Kebijakan Privasi

Your Spaces, pages, posts, articles, pictures, and settings are stored so we can show them to your visitors and deliver them where you send them. That's the product.

If you invite teammates, you give us each one's email address, and we use it to send the invitation and nothing else. Once they join, they see what is in the Spaces you share with them, as far as the boxes you tick allow - which can include your subscribers' email addresses and the messages your visitors send you.

If you're on somebody else's team, they see your name and email address, and every log in their Spaces shows what you did there and when.

When you connect a platform to the poster, you give Tublish a key (a webhook address, a bot token, an app password - whatever that platform uses). We store it and use it for exactly one thing: delivering the posts you send.

We never ask for, and never store, your actual password to any other platform.

Disconnecting a platform deletes its key.

Tublish uses YouTube API Services. When you give Tublish your YouTube channel, it reads the channel's public details through them: its name and picture, its videos and their titles, your subscriber, view, like and comment counts, and the comments under your videos. It reads those comments only to count the requests your audience leaves - it keeps the tag and how many people asked, never who asked or the rest of what they wrote.

If you connect YouTube so Tublish can upload for you, Google gives us a key. We use it only to learn which channel is yours and to upload the videos you send, with the title, description, picture and settings you chose. Some YouTube connections are made through our posting partner, Outstand, which then holds that key instead of us.

How Google itself handles this data is described in the Google Privacy Policy.

You can take Tublish's access away at any time: Disconnect on the Platforms screen deletes the key and tells Google, or our posting partner, to cancel it; or remove Tublish on your Google Account's security settings page.

To have the YouTube data we keep for you deleted, write to us through the contact page, and we'll delete it within 7 days.

On the plans that include it, you can connect an assistant such as Claude or ChatGPT to your Tublish account. You start it from the assistant and approve it on a Tublish page.

A connected assistant can read your account - your name and plan, your Spaces, the platforms connected to them, your posts and videos, your blog articles (drafts included), your Autopilot, your numbers, the requests your audience left in your YouTube comments, your calendar and to-do list, your subscribers' email addresses and the messages visitors send you - prepare new posts, have Tublish read the comments on your YouTube videos for new requests, send newsletters to your mailing list and add your subscribers to it through the mailing service you connected, write, publish and change your blog articles, put the picture you picked on a video you sent to YouTube that went up without it, change your Autopilot (its rules and its Story shelf), and change your E-Business card, your website, your media kit (what it says about you, how it looks, and whether it is online - never its numbers) and your Space's own settings (whether it is online, the language it speaks to visitors, and the phone number, WhatsApp number and email address its contact buttons show).

A visitor's message that reads as if it was written to the assistant rather than to you is kept from it until you let it through on the Messages screen.

If you're on somebody else's team, an assistant you connect reads and changes only what your place on that team opens, in the Spaces shared with you.

Whatever it reads, and whatever you ask it, is handled by the company that makes the assistant (Anthropic for Claude, OpenAI for ChatGPT) under that company's own privacy policy. We don't control what happens on their side.

We keep a record of each action an assistant takes in your account and when. Posts and articles it prepares are stored like any others, and every post or newsletter it sends, every article it writes or publishes and every change it makes to your card, your website, your media kit or your Space's settings is labeled with its name.

You can see every assistant you've connected, and disconnect any of them, on the Assistants screen.

If you make an API key, a program you give it to - one of your own, or a service you sign up to - can read and change in your account everything a connected assistant can. What it reads is handled by whoever runs that program, under their own terms; we don't control what happens on their side.

We keep a record of each request a key makes - which key, which address, how Tublish answered and when - never what was sent.

You can see your keys, and delete any of them, on the API keys screen.

When a visitor subscribes on a creator's page, their email lands in that creator's subscriber list. The list belongs to the creator; Tublish stores it for them. Creators can download or delete their list at any time.

When a visitor submits a public form - subscribing, or sending a message to a creator - we record the sender's IP address alongside it. That's our spam and abuse defense, nothing more.

Just visiting a Tublish page? We don't set advertising cookies or run third-party analytics on you. Standard server logs at our hosting provider (Cloudflare) exist, as on virtually every website.

Internet addresses a creator adds to their own Not counted list are kept so visits from them are not counted, until the creator removes them.

We log which dashboard screens signed-in accounts open and when, plus a rough location (country level) taken from the connection, and the kind of device - phone, tablet or computer - as the browser describes itself. We use this to fix bugs, check the problems people report to us, and understand what needs work.

There is no keystroke logging and no screen recording - we see which screens were opened, not what you did on them.

When a page crashes - in the dashboard, or on a creator's page for one of their visitors - the browser sends Tublish a short report: the page's address with anything private taken out, the error's own message, the browser's name and version, the language the page was showing and whether a translation tool had changed it, and which account was signed in, if any. We use it only to find and fix the crash, and it is cleared with the screen log.

These logs are cleared periodically.

Tublish sets the cookies needed to keep you signed in, and a few small ones that remember choices you make in the dashboard - your language, how a chart is drawn, how far back you last looked. No advertising cookies, no cross-site tracking.

If you switch off counting for your own browser (Analytics, then Not counted), a cookie in that browser tells us not to count its visits to your Space. It holds your Space's ID and nothing else, and switching counting back on removes it.

Small conveniences (your pinned world-clock cities, your link-tagger history) live in your own browser's storage and never reach our servers.

Tublish runs on trusted providers, each seeing only what their job requires:

• Supabase - our database and sign-in infrastructure (where your data lives)
• Cloudflare - serves the websites and pages
• Brevo - sends the email Tublish itself sends: sign-in links, notices to creators, and the invitations creators send their teammates
• Google - if you choose Google sign-in, and YouTube's own services if you give Tublish your YouTube channel
• Outstand - our posting partner, which connects some platforms (Instagram, Facebook, Threads, TikTok and some YouTube channels) and delivers what you send to them
• The platforms you connect - they receive only the posts you send them
• An assistant you connect yourself (Claude, made by Anthropic, or ChatGPT, made by OpenAI, for example) - it receives what it reads from your account, under its maker's own policy
• A program or service you give an API key to - it receives what it reads from your account, under its maker's own terms
• Paddle.com - sells our paid plans as the Merchant of Record; your card details go to Paddle directly, never touch Tublish's servers, and are handled under Paddle's own privacy policy

No data brokers. No selling. No renting. Ever.

We'd hand over data only if the law genuinely compels it.

Your account and content: until you delete them. Deletion starts a 30-day window in which you can change your mind; after that it's gone for good.

Subscriber lists: controlled by their creator, deleted with the creator's Space or account.

Anti-abuse records (IPs on public submissions), the screen logs and the crash reports: cleared periodically.

You can see, correct, download, or delete your data. Most of it you can handle yourself right in the dashboard; for anything else, email us and we'll do it.

If you're in the EU or UK, this is your GDPR right; in California, your CCPA right. We honor the spirit of both everywhere: it's your data.

Tublish isn't for children under 13, and we don't knowingly collect their information. If you believe a child is using Tublish, tell us and we'll remove the account.

When this policy changes, the date at the top changes with it, and meaningful changes get announced by email or inside Tublish before they apply.