSS feeds from your content
• Send transactional emails (account confirmation, password resets)
• Respond to customer support requests
• Monitor and analyze usage to improve the Service

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in these limited circumstances:

• Third-party service providers: We use third-party services to operate the Service (e.g., cloud hosting, email delivery, AI processing). These providers access your data only to perform tasks on our behalf and are obligated to protect it.
• Legal requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not use YouTube or Vimeo data for advertising, profiling, or any purpose unrelated to providing the Service to you.

4. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of sensitive credentials (OAuth tokens) at rest using Rails encrypted attributes
• Encryption of data in transit using TLS/SSL
• Hashed passwords using bcrypt with a cost factor of 12
• CSRF protection on all state-changing requests
• Secure, HTTP-only session cookies
• Rate limiting on authentication endpoints
• Account lockout after repeated failed sign-in attempts

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account:

• Your account data, videos, casts, transcripts, and all associated content are permanently deleted
• Your connected YouTube and Vimeo OAuth tokens are revoked and deleted
• Deletion is performed promptly and is irreversible

6. Your Rights and Choices

6.1 Access and Portability

You can access your account data at any time by signing in to the Service.

6.2 Correction

You can update your name, email, and password from your account settings page.

6.3 Deletion

You can delete your account at any time from your account settings page. This permanently deletes all your data, including all casts, transcripts, and connected platform accounts.

6.4 Revoking Third-Party Access

You can disconnect your YouTube or Vimeo account at any time from the dashboard. You can also revoke access directly:

• YouTube/Google: Visit your Google Account Permissions page and remove Postcast.
• Vimeo: Visit your Vimeo Connected Apps page and remove Postcast.

6.5 European Users (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to access, rectify, erase, restrict processing, and data portability. To exercise these rights, contact us at the email below.

6.6 California Users (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at the email below.

7. Google API Services — Limited Use Disclosure

Postcast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use YouTube data to provide and improve the Service for you
• We do not transfer YouTube data to third parties except as necessary to provide the Service
• We do not use YouTube data for advertising or to build advertising profiles
• We do not allow humans to read your YouTube data except with your explicit consent, for security purposes, to comply with law, or as aggregated/anonymized data

8. Cookies

We use strictly necessary cookies for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: support@postcast.org