Privacy Policy

Haplia is operated as a software service for creators, small businesses, and agencies. For privacy requests, contact us at the email listed at the end of this policy.

Depending on how you use Haplia, we may collect:

• Account information — email address, username, authentication identifiers, and related profile metadata from our auth provider.
• Connected social accounts — platform account names/IDs, and OAuth access/refresh tokens needed to act on your behalf (publish posts, read metrics).
• Content you create in Haplia — captions, media references, schedules, and publish status for posts you manage through the service.
• Performance metrics we fetch from connected platforms when you refresh analytics (for example daily account views and follower gain, plus likes, comments, and shares on your posts), stored as a dated daily series and as snapshots associated with your posts.
• Technical and usage data — approximate device/browser information, IP address, logs, and cookies needed to keep you signed in and operate the service securely.
• Billing-related data if/when you subscribe — customer and subscription identifiers from our payment processor (we do not store full card numbers on Haplia servers).

We use personal data to:

• Provide, maintain, and improve the Haplia service.
• Connect your accounts and publish or schedule content you authorize to platforms such as Facebook, Instagram, TikTok, and YouTube.
• Retrieve and display account and post analytics you request.
• Authenticate you, secure accounts, prevent abuse, and troubleshoot errors.
• Send service-related notices (for example security or account emails).
• Understand product usage in aggregate so we can improve reliability and design.

When you choose to connect a social platform, you authorize Haplia to access data and perform actions allowed by the permissions (scopes) you grant on that platform’s consent screen.

Facebook (Meta): we may access Facebook Pages you select, and use Page tokens to publish content and read engagement and insights metrics for posts published through Haplia, subject to Meta’s policies and your granted permissions.

Instagram: we connect Instagram professional accounts (Business or Creator) in one of two ways you choose — directly via Instagram Login, or via Facebook Login through the Facebook Page the account is linked to (for example, accounts you manage in Meta Business Suite). With your permission we may publish content, read and reply to comments, and read engagement and insights metrics (for example likes, comments, views, and reach) for posts published through Haplia, subject to Meta’s and Instagram’s policies and the scopes you approve.

TikTok: we may access basic profile information needed to identify your account, publish content you authorize via TikTok’s Content Posting APIs (when enabled), and retrieve video/list metrics available through TikTok’s APIs for analytics, subject to TikTok’s Developer Terms, TikTok’s Privacy Policy, and the scopes you approve.

YouTube (Google): we may access the YouTube channel you select via Google OAuth, upload videos you authorize, and retrieve channel and video statistics available through the YouTube Data API for analytics, subject to Google’s and YouTube’s terms and the scopes you approve.

Access tokens and refresh tokens are stored encrypted at rest. We use them only to provide the features you request and do not sell them.

Your use of each platform remains subject to that platform’s own terms and privacy policy. You can disconnect accounts in Haplia and/or revoke access in the platform’s security settings.

This section describes how Haplia accesses, uses, stores and shares data we receive from Google. We access it only after you grant permission on Google’s consent screen, and only the data needed for the features below:

• If you sign in with Google: your name, email address and profile picture, used to create and identify your Haplia account.
• If you connect a YouTube channel: the channel’s ID, name and profile picture; the videos you publish through Haplia and their titles, descriptions and settings; the channel’s subscriber count; channel and video statistics and YouTube Analytics reports (such as views, watch time and subscribers gained); your playlists, so you can choose where a video goes; and the OAuth access and refresh tokens that let Haplia act on your behalf.

We use this data only to provide features you can see and request in Haplia: publishing and scheduling the videos you choose, adding them to the playlists you pick, setting the thumbnails you upload, and showing your channel and video analytics.

We share, transfer or disclose Google user data only with the following parties, and only as needed to provide those features:

• YouTube (Google) — the videos, titles, descriptions, thumbnails, playlist choices and settings you choose to publish are sent to YouTube through the YouTube API Services.
• Supabase — our database and authentication provider. Stores your account, the connected channel’s ID and name, your OAuth tokens (encrypted) and the analytics we fetch for you.
• Google Cloud Storage — stores a copy of your channel’s profile picture and thumbnails of videos you published, so they display reliably in Haplia.
• Vercel — our application hosting provider. Runs the Haplia servers that process this data while serving your requests.
• Sentry — our error-monitoring provider. Receives technical error reports, which can include identifiers such as a video or playlist ID. Access and refresh tokens are removed before any report is sent.
• Authorities or other parties, where we are required to by law, or to protect the security of Haplia and its users.

We do not sell Google user data, use it for advertising, share it with data brokers or other third parties, or use it to develop, improve or train generalized artificial intelligence or machine-learning models.

Haplia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep Google user data for as long as the channel stays connected. Disconnecting a YouTube channel in Haplia immediately deletes its stored access and refresh tokens and its profile picture. You can also revoke Haplia’s access at any time in your Google Account permissions. To have all remaining data associated with your account deleted, email us at the address at the end of this policy.

Haplia uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

We use the following service providers to run Haplia: Vercel (application hosting), Supabase (database and authentication), Google Cloud Storage (media storage), Sentry (error monitoring) and, when you subscribe, Stripe (payment processing — Stripe does not receive any data from Google or your connected social accounts). They process data on our instructions and only as needed to provide their services.

We use cookies and similar storage to keep you signed in, remember language preferences, and protect OAuth flows (for example CSRF state). You can control cookies through your browser settings; disabling essential cookies may prevent login or account connection from working.

We retain account and service data for as long as your account is active and as needed to provide the service, comply with law, resolve disputes, and enforce agreements. You may request deletion of your account data by emailing office@haplia.com; some records may be retained where legally required or for legitimate security/audit purposes.

If you remove Haplia from Facebook, Instagram, or Threads, or send a Meta data deletion request, Meta notifies us via a secure callback. We then disconnect the matching accounts in Haplia, delete imported history and related analytics snapshots from that platform, and clear access tokens. You can check the status of a deletion request using the confirmation link Meta provides, or email us using the address below.

We apply technical and organizational measures appropriate to the risk, including encrypted storage of platform tokens and access controls. No method of transmission or storage is perfectly secure; please use a strong unique password and protect your connected platform accounts.

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to / restrict certain processing. To exercise these rights, contact us using the email below. You may also have the right to lodge a complaint with a supervisory authority.

Haplia is not directed to children under 16 (or the minimum age required in your country to use the connected social platforms). We do not knowingly collect personal data from children.

We may update this Privacy Policy as the product or legal requirements change. We will post the updated version on this page and revise the “Last updated” date. Material changes may also be communicated by email or in-product notice when appropriate.

For privacy questions or requests, email office@haplia.com.