Privacy Policy

At AutoShort.org ("we," "us," or "our"), we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our AI video generation platform.

1. Information We Collect

2. How We Use Your Information

We use your information to:

• Provide and improve our AI video generation service
• Process your payments and manage subscriptions
• Send important service updates and notifications
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve our platform
• Prevent fraud and ensure platform security
• Comply with legal obligations

3. Third-Party Services

We use the following third-party services:

• Payment providers and merchants of record - Whop for web purchases, and Apple or Google for in-app purchases; the responsible provider is identified at checkout and on your receipt
• Whop - Checkout for applicable web purchases, and a pixel that measures visits and checkouts on our site
• PostHog - Product analytics, diagnostics, and session recording
• Google Analytics and Ahrefs Analytics - Website traffic and search-performance measurement
• Microsoft Clarity - Session diagnostics when this optional integration is enabled
• VPS Hosting - Infrastructure hosting
• VPS Storage - Video and asset storage
• ElevenLabs - AI voiceover generation
• OpenAI - Script generation and content moderation
• Pexels - Stock video content
• Creatomate - Video rendering for applicable generation workflows
• Google OAuth - Account authentication when you choose Google sign-in
• YouTube Data API - Video upload integration (if connected)
• TikTok Content Posting API - Video upload integration (if connected)

Each service has its own privacy policy governing their data collection and usage.

3.1 YouTube Data & Google API Limited Use

If you choose to connect a YouTube channel, AutoShort accesses Google user data only through these scopes, solely to provide features you request: the youtube.readonly scope to list your channel(s) and basic channel details so you can pick where to publish, and the youtube.upload scope to publish the videos you create, on your behalf, to the channel you choose.

Who we share this data with: We do not sell or rent your Google or YouTube user data, we do not use it for advertising, and we do not use it to train AI or ML models. The only parties that ever hold it are:

• Google / YouTube - the video you choose to publish is uploaded back to YouTube, under your own account.
• DigitalOcean - our hosting provider. Your connection record and access tokens are stored in our database on servers we operate there.
• Bugsly - our own error-tracking service, which we run ourselves. If a publish fails it may record the error and the channel id so we can fix it. It does not receive your access tokens or video content.
• upload-post.com - only if you choose "Connect for public auto-post". That option is a separate, clearly labelled connection that authorises upload-post.com to publish to your channel on your behalf; it is not used by the normal YouTube connection. If you never choose it, this provider receives nothing.

No one else receives it. We disclose it beyond the parties above only with your explicit consent or where the law requires it. You can disconnect the channel at any time, which deletes the stored tokens.

Limited Use: AutoShort's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access anytime in the app or at myaccount.google.com/permissions.

3.2 Facebook, Instagram and Threads (Meta) Data

You can connect a Facebook Page, an Instagram professional account and a Threads profile to AutoShort so that we publish videos you made in AutoShort to that account. Connecting is optional, you start it yourself with the Connect button in Settings, and you approve the permissions on Meta's own consent screen. The buttons are shown only to accounts that have been enabled for this feature.

Permissions we request, and what each is used for:

• pages_show_list: list the Pages you share with AutoShort so you can pick the one to publish to.
• pages_manage_posts: publish the video you chose as a Reel on that Page.
• pages_read_engagement: required by Meta together with pages_manage_posts to read the Page's ID, name and Page access token. We do not read or store posts, comments, followers, reactions or insights.
• instagram_business_basic: read the account's ID and username, to show "Connected as @username" and publish to the right account.
• instagram_business_content_publish: publish the video you chose as a Reel on that account.
• threads_basic: read the profile ID and username, and the status and link of the post we created.
• threads_content_publish: publish the video you chose as a post on that profile.

What we store:

• The ID and name (Page) or username (Instagram, Threads) of the one account you connected. For Facebook, only the Page you select is stored; the list of your other Pages is not kept.
• An access token for that account, encrypted before it is saved and never returned by any AutoShort API response. Instagram and Threads tokens last 60 days and are renewed automatically while the connection is active; a Page token does not expire.
• For each publish: the video, the platform, the caption you approved, the status and the link to the post.

What we do and do not do:

• We publish only a video you selected, to the account you connected, with the caption you saw. Captions get the hashtag #AIGenerated, and Instagram posts are flagged as AI-generated, because the videos are made with AI.
• Nothing is posted unless you click Publish, or you switched on auto-post for a Series you created (you can switch it off at any time). We publish at most 25 posts per day to a Page, 25 to an Instagram account and 50 to a Threads profile.
• We do not read your private messages, comments, followers or insights, and we do not post to any account other than the one you connected.
• We do not sell this data, use it for advertising, or use it to train AI or ML models. It is stored only in our own database at our hosting provider and is shared with no one except Meta, to carry out the requests above.

Disconnect: in AutoShort, open Dashboard → Settings and click Disconnect next to the account. The stored token is deleted immediately and publishes still waiting in the queue for that account are cancelled. To also revoke AutoShort's permission at Meta, remove it as described below.

You can remove AutoShort from Facebook (Settings & privacy → Settings → Apps and Websites), Instagram (Settings and activity → Website permissions → Apps and websites) or Threads (Settings → Account → Website permissions) at any time. How to have any Meta data deleted is explained on our Data Deletion page.

3.3 AI Assistants You Connect (MCP)

You can connect AutoShort to an AI assistant such as ChatGPT, Claude or DeepSeek Harness through our MCP server (https://autoshort.org/api/mcp). Connecting is optional. You approve it on an AutoShort consent screen (OAuth) or by giving the assistant an API key you created. Either way, AutoShort creates or uses an API key on your account, which appears in Dashboard → API keys.

What the assistant can do: create videos on your account (this spends your credits, at the same prices as the web app), and read your videos and their status, your credit balance, your API usage and your plan.

What we receive: only what the assistant sends in its requests to us, such as a topic, a script or a product URL you asked it to use. We do not receive the rest of your conversation with the assistant. We process these requests the same way as requests you make in the AutoShort web app.

What the assistant receives: the results of the requests it makes, for example video titles, scripts, status, video URLs and your credit balance. The assistant's provider (for example OpenAI, Anthropic or DeepSeek) handles that data under its own privacy policy.

You can disconnect an assistant at any time by revoking its key in Dashboard → API keys. Requests using a revoked key are refused.

3.4 Browser Extension (AutoShort for YouTube)

The AutoShort for YouTube extension reads the YouTube page you are viewing (title, view and like counts, upload date, channel size, tags, and the first lines of the transcript when available) to show outlier score, views per day and title and hook checks on your screen. This calculation happens in your browser.

When data leaves your browser: only when you press Analyze or Save. The extension then sends that video's details to autoshort.org, together with your AutoShort API key. It does not send your browsing history, and it does not read pages outside youtube.com.

Storage: your settings and API key stay in the extension's local browser storage. Videos you save are kept on our servers for 30 days and then deleted; you can remove them earlier. We do not sell this data, and we use it only to provide the extension features and to enforce usage limits. Uninstalling the extension removes the local storage.

Image to Video: images you upload

Safety check first. To prevent deepfakes and unlawful content, every image you submit to Image to Video is checked automatically before anything is charged. For that check we send the image to OpenAI (vision and moderation models) and to Google (Gemini). Photos of realistic people, sexual content and images that may show a child are rejected.

Video generation. Only an image that passes the check is sent to OpenRouter, which runs ByteDance's Seedance model to make the clip. The clip is returned to us and stored in your account.

Your image is not kept. We delete the image from our servers when the clip is finished or fails.

Moderation log. For every image we check, we keep a log entry for 90 days: your account ID, the time, a SHA-256 fingerprint of the processed image (not the image itself) and the safety verdicts. We use it to investigate abuse and to answer platform and payment-provider compliance requests. If you delete your account, we delete your log entries with it.

Third parties. OpenAI, Google, OpenRouter and ByteDance handle the data under their own privacy and retention policies, which differ from each other and from ours; we do not control how long they keep it.

4. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Secure database with access controls
• Regular security audits and updates
• Encrypted storage for sensitive information
• Limited employee access to personal data

Your data is stored on servers we rent from DigitalOcean in Singapore.

5. Your Rights

You have the right to:

• Access - Request a copy of your personal data
• Correction - Update or correct inaccurate information
• Deletion - Request deletion of your account and data
• Export - Download your videos and content
• Object - Opt-out of marketing communications
• Portability - Transfer your data to another service

To exercise these rights, contact us at privacy@autoshort.org. Step-by-step deletion instructions, including for data from connected platforms, are on our Data Deletion page.

6. Data Retention

We practice data minimization and only keep your data as long as necessary:

• Account data: Until you delete your account
• Generated videos: Until you delete them or close your account
• Payment records: Only as long as required by law

When you delete your account, your account data, videos and connected-account tokens are deleted as described on our Data Deletion page, which also lists the few records we must keep (such as transaction records required by law).

7. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your session and keep you logged in
• Remember your preferences and settings
• Analyze platform usage and performance
• Prevent fraud and enhance security

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

8. Children's Privacy

AutoShort is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including Singapore, where our servers are, and the United States, where several of the providers listed above process data. We ensure appropriate safeguards are in place to protect your data in compliance with applicable laws.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Continued use of AutoShort after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this privacy policy or our data practices, please contact us: