Privacy Policy

Who we are

Seinbaken is a service that publishes video content to social media platforms on behalf of its users. It is operated by Polat Digital, a company registered in the Netherlands, which is the data controller for everything described in this policy.

How to reach us

We answer within two working days. There is no telephone line: a written question gets a written answer we can both look back at.

What we collect

We collect only what the service needs to work:

• Account data: your email address and an encrypted password hash.
• Social account connections: when you connect a platform such as TikTok, Instagram, YouTube, Pinterest, Facebook or LinkedIn, we store the access and refresh tokens that platform issues, your account identifier on that platform, and your public display name.
• Content you upload: video files, captions and the settings you choose for each destination.
• Publishing records: which posts were sent where, whether they succeeded or failed, and the identifiers the platforms returned.
• Performance data: view, like and comment counts that platforms report for posts you published through Seinbaken. On a connected YouTube channel we also read the list of videos already on that channel, with their titles, publication dates and the same public counts, so you can see them alongside the ones we published for you.

How we use it

Your data is used to publish your content to the platforms you selected, at the time you chose when you schedule a post, to show you the status and performance of those posts, and to support you when something fails. If we introduce paid plans, we will also use your account data to bill you. We do not sell your data. We do not use your content, or any data we receive from a connected platform, to develop, improve or train artificial intelligence or machine learning models. We do not post anything you did not explicitly ask us to post.

Platform access tokens

Access tokens are the keys that let Seinbaken publish on your behalf. We encrypt them at rest using AES-256-GCM, we never expose them to your browser or to any other user, and we request the minimum permissions each platform offers for publishing. You can disconnect any platform at any time from your account page, which deletes the stored tokens for that platform immediately.

YouTube API Services

Seinbaken uses YouTube API Services to publish to YouTube. When you connect a YouTube channel, Seinbaken reads the channel's name and identifier so you can see which channel you connected, uploads the videos you submit, and reads the status of those uploads to confirm they succeeded. It also lists the videos on that channel and reads the public view, like and comment counts for them, which is what the figures screen shows you. Once a day we write down each video's view, like, comment and share counts and the date it went up, and nothing else about it, so the figures screen can show what each day added. We read nothing from any channel you have not connected. This data is handled as described in this policy, and Google's handling of your data is governed by the Google Privacy Policy. Besides disconnecting YouTube from your account page, you can revoke Seinbaken's access to your Google account at any time via Google security settings.

Who we share Google user data with. The Google user data Seinbaken receives — your YouTube channel name and identifier, the videos you submit, the upload status of those videos, and the list of videos on your channel with their public view, like and comment counts — is disclosed only to the service providers named under “Who we share your data with” below (Railway, for hosting and the database; Cloudflare, for storing the video file; Anthropic, only for the suggested replies and translations described there), and to YouTube itself when you publish or reply. For a suggested reply, Anthropic receives the text of the YouTube comment you open, the commenter's display name, your video's title and a few of your own earlier replies, and nothing else. For a translation, which happens only when you press Translate, it receives the text of that one comment or reply, and nothing else. It is shared with no one else. It is not sold, not transferred for advertising, not disclosed to data brokers, and not used to develop, improve or train generalised artificial intelligence or machine learning models. It is protected by the measures described under “How we protect your data” below, including AES-256-GCM encryption at rest for the tokens that grant access to your channel.

Seinbaken's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Seinbaken also complies with the YouTube Terms of Service.

Who we share your data with

We name every party. There are no others.

Service providers, each acting only on our instructions:

• Railway (Railway Corp., USA) hosts the application and provides the PostgreSQL database holding your account, your platform connections and your publishing records, and the Redis queue that holds scheduled posts.
• Cloudflare (Cloudflare, Inc., USA) provides the R2 object storage where your uploaded video files are kept, and our DNS.
• Resend (Resend, Inc., USA) delivers the email we send you — confirming your address, resetting your password, and telling you when something needs your attention. It receives your email address and the contents of that message, and nothing else.
• Anthropic (Anthropic, PBC, USA) writes the suggested replies under comments on YouTube, Instagram, Threads and Facebook. When you open a comment that is waiting for an answer, or ask for a suggestion, its text, the name of the person who wrote it, the title or caption of your post and a few of your own earlier replies are sent to Anthropic's API, which returns a suggestion marked as an AI suggestion. Nothing is posted until you press send. Anthropic processes this only to write the suggestion and does not use it to train its models. When you press Translate under a comment or a reply, the text of that comment alone is sent to Anthropic's API, which returns it in your language; the translation is stored with your account so the same comment is not sent twice. The same terms apply: only to translate, never to train.

Platforms you choose to publish to:

When you publish, the video, the caption and the settings for that destination are sent to that platform's API: YouTube (Google LLC), TikTok, Instagram, Threads and Facebook (Meta Platforms), LinkedIn, and Pinterest. This happens only for destinations you select. What each platform does with the content afterwards is governed by its own terms and privacy policy.

A main channel, if you switch one on:

A main channel reverses the direction: you keep posting in the Instagram or TikTok app itself, and we carry each new video on to the platforms you ticked. To do that we fetch, from the platform you named as your main channel, the video file, its caption and the date it was posted. For TikTok that copy comes from TikTok's Data Portability API, which delivers it as an export TikTok prepares itself.

This happens only while you have a main channel switched on, only for the account you connected yourself, and only for videos posted after you switched it on — never for anything already in your back catalogue. We ask for your posts and your basic profile and nothing else: not your direct messages, and not your watch history, likes or searches. Turning the main channel off, or disconnecting the account, stops every further request at once and deletes the stored tokens for it. The videos we fetched are kept and deleted on exactly the same terms as the ones you upload yourself, set out below.

We do not sell your data. We do not share it with advertisers or data brokers. We run no advertising trackers anywhere, and we do not process payments today; if we introduce paid plans we will name the payment provider here before it goes live, and we will tell you by email first.

What we store on your device

Seinbaken places and reads a small amount of information on the device you use it with. This is the complete list. There is no advertising cookie, no tracking pixel and no third-party script that reads any of it, and nothing here is shared with anyone.

• A session cookie named sid, set when you sign in on the website. It holds a random token, nothing about you. It is httpOnly, so scripts in the page cannot read it, and it expires thirty days after you sign in, or immediately when you sign out.
• Two entries in your browser’s local storage. nieuw:kanalen remembers which channels you last posted to, so the compose screen starts where you left off. sb.onboarding.verborgen remembers that you closed the introduction, so it stays closed. Both stay in your browser, are never sent to us, and you can clear them with your browser’s own site data controls.
• In the iOS app, the session token is kept in the system keychain under seinbaken.sessie rather than in a cookie, and the same remembered channel set is stored under nieuw.kanalen. Both are removed when you sign out.

No Google user data, and no data obtained from the YouTube API Services, is ever written to your device beyond what is on screen while you are looking at it.

Counting visits to this website

Our public pages count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser, does not fingerprint you, and cannot follow you to any other website. It records the page, the country, the kind of device, and where the link came from, all of it aggregated. None of that identifies you, so there is nothing here for us to link to an account or to hand back to you on request.

It runs on the public pages only. It is switched off everywhere behind the login, and the iOS app contains no measurement software of any kind. There is no session recording, no heatmap, and no advertising pixel on any surface we operate.

How we protect your data

• All traffic runs over HTTPS (TLS). We send HSTS, so browsers refuse to connect to us any other way.
• Platform access and refresh tokens are the most sensitive data we hold, and they are encrypted at rest with AES-256-GCM. The encryption key is held in the application environment and never in the database, so access to the database alone does not reveal any token.
• Tokens are never sent to your browser, never displayed in the interface, and never readable by another user.
• Passwords are stored only as salted scrypt hashes. We cannot read your password and cannot recover it, only reset it.
• Sessions use httpOnly cookies, which scripts running in the page cannot read.
• Your video files are never in a public bucket. When a platform needs to fetch one, we issue a signed link that expires after six hours, which is long enough for a large upload to finish and no longer.
• We request the minimum OAuth scopes each platform offers for publishing, so a stolen token grants as little as possible.
• Access to production systems is limited to the people who operate Seinbaken.

How long we keep it

Video files are retained while your account is active and deleted within 30 days of deletion of the post or the account. Publishing records are kept for as long as your account exists so you retain your own history. The daily counts for each video on a connected channel are kept for as long as that channel stays connected, and are deleted when you disconnect it or delete your account. Once we bill for paid plans, invoices will be retained for seven years, as Dutch tax law requires.

Deleting your data

You can delete your account at any time from your account settings. Deleting your account removes your profile, your connected platform tokens, your uploaded videos, any video fetched from a main channel, and your publishing history from our systems within 30 days. You can also email privacy@seinbaken.com from your registered address and we will action the deletion within 30 days. Content already published to a social platform stays on that platform; delete it there.

If you cannot sign in, or you never finished signing up, use the deletion request form. It needs nothing but your email address, it gives you a reference on the spot, and it is the same 30 days.

Your rights

Under the GDPR you can request access to your data, correction of it, deletion of it, a portable copy of it, and you can object to processing. Write to privacy@seinbaken.com. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Changes

If this policy changes materially we will notify you by email before the change takes effect.