Privacy Policy

Who runs this service

youreel is run by Elizaveta Mazurova, an individual based in Sweden. We are the data controller for the personal data described here. You can reach us any time at hello@youreel.app.

What we collect

We keep this short. Here is everything:

• Your account details — the email address you sign in with (or the one Google shares when you use Sign in with Google), and your subscription status. If you request beta access, we also store the Instagram handle you give us until we process the request.
• Your Instagram data — when you connect your Instagram professional account, we read it through Meta's official Graph API. That means your profile, your posts, reels and stories, and their performance numbers. We only ever read your own account.
• Usage data — we use PostHog (EU region) to see which parts of the product get used and what breaks. It records pageviews and clicks. By default this runs without cookies and without identifying you, counting visits with a privacy-preserving hash. If you accept in the cookie notice, we set analytics cookies and link this activity to your account so we can follow it across sessions; you can decline, or change your mind later from Cookie settings in the footer.
• Error reports — when something crashes, we capture the error (through PostHog) so we can fix it. These are the technical details of the fault, not your content.
• Technical data — like any web service, our providers process your IP address and basic device and browser information. PostHog derives a rough (city-level) location from your IP for analytics; Vercel and Supabase log request metadata to run and secure the service.

We do not ask for anything we don't need, and we never buy or sell your data.

The Instagram permissions we ask for

When you connect Instagram, Meta asks you to approve two permissions. That's all we request:

• instagram_business_basic — lets us read your profile details and your list of posts, reels, and stories.
• instagram_business_manage_insights — lets us read the performance numbers for your account and your content (reach, views, and similar insights).

We use this only to build the analytics you see inside youreel. Your data is shown to you, and no one else.

Why we’re allowed to use it

Under the GDPR we rely on a few legal bases. We process your account and Instagram data to provide the service you signed up for (performing our contract with you). We process anonymous, cookieless usage data on the basis of our legitimate interest in keeping the product working and improving it, kept light-touch by design. Analytics cookies and account-linked usage data run only on your consent, which you give or withhold in the cookie notice and can withdraw at any time.

Where your data lives

Your data is stored in the European Union. We use a small set of trusted providers to run youreel:

• Supabase (EU region) — our database and authentication.
• Vercel — hosting the application.
• OpenAI— auto-detecting the purpose of your posts. When a new post of yours arrives, we may send its caption and cover image to OpenAI's API to suggest a mission tag, which you can change at any time. OpenAI processes this only on our instruction and does not train its models on it.
• Stripe— payments and subscriptions, once billing is switched on. We don't take payment today.
• PostHog (EU region) — product analytics and error reports.

Each of these acts as our processor under a standard data-processing agreement, and we prefer EU regions wherever they're offered.

Cookies

We keep cookies to the minimum. Here is everything we may set, and when:

• Sign-in cookies(strictly necessary) — Supabase sets a secure cookie to keep you logged in. Without it you couldn't stay signed in, so it needs no consent. It lasts for your session and is refreshed while you're active.
• Analytics cookies (consent) — PostHog. By default it runs in cookieless mode: no cookies, no browser storage, no identification, just a privacy-preserving hash. If you accept in the cookie notice, PostHog sets cookies so we can recognise your device across sessions and link your usage to your account. If you decline, it stays cookieless and anonymous. Nothing is tracked before you choose.

We remember your choice in your browser's local storage (itself not a tracking cookie), and you can change it any time from Cookie settings in the footer.

How long we keep it

We keep your data for as long as you have an account. If you disconnect Instagram, we delete your stored access token straight away, so we can no longer reach your account — the analytics we already gathered stay in your account until you delete it. When you delete your account, we erase your personal data. See Data deletion for the exact steps.

Your rights

The GDPR gives you rights over your data, and we honour all of them. You can:

• ask for a copy of the data we hold about you (access);
• ask us to correct anything that's wrong (rectification);
• ask us to delete your data (erasure);
• ask for your data in a portable format to take elsewhere (portability).

Email us at hello@youreel.app and we'll take care of it. You also have the right to complain to your data protection authority — in Sweden that's Integritetsskyddsmyndigheten (IMY).

Changes to this policy

If we change how we handle your data, we'll update this page and the date at the top. For anything that materially affects you, we'll let you know directly.