Privacy Policy

TrafficWins stores account, billing, website context, article, and job data needed to run the service. Google user data accessed: when a user connects YouTube, TrafficWins accesses the authorized YouTube channel ID, channel name, channel image, granted OAuth scopes, and the user's own video upload and processing status. TrafficWins requests only the YouTube read-only and upload permissions needed to identify the selected channel, upload user-approved videos, and confirm their processing and publication status. How Google user data is used: TrafficWins uses the channel details to show the connected YouTube account inside the user's workspace. It uses the OAuth access and refresh tokens only to maintain that connection, upload videos the user has explicitly approved for publishing, and check those uploads for completion or errors. TrafficWins does not use Google user data for advertising or to train generalized AI or machine-learning models. Google user data sharing and disclosure: TrafficWins does not sell Google user data. We disclose it only to Google to perform the user-requested YouTube operations and to contracted infrastructure providers that host, secure, store, or operate TrafficWins on our behalf. Those providers may process the minimum data needed to provide their services and are bound by applicable confidentiality and data-protection obligations. We may also disclose data when legally required or as part of a business transfer subject to this policy and applicable law. Google user data protection: OAuth access and refresh tokens are encrypted at rest using authenticated AES-256-GCM encryption and are transmitted only over HTTPS. Access is limited to authorized TrafficWins services and personnel with an operational need. We use tenant-scoped access controls, secret-management practices, logging safeguards that exclude tokens, and local token removal when a connection is disconnected. Google user data retention and deletion: OAuth access and refresh tokens are retained only while the YouTube connection remains active and are removed from TrafficWins when the user disconnects that channel. Channel identifiers, display details, granted-scope records, and publication history may remain for account continuity, security, audit, and legal obligations until the TrafficWins account or associated data is deleted. Users can disconnect YouTube in workspace settings, revoke TrafficWins in their Google Account, or contact support to request deletion of their account and Google user data. We delete or de-identify eligible data from active systems and allow encrypted backups to expire under our backup-retention schedule, subject to legal requirements.

We also use WorkOS for authentication, Stripe for billing, GlitchTip for error reporting, and infrastructure providers for hosting and storage. TrafficWins product, marketing, revenue, and customer SEO analytics are disabled; we do not run PostHog, Google Analytics, Microsoft Clarity, session replay, or acquisition-attribution tracking.

TrafficWins does not ask for AI provider API keys. A workspace admin connects a ChatGPT account, and TrafficWins stores its encrypted authentication only for that workspace's requested generation. One-off runs are ephemeral; retryable jobs use isolated server storage that is deleted when the job succeeds, fails, or is cancelled. TrafficWins thread transcripts and identifiers are not exposed through customer APIs or placed in the connected account's ChatGPT or Codex task history. OpenAI account usage and limits remain attributable to the connected account. The iOS app may store a rotating WorkOS refresh token in the iOS Keychain and an APNs device token on our servers. APNs notifications use non-sensitive status text for article, publishing, and social-post events. Users choose whether to enable notifications and can remove the device registration by signing out.

Users can request account deletion inside TrafficWins settings. The request signs the user out, is recorded for duplicate prevention, and is fulfilled within 30 days. Users may also contact support for account, social-token, or data deletion and revocation requests.