Privacy Policy

1. Overview

EscapeHatch Scheduler ("the Service") is an internal tool for the Escape Hatch Podcast. This policy describes what data we collect, how we use it, and how we protect it.

2. Data We Collect

OAuth Tokens: When you connect YouTube, Instagram, or TikTok, we store OAuth access and refresh tokens in a secure database (Vercel Postgres) to publish content on your behalf. We do not store your platform passwords.

Video Files: Uploaded videos are temporarily stored in Cloudflare R2 cloud storage for the purpose of publishing to connected platforms.

Upload Metadata: We store video titles, descriptions, tags, schedule times, and platform publishing results (URLs, media IDs) in our database for upload history and duplicate detection.

Instagram Contacts: Usernames tagged or invited as collaborators are stored for autocomplete convenience in future uploads.

Login Activity: We log IP addresses of login attempts (successful and failed) for security monitoring. These logs are retained by Vercel according to their log retention policy.

3. How We Use Your Data

All data collected is used solely for the operation of the Service:

• OAuth tokens: to authenticate API calls to YouTube, Instagram, and TikTok
• Video files: to upload content to your connected platforms
• Metadata: to track upload history, prevent duplicates, and manage scheduled publishes
• Login logs: to detect unauthorized access attempts

We do not sell, share, or transfer your data to any third parties beyond the platforms you explicitly connect.

4. Data Storage & Security

Data is stored using:

• Vercel Postgres (Neon) — OAuth tokens and upload metadata, encrypted at rest
• Cloudflare R2 — video files, access controlled via presigned URLs

Access to the Service is protected by password authentication with rate limiting on failed login attempts. Session cookies are httpOnly and secure.

5. Data Retention

OAuth tokens are retained until you disconnect a platform or they expire. Upload metadata is retained indefinitely for history purposes. Video files in R2 may be retained after publishing for re-upload capability.

6. Your Rights

You may disconnect any connected platform at any time, which deletes the stored OAuth tokens. Contact the administrator to request deletion of upload history or other stored data.

7. Third-Party Services

The Service integrates with YouTube (Google), Instagram (Meta), and TikTok (ByteDance). When you connect these platforms, their respective privacy policies also apply to data processed through their APIs.

8. Changes

We may update this policy as the Service evolves. Continued use constitutes acceptance of the updated policy.

9. Contact

For privacy-related questions, contact the Escape Hatch Podcast team.