Oops Studio Publisher collects no personal data from anyone. It is an internal tool that posts our own videos to our own social accounts. It has no users other than Oops Studio, no sign-up, and no analytics.
When we connect one of our own social accounts, that platform issues Publisher an access token and a refresh token through its official OAuth flow. Alongside those, Publisher reads only the minimum profile information the platform returns for the connected account — such as its username and the posting options available to it — so the tool can confirm which of our accounts it is about to post to.
That is the entire set of data Publisher handles. It requests only the scopes needed to upload and publish a video, and no others.
Tokens are stored on infrastructure we control, in a file readable only by the owning system account, and are never committed to source control. They are transmitted only to the issuing platform's own API, over HTTPS.
Tokens are kept only while the account remains connected. When we disconnect an account, or when a token is revoked or expires, the stored record is deleted. Nothing is archived.
Access for any connected account can be revoked at any time from that platform's third-party application settings. Revocation takes effect immediately and Publisher can no longer post to the account.
If what the tool accesses ever changes, this page is updated and the effective date above changes with it.