Privacy policy

Streamline Social is a product of Cornerstone Industries LLC, based in Charleston, South Carolina. This policy explains what information we collect when you use Streamline Social, why we collect it, and how you can control or delete it.

We collect only what the service needs to run:

• Account information. Your email address and a password hash, handled by Supabase Auth. We never see or store your plain-text password.
• Brand profile and knowledge docs. The voice, brand, key dates, and strategy information you type in during onboarding or add later in Settings.
• Public social data about accounts you choose to track. Profile details, posts, and engagement numbers for the peer and aspirational accounts you add, gathered from public sources using Apify and the YouTube Data API.
• Connected-account data, only when you connect your own Instagram or YouTube account in Settings: your user ID, username, name, profile picture, and follower counts; your media list and per-post insights; account-level insights (reach, profile views, follower count); and follower demographics, for Instagram; your channel, videos, and statistics and analytics, for YouTube. This is stored as periodic snapshots and post metrics. The OAuth access and refresh tokens that let us read this data are encrypted at rest with AES-256-GCM and are never shown back to you or anyone else.
• Chat messages. What you send to the in-app assistant, and its replies, so the conversation has history.
• API key hashes. If you create an API key for the public API or MCP server, we store a hash of it, not the key itself.

We use your data only to show you your own analytics, recommendations, content briefs, and the assistant's answers. We do not use your data for advertising, we do not sell it, and we do not use it to train third-party models.

We share data only with the services that run Streamline Social, and only as much as each one needs:

• Supabase, which hosts our database and handles authentication, in the United States.
• Vercel, which serves the application.
• Google, whose Gemini model writes your content briefs and powers the assistant's answers.
• Apify, which we use to collect public data about the accounts you track.
• Meta and Google, the platforms whose APIs you connect to when you link an Instagram or YouTube account.

We do not share your data with anyone else, and we never sell it.

You can connect an AI assistant, such as Muse, Claude, or another tool that speaks the Model Context Protocol, to read a brand's Streamline Social analytics on your behalf - either by signing in through that assistant, or by creating an API key in Settings. Once connected:

• The assistant can read only the analytics you can already see for the brand(s) you choose - your weekly briefs, proof of what's worked, audience reads, peer data, and comment themes. It cannot post, message, or change anything.
• That data goes to the assistant's own provider (for example Anthropic for Claude, or Meta for Muse), handled under that provider's own privacy terms, once it leaves our servers in response to the assistant's request.
• You can revoke access at any time: in Settings, revoke an API key, or revoke a connected app's access directly from the same page.
• We log every tool call and API request for security, including which credential made it and when.

• Posts and snapshots for the public accounts you track are kept for as long as your brand exists in the product.
• Connected-account data (Instagram or YouTube) is kept while the connection is active, and deleted when you disconnect or within 30 days of disconnecting.
• If you delete your account, we delete your data within 30 days of the request.

You can access, correct, export, or delete your data at any time. To disconnect a connected Instagram or YouTube account, go to Settings and use the disconnect control there, which removes the stored tokens and connected-account data immediately. To request a full account deletion, see the data deletion page.

Your data is protected by row-level security in our database, encryption at rest for OAuth tokens, HTTPS everywhere, and least-privilege API keys for the services we depend on.

We may update this policy as the product changes. If we make a material change, we will update the effective date at the top of this page.

Questions about this policy or your data? Email us at cornerstoneindustriesteam@gmail.com.