Privacy — joogoos

What we hold

Your account. Email address, and — if you signed in with Google — the name and profile picture Google gives us. No password, ever: sign-in is a link by email or Google.
Your business profile. What you tell the chat about your business, and anything we look up about it from public sources when you ask us to.
Your media. The photos you upload and everything generated from them.
Your work. Briefs, scripts, timelines, drafts, the finished files.
Your spending. One row per step run: when, which operation, which provider and model, what it cost, what you were charged.
Ordinary server logs. IP address, browser, the pages requested, kept short.

What we do with it

Run the product, charge you correctly, answer you when you write in, and keep the service up. We do not sell it, we do not share it with advertisers, and we do not build profiles of you for anyone else.

Your content is not used to train anybody's model. We send what a step needs to the provider that runs it, and we use providers on terms that exclude training on the data we send. We do not train models of our own on your work.

Google user data

Joogoos asks Google for permission in four separate places, and asks for the least each one needs. None of them can read your mail.

Signing in. If you choose to sign in with Google we ask for openid, email and your basic profile. We keep the email address, name and profile picture Google returns, and use them to create your account and sign you in. Nothing else.
Connecting your mailbox. If you choose to send customer emails from your own address rather than ours, we ask for one permission. https://www.googleapis.com/auth/gmail.send can only send a message as you; it cannot change or delete anything, and it cannot read anything. We use it only to send the messages you have written and approved, and because we cannot see a reply we send each company one email and no follow-ups; an answer arrives in your own inbox like any other. From 21 to 27 September 2026 a connected mailbox was also asked for https://www.googleapis.com/auth/gmail.readonly, so that we could notice a reply and stop emailing that company. Every one of those connections was ended on 30 September 2026 and its stored token deleted, so Joogoos holds no permission that can read mail; if you connected in those days, you can also remove the old permission from your Google Account. The refresh token is stored encrypted; disconnecting deletes it here and gives the permission back to Google, as below.
Connecting Search Console. If you choose to see how your own website is doing in Google search, we ask for https://www.googleapis.com/auth/webmasters.readonly. That permission is read-only: it cannot change your site, its verification, its sitemaps or anything else in Search Console. We use it to read, for the site you pick, the search phrases people used to reach it, the pages they landed on, and how often each was shown and clicked. We show you those, and use the phrases to suggest the next articles worth writing for your site; nothing else. The refresh token is stored encrypted; disconnecting deletes it here and gives the permission back to Google, as below.
Connecting your YouTube channel. If you choose to publish a finished video to YouTube, we ask for two permissions. https://www.googleapis.com/auth/youtube.upload uploads a video to your channel, and nothing else: it cannot read, change or delete anything already there. https://www.googleapis.com/auth/youtube.readonly we call exactly once, when you connect, to read your channel's name and picture so the page can show you which channel you have linked. We do not read your videos, your analytics, your comments, your subscribers or your watch history, and we never call it again after the connection is made. The broader youtube permission is deliberately not asked for. What we keep is your channel's id, name and picture, and, for each video we upload for you, the id YouTube gives it back so we can link you to it. The tokens are stored encrypted and opened only to publish; disconnecting the channel deletes them here and gives the permission back to Google, as below.

Joogoos uses YouTube API Services to publish the videos you ask it to. By connecting a YouTube channel you agree to the YouTube Terms of Service, and what YouTube and Google do with your data is covered by the Google Privacy Policy. You can take Joogoos's access to your YouTube channel back at any time from Google's own security settings, as well as from the app.

Joogoos's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide and improve the features you asked for, we do not sell it, we do not use it for advertising, and nobody here reads it except with your permission, to fix a fault you have reported, or where the law requires it.

Google user data is not used to develop, train or improve generalised AI or machine learning models — not ours, and not those of the providers listed below.

How long we keep Google data, and how it goes

Your email address, name and picture from signing in: for as long as you have an account, and deleted when you close it.
The refresh tokens for your mailbox and for Search Console: only while that connection is on. Disconnecting deletes the token here the same moment and gives the permission back to Google, as below.
Gmail message content: nothing is read from a mailbox today. A reply noticed while a mailbox could still be read, as described above, until 30 September 2026, is kept against the letter it answers for as long as that customer record exists, and deleted with it. Nothing else from your mailbox is stored at any point, not even briefly.
Search Console figures: the phrases, pages, impressions and clicks we show you, kept while your account is open and deleted when you close it.
YouTube: your channel's id, name and picture while the channel is connected, and the id of each video we uploaded for you for as long as that post exists. Disconnecting the channel deletes the connection and its tokens; closing your account deletes the rest. We hold no other YouTube data at any point.

To take it back: disconnect the mailbox or Search Console in the app, or revoke joogoos at myaccount.google.com/permissions. Either deletes the token and the data gathered under it from our database at once, and from the encrypted backups within thirty days as those roll off. Google keeps two separate permissions for joogoos, so it may be listed twice at myaccount.google.com: one for your mailbox and Search Console, and one for signing in and your YouTube channel. Disconnecting YouTube never touches the mailbox or Search Console, and the other way round. The mailbox and Search Console share theirs, so disconnecting one in the app gives it back to Google once the other no longer uses the same Google account; until then joogoos no longer holds the disconnected connection's token and cannot use it. Revoking an entry at myaccount.google.com ends everything under it at once. Closing your account removes all of it — see deleting your data.

The other social accounts you connect

Instagram, Facebook, TikTok, LinkedIn and X are connected the same way: you sign in on the platform's own page and allow Joogoos to post there, and Joogoos never sees your password. Each asks only what posting needs:

Instagram (Meta): instagram_business_basic to show which account you connected, and instagram_business_content_publish to publish the posts you approve.
Facebook (Meta): pages_show_list and business_management to list the Pages you manage so you can choose one, pages_manage_posts to publish to it, and pages_read_engagement, which Meta requires alongside publishing.
TikTok: user.info.basic to show which account you connected, and video.publish to post the videos you approve, with the privacy and settings you choose for each one.
LinkedIn: openid and profile to show whose profile it is, and w_member_social to post on it.
X: users.read and tweet.read to show which account you connected, tweet.write and media.write to post, and offline.access so the connection lasts beyond two hours.

What we keep, for each: the account's id, name, handle and picture as the platform gives them, the permission it granted, encrypted, and for each post we publish the id and link the platform gives back. We do not read your feed, your followers, your messages or your analytics, and nothing we receive from these platforms is sold, used for advertising, or used to train any model. Disconnecting an account under Business → Channels deletes it here at once and gives the permission back to the platform; for a YouTube or Facebook account connected in more than one workspace, that happens when the last one disconnects; deleting your data covers the rest, including data Meta sends us as a Platform Data under its terms.

Who else sees it

Only the companies that do a job for us, and only the part of it they need to do that job:

AI providers — Anthropic, Google, fal and ElevenLabs — receive the prompt, photo or audio for the step they run, and nothing else. They do not receive your email address or your account.
Cloudflare serves this site, sits in front of the app, and stores your files in R2.
Stripe takes the payment. Card details, your billing address and, for a business, a VAT or tax number if you give one go to Stripe and are kept there with the payment; we keep the fact that a payment happened and for how much.
Resend sends the sign-in links and the few emails we send.
Hetzner hosts the server, in Germany.
Backblaze holds the encrypted backups.

We also hand things over if the law requires it, and we will tell you when we are allowed to.

How we protect it

In transit. Everything travels over HTTPS. The server has no port open to the web at all; it is reached only through a Cloudflare tunnel.
Your Google tokens. Sealed with AES-256-GCM, a fresh nonce for every row, under a key that exists only inside the server processes and never in our code, our backups or our laptops. One function opens them, in the worker, on the line before the call to Google. No part of the API can hand one back: the shapes our routes answer with have no field a token could sit in, and a test asserts that of the whole answer rather than of a field somebody remembered.
No passwords. We never hold one. Sign-in is a link by email or Google, and the session is a row on our server behind an HttpOnly cookie.
One workspace cannot reach another. Every route is checked against that by a test suite that runs before anything ships.
Backups are encrypted before they leave the server and held by Backblaze for thirty days.
People. Nobody here opens your content except to fix a fault you have reported to us, or where the law requires it. Our own secrets are held in a managed store, never in the code.

Where it lives, and for how long

Data sits on a server in Germany and in Cloudflare R2. Backups are encrypted and kept for thirty days. Deleted media is removed from the database immediately and purged from storage within thirty days; server logs roll off within thirty days. Everything else is kept for as long as you have an account, and deleted when you close it — see deleting your data.

What you can do

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Write to [email protected] from the address on the account and we will do it within thirty days. If you are in the UK or the EU, those are rights you have under data protection law rather than favours we are doing you.

Cookies

One, and it is the session cookie that keeps you signed in. No advertising cookies, no third-party trackers, and nothing at all on this website until you sign in to the app.

Changes

If this page changes in a way that matters, the account gets an email before it takes effect. The date at the top is the date of the current version.

Contact

[email protected] for anything on this page.