Privacy Policy

1. Scope and responsible service

This Privacy Policy applies to Short Sync’s website, mobile web application, account connection flows, publishing tools, Stats, posting streaks, leaderboard, public bio pages, account administration, and support interactions. It does not govern the independent privacy practices of social platforms or service providers when they act for their own purposes.

For privacy questions or requests, contact gab3mendoza@gmail.com.

2. Information collected

• Account information: name, email address, profile picture, account identifiers, authentication status, verification status, sign in timestamps, and legal acceptance records. Clerk handles passwords and authentication credentials. Short Sync does not store your plaintext password.
• Public bio and leaderboard information: your chosen public address, bio, theme, connected social links, optional buttons, display name, profile picture, posting streak, and active posting day counts. Public bio information is available without an account when you publish the page. Leaderboard information is visible to signed in Short Sync users while leaderboard visibility is enabled in Preferences.
• Connected account information: platform, public profile or Page identifiers, handle, display name, avatar, connection status, capabilities, and provider connection identifiers. Composio holds Instagram and Facebook authorization tokens. Zernio holds TikTok and YouTube authorization tokens. For user owned Zernio accounts, Short Sync stores the submitted Zernio API key in encrypted form.
• Content and publishing information: uploaded video, caption, selected destinations, publishing settings, first frame thumbnail, public post URL, platform post identifiers, status, provider responses, retry history, and safe error details.
• Stats and consistency information: metrics made available by connected platforms, such as views, likes, reactions, comments, shares, saves, and watch time, plus publishing dates, timezone based streak values, active posting day totals, and leaderboard rank. Platform metrics are refreshed when a user asks for them and are not continuously polled in the background. Leaderboard results may be cached for up to five minutes.
• Technical and security information: request metadata, timestamps, security events, session information, provider callback state, browser session state used to avoid unnecessary requests, and diagnostic logs generated by hosting, authentication, database, and connection providers.
• Support information: messages and information you choose to send when requesting help, access, correction, or deletion.

3. Sources of information

Information comes directly from you, from your browser and device, from Clerk during authentication, from the providers you authorize through Composio or Zernio, from the selected social platforms, and from infrastructure providers operating the service.

4. How and why information is used

• Create and secure your account, verify your email, and record legal acceptance.
• Save your display name, profile picture, timezone, and publishing preferences.
• Connect only the social accounts and Pages you authorize.
• Upload, validate, publish, retry, track, open, and where supported delete selected posts.
• Create and display a lightweight first frame thumbnail without retaining the playable video in post history.
• Retrieve and display requested platform Stats.
• Calculate timezone based posting streaks and, while visibility is enabled, rank consistency among signed in users.
• Publish and route visitors to the public bio page and links you configure.
• Prevent duplicate authorization attempts, abuse, fraud, unauthorized access, and excessive provider usage.
• Allow a restricted administrator to support accounts, review basic account status, and permanently remove an account when authorized or reasonably necessary.
• Diagnose failures, maintain the service, enforce the Terms, comply with law, and respond to support or rights requests.

Where a law requires a legal basis, Short Sync processes information as needed to perform the service you request, based on consent when consent is requested, for legitimate interests such as securing and maintaining the service when those interests are not overridden by your rights, and to comply with legal obligations. You may withdraw consent by disconnecting a provider, unpublishing a bio page, disabling leaderboard visibility, or contacting us, but withdrawal does not affect earlier lawful processing or prevent processing supported by another legal basis.

Short Sync does not sell personal information, use it for cross context behavioral advertising, or train artificial intelligence models on uploaded videos.

5. Visibility of content, bio pages, and leaderboard

When you select a destination and submit a post, you instruct Short Sync to transmit the video, caption, and necessary settings to that platform for public publication. The resulting post, profile information, and engagement may be visible to the public under the platform’s rules.

When you publish a Short Sync bio page, its address, name, photo, bio, social links, and buttons can be viewed without an account. Email addresses and phone numbers added as buttons are therefore public. You can unpublish or edit the page in Settings. Short Sync cannot control copies, embeds, shares, downloads, search indexing, or retention by other people or platforms after publication.

Leaderboard visibility is enabled by default. While it is enabled, your display name, profile picture, current streak, and active posting day totals are visible to signed in Short Sync users. You can disable this sharing in Preferences. Your personal post captions, destination links, and platform Stats are not included in the leaderboard.

6. Service providers, disclosures, and transfers

Short Sync discloses information only as needed to operate the service, follow your instructions, protect rights and security, complete a business transfer, or comply with lawful process. Current provider categories include:

• Clerk: authentication, sessions, email verification, and legal acceptance.
• Vercel and Vercel Blob: application hosting, server functions, delivery, logs, and temporary video and thumbnail storage.
• Neon: PostgreSQL database hosting.
• Composio: user isolated Instagram and Facebook OAuth connections and API actions.
• Zernio: TikTok and YouTube connections and API actions.
• TikTok, YouTube and Google, Instagram and Meta, and Facebook: the destination platforms you direct Short Sync to connect with, publish to, retrieve metrics from, or delete from.

These providers may process information in the United States and other jurisdictions and maintain their own terms and privacy notices. Where applicable law requires a transfer mechanism, Short Sync relies on provider contractual commitments or other legally recognized safeguards. Privacy protections and government access rules may differ outside your location.

7. Retention

• Full uploaded videos: deleted after all selected destinations finish successfully where deletion succeeds, and otherwise scheduled to expire no later than seven days after upload with later retry if storage deletion temporarily fails.
• First frame thumbnails: retained with the Short Sync post record so you can identify the post, then deleted when that record or account is deleted, subject to backup and provider deletion timing.
• Profile pictures and public bio content: retained until replaced, removed, unpublished where applicable, or the account is deleted, subject to backup and storage provider deletion timing.
• Captions, destination IDs, public URLs, statuses, Stats, publishing dates, and event history: retained until you delete the Short Sync post record or your account, unless longer retention is reasonably needed for security, disputes, or legal obligations. Streaks and leaderboard positions are calculated from retained publishing dates and may remain in a short cache for up to five minutes after a preference or record changes.
• Authorization state records: expire after approximately ten minutes and expired records are removed through scheduled cleanup.
• Provider connections and encrypted credentials: retained until disconnected, replaced, revoked, or the account is deleted.
• Authentication, security, and infrastructure logs: retained according to the applicable provider’s operational and security retention settings.

8. Security

Short Sync uses encrypted transport, provider hosted OAuth, encrypted user owned API credentials, separate user scoped database access, and forced row level security. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. You should use a unique password, protect your email account, limit provider permissions, and disconnect access you no longer need.

9. Your choices and privacy rights

You can change your profile, unpublish or edit your bio page, disable leaderboard visibility, disconnect providers, delete individual Short Sync post records, and remove supported destination posts from the post history interface. Some platform posts require deletion in the platform itself. To request access, correction, a portable copy, or complete account deletion, email gab3mendoza@gmail.com from the address associated with your account. Identity verification may be required.

Depending on where you live, you may have rights to know, access, correct, delete, restrict, object, or appeal, and to receive equal service without unlawful discrimination. An authorized agent may submit a request where local law permits, but proof of authority and direct identity confirmation may be required. We will respond within the period required by applicable law and explain any available appeal process if a request is denied. You may also complain to the privacy or data protection authority where you live where applicable law provides that right.

For California notice at collection purposes, the categories collected are the identifiers, account credentials, internet or network activity, user content, public social profile information, engagement and consistency data, and support information described above. They are collected from the sources in Section 3, used for the purposes in Section 4, disclosed to the recipients in Section 6, and retained as described in Section 7. Credentials and connection secrets are used only to provide and secure the requested service, not to infer characteristics. Short Sync does not sell personal information or share it for cross context behavioral advertising, so there is no sale or targeted advertising opt out to exercise for current practices.

10. Cookies and browser signals

Short Sync and Clerk use cookies or similar browser storage needed for authentication, security, routing, and session continuity. Short Sync does not currently use advertising cookies. Because there is no sale or targeted advertising, Short Sync does not respond differently to Global Privacy Control or Do Not Track signals at this time.

11. Children

Short Sync is intended for adults and is not directed to children under 13. Account creation is limited by the Terms to people at least 18 years old. If you believe a child provided personal information, contact us so it can be investigated and deleted.

12. Changes

We may update this policy when data practices, providers, features, or legal requirements change. The effective date above identifies the current version. Material changes will be presented in the service or otherwise communicated when required, and renewed consent will be requested where applicable.