Data Retention Policy

1. Principles

We keep data only as long as necessary to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements.

2. Retention by category

• Account data — retained while your account is active.
• YouTube OAuth tokens — retained (encrypted) until you disconnect the channel or delete your account, after which they are revoked and removed.
• Projects and generated content — retained while your account is active so you can access your library.
• Refresh tokens — rotated on each use and expire after 7 days; password reset tokens are single-use and expire after 1 hour.
• Request logs — retained for a limited period for security and reliability, then rotated.

3. Deletion

The platform uses soft deletion for user-facing records, which are flagged as deleted and excluded from your account. On account closure or verified deletion request, we remove or irreversibly anonymize your personal data within a reasonable period, except where retention is legally required.

4. Backups

Residual copies may persist in encrypted backups for a limited time before being overwritten in the normal backup rotation.