Pickin Privacy Policy

Account data. When you create an account we collect your email address and the account identifier issued by our authentication provider. We do not collect or store your password: authentication is handled by our provider.

Content you submit. This includes the video URLs you submit, the video files you upload, and any brand logo or audio track you add. It also includes everything the Service derives from that material: transcripts, generated clips, thumbnails, captions and clip metadata such as titles, hooks and suggested hashtags.

Usage data. Processing job records (status, progress, timestamps, source duration, error messages) and your credit ledger, so we can run the Service, meter usage and diagnose failures.

Referral and fraud-prevention data. To check that nobody refers themselves through the referral and partner programme, we record, for each account, a keyed hash of the IP address it is used from, of that address's network, and of a random identifier that the Pickin web app creates and keeps in your browser. We keep only these hashes, never the address or the identifier in clear: they let us tell that two accounts were used from the same browser, address or network, and nothing else. When we review a partner's payout, we also compare the fingerprints that our payment processor, Stripe, gives the cards that paid (an identifier, not the card number); they are not stored.

Connected platform data. If you choose to connect a third-party account such as TikTok, a YouTube channel or an Instagram professional account, we receive and store the information described in sections 4 to 6.

Technical data. Server logs containing IP address, request time, and user agent, retained for security and troubleshooting.

• To provide the Service — downloading or receiving your source video, transcribing it, selecting highlights, rendering clips, and publishing to a platform at your request. Legal basis: performance of a contract.
• To prevent referral fraud: the hashes described in section 1 are compared between a referred account and the account that referred it. A referred account used from the same browser or IP address as its referrer receives no referral credits, and a partner's payout request is reviewed with these signals before any money is paid. Legal basis: our legitimate interest in preventing fraud.
• To manage your account and credits — authentication, usage metering, and support. Legal basis: performance of a contract.
• To keep the Service secure and reliable — abuse prevention, rate limiting, error diagnosis, and protecting our infrastructure. Legal basis: our legitimate interests.
• To comply with legal obligations — responding to lawful requests and keeping records we are required to keep. Legal basis: legal obligation.

We do not sell your personal data, we do not use it for advertising, and we do not use your content to train our own artificial-intelligence models.

Transcription uses a speech-recognition provider. To turn what is said into text, the audio track of your source video, and not the picture, is sent to Groq, which runs the Whisper speech-recognition model and returns the transcript. If Groq is unavailable, transcription runs on our own servers instead.

Highlight selection uses a third-party language model. To choose which moments become clips, the text of the transcript, and not the video or audio itself, is sent to our language-model provider (Anthropic, and where configured DeepSeek). Under the API terms of these providers, content submitted through the API is processed only to return the requested result and is not used to train their models.

Framing and captioning happen on our servers. Face detection, reframing and caption rendering run locally on our infrastructure.

Connecting a TikTok account is entirely optional and always initiated by you through an explicit authorisation flow on TikTok. If you never connect an account, none of the processing in this section takes place.

What we receive from TikTok. When you authorise the connection, TikTok provides us with an access token and a refresh token, your TikTok user identifier (open ID), the permissions you granted, and your display name and username, used only to show you which account is connected.

What we send to TikTok. Only when you explicitly choose to publish a specific clip do we send that video file to TikTok, together with the post settings you selected in the application, such as the title and the privacy level. Before each direct post we also query TikTok for your current creator settings, such as the privacy options available to your account, so the application can present valid choices.

How your tokens are protected. TikTok access and refresh tokens are encrypted at rest using authenticated symmetric encryption with a key that is held separately from the database. They are decrypted only in memory, at the moment an authorised request is made on your behalf. They are never written to logs, never exposed through our interface or API, and never shared with any third party.

How to disconnect. You can disconnect your TikTok account at any time from the Connected accounts panel in the application. When you do, we ask TikTok to revoke the token and we delete the stored credentials and profile information from our systems. You can also revoke access directly from the security settings of your TikTok account.

Our use of information received from TikTok complies with the TikTok Developer Terms of Service and applicable TikTok developer policies. We use this information solely to provide the publishing features you request, and for no other purpose.

Pickin uses YouTube API Services to let you upload your clips to your YouTube channel as Shorts. Connecting a channel is optional and always initiated by you on Google's authorisation screen. By using Pickin's YouTube features, you agree to be bound by the YouTube Terms of Service, and Google's processing of your data is governed by the Google Privacy Policy.

What we access and store. Pickin asks Google for two permissions: to upload videos to your channel, and to read your channel's basic details. When you connect a channel, we receive and store an access token and a refresh token, your channel's identifier, and its name and handle, which we use only to show you which channel your videos will go to. After an upload, we store the identifier YouTube gives the video, so the application can link you to it. We do not read your existing videos, playlists, comments, subscribers or analytics.

What we send to YouTube. Only when you choose to upload a specific clip, from its Post tab or by scheduling it in the calendar, do we send that video file to YouTube, at the time you chose, together with the title, description, visibility and audience setting (made for kids or not) that you set in the application, exactly as you entered them.

How it is used and shared. Information received from YouTube API Services is used only to provide the upload feature you request. It is not sold, not used for advertising, and not shared with any other party. YouTube tokens are encrypted at rest in the same way as the TikTok tokens described in section 4. Pickin does not place cookies or similar technologies on your device to access YouTube data; the only cookies we use are described in section 12.

How to revoke access. You can disconnect your channel at any time from the Accounts page in the application: we then ask Google to revoke Pickin's access and delete the stored credentials and channel details. You can also revoke Pickin's access directly from your Google Account, on the Google security settings page. Once access is revoked, Pickin can no longer upload to your channel.

How long we keep it, and when we delete it. Once a day, Pickin checks with Google that you still authorise it and reads your channel's name and handle again, so what we hold is never more than a day old. When you disconnect your channel in Pickin, we delete its credentials, name, handle and the identifiers of the videos we uploaded immediately. If you revoke Pickin's access from your Google Account, we detect it at that daily check and delete the same data then, and in any case within 30 days. The identifier of each uploaded video is deleted 30 days after the upload. You can also ask us to delete this data at any time by writing to privacy@pickin.io; we do so within 7 days.

Pickin uses the Instagram API with Instagram Login, provided by Meta Platforms, to let you publish your clips to your Instagram professional account as Reels and, if you choose, to show their statistics. Connecting an account is optional and always initiated by you on Instagram's own authorisation screen, where you see the permissions Pickin asks for. If you never connect an account, none of the processing in this section takes place.

What we receive and store. When you connect an account, Instagram gives us an access token, which we exchange for one valid for 60 days and renew while the account stays connected; your Instagram account identifier and the identifier Instagram assigns you for Pickin; your username, which we use only to show you which account your Reels will go to; and the permissions you granted. After a publication, we store the identifier Instagram gives the Reel. We do not read your direct messages, your comments, your followers or your other accounts.

Statistics. When you refresh your statistics in the application, Pickin reads the 20 most recent videos of the account: their identifier, caption, link, thumbnail, publication date, and numbers of likes and comments. Only if you enable statistics for the account, which asks Instagram for a separate permission, Pickin also reads their views and shares. We keep the latest reading and a daily total for up to 90 days, to show you how your videos perform over time.

What we send to Instagram. Only when you choose to publish a specific clip, at the time you chose, we give Instagram a temporary link to that video file together with the caption and hashtags you set. Instagram downloads the video from that link and publishes it on your account. Instagram tokens are encrypted at rest in the same way as the TikTok tokens described in section 4.

How to disconnect, and when we delete the data. You can disconnect your account at any time from the Accounts page in the application, or remove Pickin from the Apps and websites section of your Instagram settings, in which case Meta notifies us. Either way, we immediately delete the access token, the account details and the statistics, and remove the username and Reel identifiers from your publications. The Reels already published stay on your account until you delete them on Instagram.

How to ask for deletion. You can ask Meta to have Pickin delete your data from your Instagram settings: we delete it as soon as Meta tells us and give you a confirmation code and a page showing the status of your request. You can also write to privacy@pickin.io; we do so within 7 days.

Our use of information received from Instagram complies with the Meta Platform Terms and Developer Policies. We use it solely to provide the publishing and statistics features you request: we do not sell it, use it for advertising, or share it with any other party.

We share personal data only with the service providers needed to operate the Service, and only to the extent necessary:

• Clerk — user authentication and session management (email address, account identifiers).
• Groq — transcription of the audio track of your source videos, as described in section 3.
• Anthropic, and DeepSeek where configured — highlight selection from transcript text.
• TikTok — only if you connect an account, and only as described in section 4.
• Google (YouTube) — only if you connect a channel, and only as described in section 5.
• Meta (Instagram) — only if you connect an Instagram professional account, and only as described in section 6.
• Stripe — payment processing when you buy credits or a plan (we never see or store your card details).
• Hetzner — hosting of the servers and storage on which the Service runs.
• Our email hosting provider — sending the emails the Service sends you, such as notices about your videos.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety and property of our users or of ourselves. If our business is transferred, data may be transferred as part of that transaction, subject to this Policy.

Your videos, clips, transcripts and account records are stored on servers located in Germany, within the European Union. Some of the providers listed in section 7 are established outside the European Economic Area. Where personal data is transferred outside the EEA, that transfer is governed by an appropriate safeguard, such as the European Commission Standard Contractual Clauses or an adequacy decision.

• Account data is kept for as long as your account exists.
• Uploaded source videos are retained while your account is active, because they are the only copy available for re-rendering an existing clip with different settings.
• Generated clips, transcripts and job records are kept for as long as your account exists, so they remain available in your workspace.
• Connected platform credentials and profile details are kept until you disconnect the account or delete your account; for YouTube and Instagram, see the shorter limits in sections 5 and 6.
• Server logs are kept for a limited period for security and troubleshooting.
• Referral fraud-prevention hashes (section 1) are kept for 24 months after the account was last used from that browser, address or network, the time a referral's commissions can still be paid or disputed, then deleted automatically.

When you delete your account, or when you ask us to delete specific content, we remove the corresponding data from our active systems. Residual copies may persist in encrypted backups for a limited period before being overwritten.

• All traffic between your browser and the Service is encrypted in transit using TLS.
• Third-party OAuth credentials are encrypted at rest, as described in sections 4 to 6.
• Access to media files is granted through short-lived signed links rather than public URLs.
• Access to production systems is restricted to the people who need it to operate the Service.

No system can be guaranteed completely secure. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority, and you where required, within the timeframes set by applicable law.

If you are in the European Economic Area or the United Kingdom, you have the right to:

• access the personal data we hold about you and obtain a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive the data you provided in a portable, machine-readable format;
• withdraw any consent you have given, without affecting processing carried out before the withdrawal.

To exercise any of these rights, contact privacy@pickin.io. We respond within one month, as required by the General Data Protection Regulation. You also have the right to lodge a complaint with your local supervisory authority, which in France is the Commission Nationale de l'Informatique et des Libertes (CNIL).

We use strictly necessary cookies only. These are session cookies set by our authentication provider to keep you signed in and to protect against request forgery. We do not use advertising cookies, and we do not use third-party tracking or analytics cookies for profiling.

The web app also keeps a few values in your browser's local storage: the referral code you arrived with (30 days), your interface preferences, and the random browser identifier described in section 1, used only to prevent referral fraud.

The Service is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Policy as the Service evolves. We will revise the "Last updated" date above and, where the change is material, provide a more prominent notice before it takes effect.

Pickin is operated by Myrio Consulting FZC-LLC, the data controller. For any question about this Policy or about how your data is handled, contact us at privacy@pickin.io. For general enquiries, use contact@pickin.io.