Privacy Policy

1. Who we are and what this covers

Auk turns a long video you own into short vertical clips: we download or receive your source video, transcribe it, pick highlights, crop and caption them, and, if you ask, publish the result to a social account you have connected. This policy covers auk.video and the Auk web application. It does not cover the platforms you publish to, which run under their own policies.

We are the controller of the personal information described here (under Quebec's Law 25 and the GDPR, the “controller”; under Brazil's LGPD, the “controlador”; under PIPEDA, the organisation accountable for it). Our Privacy Officer is accountable for how we handle it; contact details are in section 13.

2. Connected publishing accounts

You can connect a social account so that Auk can publish the clips you choose to it. We only connect an account when you start the connection yourself, and we only ask the platform for the permissions publishing needs. Whatever the platform, the same rules apply to what we get back:

• We store the account identity we need to show you where a clip will go (an account id, display name and avatar URL), the permissions the platform granted, and a refresh token. Refresh tokens are encrypted at rest with AES-GCM and are never shown to you, logged, or sent to your browser. We do not store access tokens, with one exception: Instagram issues no refresh token, so for Instagram we store its long-lived access token (valid about 60 days), sealed the same way. For the other platforms we exchange the refresh token for a short-lived access token at the moment of each upload and discard it.
• We publish only the clips you send, to the account you choose, when you tell us to.
• We do not read your analytics, followers, subscribers, messages, comments or any post we did not publish for you.
• We never sell platform data, never use it for advertising, never use it to train machine-learning models, and never share it with anyone except the subprocessors in section 5 that are needed to run the upload.
• Nobody at Auk reads it, unless you ask us to for support, it is needed to investigate abuse or a security incident, or the law requires it.
• Disconnecting the account in Auk asks the platform to revoke our access and then deletes the stored identity and token outright, rather than flagging them.

YouTube (YouTube API Services)

Auk uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your information is governed by the Google Privacy Policy.

When you connect a channel, we ask Google for exactly two permissions:

• youtube.upload, to upload the clips you choose to publish to your channel. We never upload anything you have not explicitly sent from Auk.
• youtube.readonly, to read your channel's id, title and avatar, so the app can show you which channel you are about to publish to, and to read back the status of a video we uploaded. We do not read your analytics, your comments, your subscribers or videos we did not upload.

From YouTube we store only: your channel id, title and avatar, so you can see where a clip will go; and, for each video Auk uploaded for you, its video id, link, upload status and privacy setting, so you can find it again. We refresh all of this from YouTube at least once a day, and never keep any of it for more than 30 days without refreshing it. At each refresh we also check that you have not revoked our access; if you have, we delete all of it within 7 days. We store no other YouTube data, and nothing about videos Auk did not upload.

You can revoke our access at any time, from inside Auk by disconnecting the channel in Settings, or directly at Google's security settings permissions page. Revoking at Google stops all access immediately.

Google user data and Limited Use

Auk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That covers both YouTube data and the name, email address and profile picture Google gives us if you sign in with Google. We use Google user data only to provide the features you see in Auk, and we do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.

TikTok

TikTok publishing is rolling out; this part applies from the moment you can connect a TikTok account. Auk uses TikTok's Login Kit and Content Posting API, and asks TikTok for:

• user.info.basic, to read your TikTok open id, display name and avatar, so the app can show you which account you are about to publish to;
• video.publish, to post the clips you choose to your account, with the caption and the audience you pick.

TikTok's handling of your information is governed by the TikTok Privacy Policy. Before anything is sent to TikTok, you see the account it will go to, choose who can see it, and confirm; we do not choose a privacy setting for you. You can revoke our access by disconnecting the account in Auk, or in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions.

Instagram and Facebook (Meta)

Instagram publishing is rolling out; this part applies from the moment you can connect an Instagram account. Auk publishes to Instagram professional (Business or Creator) accounts through Meta's Instagram API, and asks Meta for:

• instagram_business_basic, to read your Instagram account id, username and profile picture, so the app can show you which account you are about to publish to;
• instagram_business_content_publish, to publish the clips you choose to that account as Reels.

Meta's handling of your information is governed by the Meta Privacy Policy. You can revoke our access by disconnecting the account in Auk, or at Meta as described in section 8.

3. What we collect and why

Account information

Your email address, and your name and profile picture if you sign in with Google. We use this to authenticate you, to send you transactional email about your own projects, and to answer support requests. Authentication is handled by Supabase; if you sign in with a password we never see it, only the hash Supabase stores.

Content you give us

The video you upload or the link you paste, and everything derived from it: the downloaded source file, the extracted audio, the transcript, the clip candidates our model selected, the cropped clips, and the rendered MP4s. We hold this because it is the product: without it there is nothing to edit or export. Your content is yours, and we do not use it to train models.

To choose, cut and title clips, the text of the transcript and a few still frames from your video are sent to a language model through OpenRouter (section 5). We send them only to model providers that do not use them to train models. Some providers keep a request for a period set by their own terms, for example to detect abuse, run their service or meet a legal obligation.

To crop a clip around whoever is speaking, our software detects where faces are in each frame and which face is talking, and records their positions over time. It does not recognise who anyone is: it creates no face print or other biometric template, and it does not compare faces across videos or against any database. The position data is stored with the project and deleted with it. People who appear in your video are not our users, so section 5 of our Terms requires you to have their permission.

Connected publishing accounts

The account identity, granted permissions and encrypted refresh token described in section 2, for each platform you connect, and a record of what we published there for you (the post id, link and status the platform returns, refreshed as described in section 2) so you can find it again.

Your agreement to our terms

When you accept our Terms of Service and confirm that you have read this Privacy Policy, we record which document you accepted, its version (its effective date), the language you read it in, whether you accepted at signup or in the app, the time our server recorded it, and the time your browser reported you ticked the box. If you later give or withdraw consent to marketing email, we record that the same way. We keep this record to show that you agreed, as the platforms we connect to and Canadian law (including Quebec's Charter of the French language and Canada's Anti-Spam Legislation) expect. Nobody edits it, you or us: a change is a new entry, never an overwrite. We do not store your IP address or device details with it.

Billing information

Payments run through our payment provider, acting as our merchant of record. It, not Auk, collects and processes your card details; we never see or store a card number. We store its customer and subscription identifiers, your plan, your subscription status and period end, and your credit balance and its ledger.

Showcase pages

If we send you a private page showing clips made from your channel, we record each visit to it (the IP address, approximate location, network, browser and referring page), which clips you play or watch to the end, and whether you click its button, to protect it from password guessing and to know how it was received, and we keep any feedback you leave there.

Usage and device information

Standard server logs (IP address, browser user agent, request paths, timestamps) kept for security, debugging and abuse prevention, and the Google Analytics and PostHog measurement described in section 6. We also keep a record of when you used Auk and from which IP address, as section 7 describes.

How you found us

If you accept analytics cookies, we keep the link that first brought you to Auk in your browser, as section 6 describes, and when you create an account we copy its source and its campaign tag to your account: for example, that a post of ours on Reddit brought you here, or the button on a Showcase page (which names Showcases, not you). If you sign up with Google, we copy them when you first sign in. Separately, right after you sign up we may offer a short welcome survey: where you heard about Auk, what you make, and what you used before. It is optional and you can skip it; if you answer all three questions, we add the credits it names to your balance, once, and they stay yours if you later delete your answers, which you can do at any time in Settings. We keep your answers with your account. We use the link and your answers only to learn which of our posts and pages bring people to Auk and who uses it.

What you download

When you start downloading a clip, we record which rendered file it was, whether you started from the clip player or the editor, whether the file was ready or you waited for it, how long you waited, and when. We use this to see which videos are actually used, so we prepare clips ahead of time only where that saves you a wait, and to keep that cost in check. It is linked to your account through the clip. We never sell it, never share it beyond the service providers in section 5 except where the law requires us to, and never use it for advertising.

4. How we use it

• To run the pipeline you asked for: ingest, transcribe, select highlights, crop, caption, render, publish.
• To authenticate you and keep your projects separate from everyone else's.
• To meter credits, bill you and issue receipts.
• To send transactional email: your video is ready, your export failed, a password reset.
• To send product news, only if you have agreed to receive it, as Canada's Anti-Spam Legislation requires. Every such email has a working unsubscribe link, and we act on an unsubscribe within 10 business days.
• To learn which of our posts and pages bring people to Auk and who uses it, from how you found us and the welcome survey (section 3).
• To keep the service up and to investigate errors, abuse and fraud.
• To see which features and files are used, so we can improve the service and keep its costs in check: for example, how often a clip we prepared ahead of time is downloaded.
• To meet legal and tax obligations.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your video or transcripts to train machine-learning models. We do not run automated decision-making that produces a legal or similarly significant effect on you.

Where the GDPR or UK GDPR applies, our lawful bases are: performance of a contract (running the service, billing it, and publishing to the accounts you connect), legitimate interests (security, abuse prevention, keeping the access records in section 7, product reliability, and seeing how the service is used so we can improve it and keep its costs in check), consent (analytics cookies, how you found us, the welcome survey, and marketing email), and legal obligation (tax and accounting records).

Where Brazil's General Data Protection Law (LGPD) applies, our legal bases (art. 7) are: performance of a contract (running the service, billing it, and publishing to the accounts you connect), legitimate interests (security, abuse prevention, product reliability, and seeing how the service is used so we can improve it and keep its costs in check), consent (analytics cookies, how you found us, the welcome survey, and marketing email), and compliance with a legal or regulatory obligation (tax and accounting records, and the access records Brazil's Marco Civil da Internet requires). Processing your account details, the content you give us and your billing records is a condition of providing Auk: without it we cannot run the service for you. You can use the rights in section 11 at any time.

5. Who processes it, internally and externally

Internally, access is limited to the people at Hoglet Labs Inc. who need it to operate and support the service. Staff can open an account's projects only to answer a support request from that account or to investigate abuse or a security incident. When staff act as a user, we log when that starts and every change they make. Externally, we use the subprocessors below and no others. Each one is bound by its data processing terms to process data only on our instructions, and we remain responsible to you for what they do with it on our behalf. The table says where one handles something as its own: Pexels, for search terms.

When you publish, the clip and the title, description and privacy setting you gave it go to the platform you chose (YouTube, TikTok or Instagram). That platform receives it on your instruction, as an independent organisation under its own policy, not as our subprocessor.

We also disclose information when the law requires it (a valid court order, subpoena or legal process), to establish or defend a legal claim, or to protect the rights and safety of our users. If Auk is acquired or merged, your information may transfer with the business; we will tell you before it becomes subject to a different privacy policy.

No third party serves advertisements on Auk. Nobody other than the subprocessors above serves content on our pages.

6. Cookies and device-level collection

We use two kinds of browser storage, and no advertising cookies:

• Strictly necessary. Supabase stores your session token in your browser's local storage so you stay signed in. The app keeps your theme choice in a first-party cookie (auk-theme) and local storage, and keeps small UI state there too, such as a link you pasted on the homepage before signing in. A first-party cookie (auk-consent) remembers your answer to the analytics question for a year. Without these, the app cannot work.
• Analytics, only if you accept. Google Analytics is not loaded at all until you choose Accept on the cookie banner; if you choose Reject, or never answer, it never runs. Once accepted, Google Analytics 4 sets cookies to measure aggregate usage: which pages are visited, how long a session lasts, roughly where visitors are. Its handling of that data is governed by the Google Privacy Policy. If you accept, PostHog also runs, but only inside the signed-in app (your projects, clips, editor, templates, scenes, publishing and settings), never on our public pages. It records the pages you open there and the actions we chose to measure (such as starting a clip job or exporting a clip), with your browser, operating system, device type, screen size, language and time zone, linked to your account id so we can see how the product is used over time. It does not look up where you are, and it discards your IP address. It does not record your screen, what you type, the text of your transcripts or the content of your videos, and the addresses it records have project and clip ids removed. PostHog keeps its identifiers in the page's memory only: it keeps no cookies or local storage on your device.
• How you found us, only if you accept. The same Accept lets us keep the link that first brought you here, in a first-party cookie and local storage (auk_first_touch) for 90 days: its source and campaign tags, the site you came from and the page you landed on. A later link never replaces one that named a source or a campaign.
• You can withdraw consent at any time with the button below, which stops Google Analytics and PostHog and deletes the cookies and local storage they set, and the link that brought you here; if you are signed in, it also removes that link's source and campaign from your account. The app keeps working.

We do not fingerprint devices and we set no advertising or cross-site tracking cookies.

Change cookie settings

7. How long we keep it

• Projects and media (source video, audio, transcripts, clips, renders): for as long as your account exists, until you delete the project.
• Content we removed for breaking our Terms (for example after a copyright notice): kept out of reach for 30 days, so it can be put back if the removal was a mistake, then deleted with everything we hold about it: its files, captions and edits, and the transcript when we removed a whole project. Our internal log keeps only the record that we removed it. Where the law requires us to preserve it (for example to report a crime), we keep it for as long as that duty lasts, even if you delete the account.
• Account records: for as long as your account exists.
• Record of your agreement and email preferences: for as long as your account exists, deleted with it.
• Publishing credentials and account identity: re-read from the platform daily while connected. Deleted immediately when you disconnect the account in Auk, and within 7 days (in practice the next day) if you revoke access at the platform instead.
• Links to what we published for you (the platform's video id, link and privacy status): re-read daily, and removed within 7 days of the account being disconnected or revoked, or of the video being deleted on the platform. The record that a clip was published stays in your history, without the link.
• Billing and tax records: up to seven years after the transaction, because Canadian tax law requires it.
• Product analytics (PostHog): events at most 12 months, then deleted; the profile that links them to your account id is deleted when you delete your account.
• How you found us (the source and campaign of that link, and your welcome survey answers): for as long as your account exists, deleted with it. Withdrawing analytics consent while signed in removes the source and campaign at once; signed out, ask us (section 11). Delete your survey answers in Settings, at any time.
• Download records (which rendered file you started downloading, from where, and how long you waited): 13 months, then deleted; sooner if you delete the project or the account.
• Sign-in sessions: ended and deleted after 90 days without use, with the IP address and browser recorded with them.
• Access records (your account id, the IP address you used Auk from, and the date and hour, at most one record per address per hour): 6 months, then deleted, even if you delete your account sooner, because Brazil's Marco Civil da Internet requires an application provider to keep them that long. No part of Auk shows them, and we disclose them only on a court order.
• Showcase visit records and feedback: 13 months.
• Server logs: generally 30 days, longer only where an open security investigation needs them.

8. Deleting your data

You can delete an individual project at any time from the app, which removes its source video, audio, transcript, clips and renders. You can disconnect a publishing account from Settings, which deletes the stored credential.

If you connected Instagram or Facebook, you can also remove Auk at Meta: on Facebook, go to Settings and privacy, Settings, Apps and websites, select Auk and choose Remove; on Instagram, go to Settings, Website permissions, Apps and websites, select Auk and choose Remove. For TikTok, go to Settings and privacy, Security and permissions, Apps and services permissions, and remove Auk. For YouTube, use Google's permissions page (menu names may differ in your version of the app). Removing Auk at the platform stops our access at once. We check every connected account at least daily; when we find that access has been removed, we delete the identity, token and everything else we hold from that platform within 7 days, without you needing to do anything more.

Deleting data from Auk, whether one project, one connection or your whole account, deletes only the copies Auk holds. It does not delete or change anything on YouTube, TikTok or Instagram. A video Auk published for you stays on that platform until you delete it there, in the platform's own app or website.

To delete your whole account and everything in it, cancel any plan in Manage billing and then use Request account deletion in Settings, or email privacy@auk.video from the address on the account with the subject “Delete my account”. Either way, we cancel your subscription and delete your account, projects, media and connected platform accounts within 7 days of your request, and confirm by email. Our database provider keeps encrypted backups on a rolling cycle of no more than 30 days; until then a deleted record may exist only in a backup that nobody uses to operate the service, and if we ever restore a backup we delete it again before the service goes back online. Three records survive deletion, because the law or security requires them: the payment notifications our payment provider sent us (which include your billing email and what you paid), kept for as long as Canadian tax law requires; our internal log of actions staff took on accounts, kept for 24 months for security; and the access records in section 7, kept for the 6 months Brazilian law requires. Our payment provider, as merchant of record, also keeps its own records of your payments.

9. How we protect it

All traffic runs over TLS. Refresh tokens for connected accounts are encrypted at rest with AES-GCM under a key held outside the database, and are never returned by any API route. Access to production systems is limited to the people who operate them. Every API request is checked against the account that owns the record it touches, which is enforced by an automated test that fails the build if a route forgets, so one customer cannot read another's projects.

No system is perfectly secure. If a breach of our security involves your personal information and creates a real risk of significant harm to you, as Canada's PIPEDA puts it, or a risk of serious injury, as Quebec's law puts it, we will notify you and the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, as the law requires, as soon as feasible. Where the GDPR or UK GDPR applies, we notify the competent authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to people, and we notify you without undue delay when the risk to you is high. Where Brazil's LGPD applies, we notify the National Data Protection Authority (ANPD) and you within 3 business days of becoming aware of an incident that may create a relevant risk or harm to you. Our notice will say what happened, what information was involved, what we have done, and what you can do to protect yourself. We keep a record of every breach and confidentiality incident, whether or not it had to be reported.

10. Where your information is stored

We are based in Canada, but our infrastructure providers store and process data in the United States, the United Kingdom and the European Union, as set out in section 5. This means your information may be accessible to courts, law enforcement and national security authorities in those countries under their laws. For personal information from the European Economic Area or the United Kingdom, we rely on the European Commission's adequacy decision for Canada, and for onward transfers to our providers, on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the provider's certification under the EU-U.S. Data Privacy Framework (and its UK Extension). As Quebec law requires, before we send personal information outside Quebec we assess whether it will be adequately protected and put a written agreement in place. You can ask us for more detail about these safeguards.

Transfers of information from Brazil

If you use Auk from Brazil, you send your information to us in Canada, and we send it on to the providers in section 5, outside Brazil. Brazil's data protection authority asks us to explain these international transfers (Resolution CD/ANPD 19/2024), so here they are:

• What, how, why and for how long. The information in section 3, for the purposes in section 4, kept for the periods in section 7. It travels over encrypted connections, and each provider receives only what its task in the table below needs.
• Who is responsible. Hoglet Labs Inc., the controller, whose contact details are in section 13. Each provider processes the information only on our instructions, under its data processing terms and the security measures in section 9. Our payment provider, and the platforms you publish to, decide for themselves what they do with what they receive, under their own policies.
• Your rights. The rights in section 11, including the right to petition the ANPD, through the contacts in section 13. If a transfer relies on contractual clauses, you can ask us at privacy@auk.video for the full text of those clauses, and we will send it within 15 days.

11. Your rights

Wherever you live, you can ask us to give you a copy of your personal information, correct it, delete it, or stop a particular use. Email privacy@auk.video and we will answer within 30 days, or sooner where the law requires it (Brazil, below). If the law allows us more time and we need it, for example because a request is complex, we will tell you within the first 30 days why, and when you will hear from us. We will not charge you or treat you differently for asking.

Canada. Under PIPEDA you have the right to access and correct your personal information, to withdraw your consent to a use of it (subject to legal and contractual limits, and we will tell you what withdrawing means for the service), and to challenge our handling of it. If our answer does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada. Quebec residents additionally have rights of portability and de-indexing under Law 25 and may complain to the Commission d'accès à l'information du Québec.

European Economic Area and United Kingdom. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office.

United States. Residents of California and other states with comprehensive privacy laws have the right to know, delete, correct and port their personal information, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we do not discriminate against anyone who exercises a right.

Brazil. Under the LGPD (art. 18) you have the right to: confirmation that we process your data; access to it; correction of data that is incomplete, inaccurate or out of date; anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law; portability to another provider; deletion of data processed with your consent; information about the public and private entities we share it with; information about the possibility of refusing consent and what refusing means; and revocation of your consent. You may also object to processing that does not rely on your consent if it breaches the law, and ask for a person to review a decision taken solely by automated processing (we take none). Exercising them is free. We confirm whether we process your data and give you access to it at once, in simplified form: your account details, your projects and your credit history are in the app at any time. If you ask, we send you a complete statement of its origin, the criteria used and the purpose of the processing within 15 days of your request. You may petition the National Data Protection Authority (ANPD) about your data, and also a consumer protection body, such as your state's Procon or consumidor.gov.br.

12. Children

Auk is not for children. You must be at least 18 and have reached the age of majority where you live to hold an account, because holding one means agreeing to a paid contract. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we delete the account and its contents. Contact us if you believe a child has given us information.

13. Contacting us, and complaints

Privacy questions, requests and complaints go to our Privacy Officer, who is the person in charge of the protection of personal information at Hoglet Labs Inc., at privacy@auk.video, or by post to: Privacy Officer, Hoglet Labs Inc., 6-2160 Highway 7, Suite 620, Vaughan, Ontario L4K 1W6, Canada - Greater Toronto Area. Anything else reaches us at hello@auk.video. We answer privacy requests within 30 days (access requests from Brazil sooner, as section 11 says) and will tell you if we need longer and why.

Brazil. Complaints and requests under the LGPD, and the ANPD's communications, go to privacy@auk.video, and we answer them in Portuguese.

How we govern it. Our Privacy Officer approves how long we keep personal information and how we destroy it (section 7), who on our staff may see it (section 5), and how we handle a complaint: write to us as above, we acknowledge it, answer within 30 days, and tell you how to take it to the regulator in section 11 if you are not satisfied. Before we add a provider or a new use, we assess it, and before personal information leaves Quebec we assess the protection it will have (section 10).

14. Changes to this policy

If we change this policy we will update the effective date at the top, and for a change that materially affects how we handle your information we will email you or show a notice in the app before it takes effect. If a change would let us use your information for a new purpose, we will ask for your consent before doing so, and nothing changes for you until you give it.

Hoglet Labs Inc., 6-2160 Highway 7, Suite 620, Vaughan, Ontario L4K 1W6, Canada - Greater Toronto Area. Email: hello@auk.video.