Privacy Policy

We collect information in the following ways:

• Account information: your email address, authentication status, account identifier, and information supplied by a sign-in provider such as Google.
• Profile information: details you choose to add, such as a display name and Instagram username.
• Content and activity: content-planning information, schedules, preferences, and actions you take in the Service.
• Device and usage information: browser type, device information, IP address, pages viewed, referring pages, approximate location derived from IP, timestamps, and diagnostic events.
• Communications: information you include when you contact us for support or send feedback.

Please do not provide sensitive personal information unless it is necessary for a feature you intentionally use.

This section specifically describes Creatorpop's access to and handling of information received from Google when you choose “Continue with Google.”

Google data we access

Creatorpop requests only the basic Google OAuth/OpenID Connect scopes needed for authentication: openid, email, and profile. Depending on what is available in your Google account, this lets us receive:

• your unique Google account identifier;
• your email address and whether Google has verified that address;
• your name; and
• your Google profile image.

Creatorpop does not request or access your Gmail messages, Google Drive files, Google Calendar events, Google Contacts, Google Photos, payment information, passwords, or other Google service content.

How we use Google user data

We use the Google account information solely to authenticate you, create or link your Creatorpop account, display basic account identity, maintain your signed-in session, provide account support, and protect the Service against fraud and abuse. We do not use Google user data for advertising, retargeting, credit decisions, data-broker services, or to train general-purpose artificial-intelligence or machine-learning models.

How Google user data is stored

Our authentication provider, Supabase, processes the OAuth response and stores the account identifier and basic profile fields in its authentication system. Creatorpop uses secure session cookies to keep you signed in. We do not receive your Google password. Creatorpop does not use Google access tokens to call Gmail, Drive, Calendar, Contacts, Photos, or other Google APIs.

How Google user data is shared

Google sign-in data is shared only with service providers that process it on our behalf to operate authentication, hosting, security, and account support—principally Supabase. These providers may use the data only to provide contracted services to Creatorpop. We do not sell Google user data, share it with data brokers, or disclose it to advertisers. We do not send your Google profile fields to Google Analytics.

Google API Limited Use

Creatorpop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use personal information to:

• provide, personalise, maintain, and secure the Service;
• create and authenticate accounts and respond to support requests;
• understand usage, diagnose problems, and improve features and performance;
• communicate service, security, policy, and product updates;
• prevent fraud, abuse, and violations of our terms; and
• comply with legal obligations and protect rights, safety, and property.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and improving the Service, your consent, and compliance with legal obligations, as appropriate.

We use essential cookies to keep you signed in, protect account sessions, and support password recovery. These cookies are necessary for authenticated features to work.

We use Google Analytics to measure page views, referring pages, device and browser characteristics, approximate location derived from IP address, and interactions with the website. We use this information in aggregate to understand and improve the Service. We do not intentionally send names, email addresses, Google account identifiers, or Google profile images to Google Analytics.

You can limit non-essential cookies through your browser settings or available browser privacy controls. Blocking essential cookies may prevent account features from working correctly.

We do not sell personal information or share it for cross-context behavioural advertising. We disclose only the information reasonably necessary for the following recipients and purposes:

• Supabase: authentication, account records, session management, databases, and related infrastructure.
• Google: Google Sign-In and website analytics. Google Analytics receives website usage information, not the basic Google profile fields used to create your Creatorpop account.
• Other service providers: hosting, email delivery, security, monitoring, and technical operations, where needed to provide the Service.
• Professional advisers when reasonably necessary for legal, accounting, insurance, or compliance purposes.
• Authorities or other parties when required by law or reasonably necessary to protect rights, safety, and the integrity of the Service.
• A successor organisation in connection with a merger, financing, acquisition, reorganisation, or sale of assets, subject to appropriate safeguards.

We may also share information when you direct us to do so or give consent.

We retain account information—including Google account data received for sign-in—and your Creatorpop content while your account remains active, because it is needed to provide the Service. Authentication and security logs may be kept for a limited period after an account closes to prevent fraud, investigate security incidents, resolve disputes, and comply with law. De-identified information that can no longer reasonably identify you may be retained for analytics and service improvement.

How to delete your Creatorpop data

1. Email support@creatorpop.co from the address associated with your account and request account deletion.
2. We may ask you to verify control of the account so that we do not delete information at someone else's request.
3. Once verified, we will delete or de-identify your Creatorpop profile, content, and the Google identity data linked to the account within 30 days, unless retention is required by law or needed for a documented security or dispute-resolution purpose.
4. Residual encrypted backups and security logs may persist for up to 90 days before routine deletion, and are isolated from ordinary product use.

Deleting Creatorpop does not delete your Google account. You can also revoke Creatorpop's Google access at any time from your Google Account connections. Revoking access stops future Google sign-in but does not by itself delete the Creatorpop account; use the deletion process above for that.

We use technical and organisational measures designed to protect personal information, including encrypted HTTPS connections in transit, encryption at rest provided by our infrastructure providers, access controls, secure session cookies, restricted production access, logging, rate limiting, and safeguards intended to prevent unauthorised access or disclosure.

Access to personal information is limited to authorised personnel and service providers who need it for the purposes described in this policy. No online service can guarantee absolute security, so please notify us if you suspect unauthorised access to your account.

Creatorpop and its service providers may process information in countries other than the one where you live. Where required, we use recognised safeguards for international transfers. Privacy laws in those countries may differ from those in your jurisdiction.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information; receive a portable copy; or withdraw consent. You may also have the right to complain to your local data-protection authority.

You can update some account information within the Service. For access, correction, portability, objection, or deletion requests, email support@creatorpop.co. We may need to verify your identity before completing a request, and legal exceptions may apply.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. A higher minimum age may apply where local law requires it. If you believe a child has provided personal information in violation of this policy, please contact us.

The Service may link to or integrate with third-party websites and services. Their privacy practices are governed by their own policies, not this one. Creatorpop is not affiliated with or endorsed by Instagram or Meta.

We may update this policy as the Service, our practices, or applicable law changes. We will post the updated version here, revise the effective date, and provide additional notice when a change is material.

For privacy questions or requests, email support@creatorpop.co.