Privacy Policy

Last updated 28 September 2026

CreaterOS ("we", "us") schedules and publishes your content to Instagram from your Google Drive, and can write captions and pick music with AI. This policy explains what data we handle, why, and the choices you have. Questions: sweharshgautam@gmail.com.

What we collect

• Your CreaterOS account: email address, optional name, a salted hash of your password (never the password itself), your timezone, and sign-in sessions.
• Connected Instagram accounts: username, account IDs, account type, profile picture link, and the access tokens that let us publish for you. Tokens are encrypted at rest (AES-256-GCM).
• Google Drive (if you connect it): your Google account email and an encrypted refresh token. We only read the folders you choose, download the files being published, and move posted files to your "published" folder. Downloaded media is deleted from our servers within minutes of publishing.
• Publishing data: your schedules and settings, your caption prompt ("caption voice"), captions and alt text we generate or read, links to published posts, run logs and notifications.
• Technical data: IP address and browser type for sign-in sessions and security, and server logs (with tokens and secrets removed).

How we use it

Only to provide the service you asked for: publishing your content on your schedule, writing captions and alt text, choosing music for Reels, keeping you informed about runs, and keeping the service secure. We do not sell your data, use it for advertising, or share it except as described below.

AI processing

To write captions and alt text and to choose music, the image or video frame being published and its caption are sent to Google's Gemini API. We use Google's paid API, under which Google does not use this content to improve its products. Your caption prompt is only used for your own accounts.

Google user data

CreaterOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Drive data only to publish the content you choose, do not use it for advertising, do not transfer it to others except as needed to provide the service or as required by law, and do not use it to train AI models.

Who we share data with

Service providers that process data on our behalf to run CreaterOS:

• Meta (Instagram): to publish your posts.
• Google (Drive, Gemini API): to read your content and generate captions, alt text and music choices.
• Railway: our hosting provider, where the service and its database run.

Background music comes from openly licensed (CC0) libraries such as Freesound via Openverse; no personal data is sent to them. We may disclose data if required by law.

Security

Connections are encrypted with HTTPS. Access tokens are encrypted at rest, passwords are hashed with scrypt, sessions use secure, http-only cookies, and access to your accounts is limited to you.

How long we keep data

• Run logs and notifications: 90 days.
• Media downloaded for publishing: deleted within minutes.
• Disconnecting an Instagram account deletes its access tokens immediately; its post history is kept so you can reconnect later, until you delete it.
• Everything else: until you delete it or delete your CreaterOS account.

Your choices and deleting your data

• Delete one Instagram account's data: open the account → Connections → "Delete all data".
• Delete your whole CreaterOS account: Settings → "Delete my account". This permanently removes your account, connected accounts, settings, history and logs, and revokes our Google Drive access.
• Remove access from the platforms: you can remove CreaterOS in Instagram (Settings → Website permissions / Apps and websites) or at Google account permissions. When you remove it from Instagram, Meta notifies us and we delete the related tokens; a data-deletion request made through Meta deletes the related data and gives you a confirmation code.
• You can also email us to access, correct or delete your data.

Children

CreaterOS is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We will update this page when our practices change and, for significant changes, tell you in the app.