Privacy Policy

1. Scope & Overview

Welcome to Frooty (“Frooty”, “we”, “our”, or “us”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use:

• Our web-based video collaboration and review platform at frooty.ai;
• Our desktop applications for macOS and Windows;
• Our creative host extensions and NLE plugins, including the Adobe Premiere Pro Panel and DaVinci Resolve integration;
• Our multi-platform publishing scheduler and social network connections (including LinkedIn, YouTube, Instagram, Facebook, TikTok, X, and Threads); and
• Any associated APIs, webhooks, mobile experiences, and customer support channels.

We believe creative work requires complete trust. We do not sell your personal data, and we do not use your proprietary video, audio, or creative content to train public AI models.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from connected third-party integrations.

A. Information You Provide Directly

• Account and Profile Details: Your name, email address, password hash, profile avatar, workspace role, and display preferences.
• Creative Content & Media Assets: Video files, audio tracks, thumbnail images, subtitle files, project titles, descriptions, frame-accurate comments, time-coded markers, and visual canvas annotations.
• Publishing Metadata: Video captions, hashtags, scheduled publishing times, platform-specific privacy settings, and distribution tags.
• Billing & Payment Data: Billing address, tax ID, and payment details processed directly through our PCI-DSS compliant payment processor (Stripe). We do not store raw credit card numbers.
• Support & Communications: Feedback, bug reports, and correspondence submitted via our help desk or email.

B. Information Collected from Connected Integrations

• OAuth Social Tokens: When you link publishing accounts, we securely store encrypted access tokens, refresh tokens, user IDs, channel names, and profile avatars needed to publish on your behalf.
• Publishing Feedback: Post URLs, platform post IDs, and status confirmations returned by third-party APIs upon publication.

C. Information Collected Automatically

• Device & Telemetry Data: IP address, browser type and version, operating system, device identifiers, language settings, and referrer headers.
• Service Usage: Feature interactions, playback events, storage usage, and system crash diagnostics used to maintain performance and reliability.

3. How We Use Information

We use your information exclusively for legitimate operational purposes:

• To provide, operate, and maintain our collaborative video review and approval workflows;
• To transcode video files into streaming-optimized web proxies and generate waveforms;
• To generate automated, frame-accurate captions, subtitles, and transcripts;
• To schedule and publish your media to third-party social platforms per your explicit direction;
• To authenticate users, enforce workspace permissions (Admin, Editor, Reviewer, Viewer), and secure review links;
• To process billing, invoices, and subscription renewals;
• To detect, prevent, and address security incidents, fraud, abuse, and technical glitches; and
• To communicate service announcements, security alerts, and customer support updates.

4. AI & Video Processing (No AI Training Guarantee)

When you utilize automated speech-to-text or captioning features, audio streams are processed ephemerally on dedicated processing nodes solely to generate the requested subtitles and transcripts for your active project. Your content remains your sole intellectual property and is protected by workspace isolation boundaries.

5. Social Platform Integrations & API Disclosures

Frooty allows users to connect social accounts to publish videos directly from the Frooty scheduler. When using these integrations, we adhere strictly to each platform's developer policies.

A. LinkedIn Integration

When connecting LinkedIn, we request permissions via OAuth 2.0 (openid, profile, and w_member_social, and where authorized for company pages, w_organization_social):

• Use of Data: We access your LinkedIn member identifier, profile name, and avatar solely to display your linked account in your Frooty workspace and to transmit your scheduled video uploads and accompanying text to LinkedIn's REST APIs (/rest/videos and /rest/posts).
• No Data Sale or Brokering: We never sell, rent, monetize, or transfer your LinkedIn profile data or user statistics to data brokers, advertising networks, or unapproved third parties.
• Revocation: You can disconnect your LinkedIn account at any time via Manage Accounts in the scheduler, which immediately deletes all stored LinkedIn tokens from our active database.

B. YouTube & Google API Services

Limited Use Disclosure: Frooty's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We access only the permissions required to upload your videos (youtube.upload), view your video metadata, and check upload status. You can view or revoke Frooty's access to your Google account at any time via the Google Security Settings page.

C. Meta (Instagram & Facebook)

We utilize Meta Graph APIs to enable scheduled publishing to Instagram Reels and Facebook Pages. Data retrieved is limited to Page names, Instagram professional IDs, profile pictures, and post status confirmations. We comply fully with the Meta Platform Terms and Developer Policies.

D. TikTok, X (Twitter), and Threads

We connect to TikTok, X, and Threads via their official developer APIs exclusively to upload user-selected videos and captions at the times scheduled by you.

E. Encryption of Social Credentials

All third-party OAuth access tokens and refresh tokens are encrypted at rest using industry-standard AES-256-GCM encryption. Tokens are only decrypted ephemerally inside our background publishing worker when executing a scheduled post.

6. Desktop Applications & Creative NLE Extensions

Frooty offers host extensions (including the Adobe Premiere Pro Panel and DaVinci Resolve integration) and standalone desktop applications:

• Local File Access: The desktop app and Premiere Pro panel access your local filesystem strictly within directories you explicitly designate (such as project download destinations and scratch cache folders). We never perform background scans of your storage or index unrelated local media files.
• Timeline & Sequence Synchronization: When you trigger timeline synchronization in Premiere Pro or DaVinci Resolve, our extension reads active sequence timecodes, markers, and cut points to match review comments to your editing timeline. No background project scanning occurs when the panel is idle.
• Local Extension Storage: The Adobe panel securely caches your active session token in protected local application storage to prevent frequent re-authentication prompts.

7. Information Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share information only in the specific circumstances below:

• With Your Workspace Team: Content, versions, and comments you add within a workspace are accessible to team members based on their assigned role permissions.
• With Review Link Recipients: If you generate a public or passphrase-protected review link, anyone with that link and valid credentials can view the designated video and existing comments.
• Trusted Infrastructure Providers: We engage reputable cloud infrastructure vendors under strict data processing agreements:
  • Cloud storage and CDN delivery (Cloudflare R2, AWS S3-compatible);
  • Payment and subscription processing (Stripe);
  • Transactional email and notifications (Resend, Listmonk); and
  • Database and Redis infrastructure.
• Legal and Regulatory Compliance: We may disclose information if required by a valid court order, subpoena, or applicable law, or to protect the safety, rights, or property of Frooty, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, financing, or sale of company assets, user data may be transferred as a business asset under appropriate confidentiality protections.

8. Data Security & Encryption

We implement comprehensive administrative, technical, and physical safeguards designed to protect your data:

• Encryption in Transit: All data transmitted between your browser, desktop apps, extensions, and our servers is secured using TLS 1.3 / HTTPS encryption.
• Encryption at Rest: Video files, database records, and backups are encrypted at rest using AES-256 encryption.
• OAuth Secret Security: All third-party access tokens are encrypted with AES-256-GCM before database storage.
• Access Controls: Production infrastructure access is restricted to authorized personnel via multi-factor authentication and role-based access protocols.

While we maintain rigorous security standards, no method of digital transmission or storage is completely impenetrable. If you suspect any unauthorized access to your account, please notify us immediately at security@frooty.ai.

9. Data Retention & Account Deletion

• Active Data: We retain your personal information, projects, and creative assets for as long as your workspace account remains active.
• Media Deletion: When you delete a video or project in Frooty, the source media, streaming proxies, audio waveforms, and associated comments are permanently queued for deletion and purged from active storage.
• Social Account Disconnection: Disconnecting a social connection in your settings immediately deletes the associated tokens from our databases.
• Account Deletion: You can delete your account at any time from your account settings or by contacting privacy@frooty.ai. Account deletion permanently purges your personal profile data and associated workspace assets within 30 days, except where retention is mandated by law (such as tax or financial compliance records).
• Meta Data Deletion: If you connected a Facebook Page, Instagram or Threads account, you can also request deletion of that Meta data on its own through Facebook Settings → Your Facebook information → Delete your Facebook information. See the Data Deletion page for exactly what is removed and how to request it.

10. Your Privacy Rights (GDPR, CCPA & Global)

Depending on your geographic location, you may have statutory rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your personal data.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.
• Right to Object or Restrict: Object to or restrict specific processing activities.
• Right to Non-Discrimination: You will never be discriminated against for exercising any privacy right.

To exercise any of these rights, please contact us at privacy@frooty.ai. We will verify your identity and respond within 30 days.

11. Cookies & Local Storage

We use cookies and browser local storage technologies for:

• Essential Authentication: Maintaining your logged-in session, security tokens, and workspace state;
• User Preferences: Storing player volume, timeline zoom, dark mode theme, and panel configurations; and
• Performance Telemetry: Aggregated, privacy-focused operational metrics to detect errors and improve load times.

You can configure your browser to decline cookies, but doing so may prevent you from logging in or using interactive features of the platform.

12. Contact & Company Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:

We periodically update this policy to reflect changes in our services or legal obligations. We will notify you of material changes by updating the “Last updated” date at the top of this page.