Privacy Policy
Last updated: October 15, 2026 · Português
This is an English version of our privacy policy. If it differs from the Portuguese version, the Portuguese one prevails.
Subiu is a tool that publishes your videos to social networks at the date and time you choose. To do that, it needs to keep some of your data. This page says exactly what, why, for how long, and how to delete it.
In short: we keep your video, your caption, your schedule and an access authorization for the networks you connected. We use it for one thing only: publishing what you told us to publish. We do not sell any of it, we do not use it for advertising and we do not use it to train AI models.
Who is responsible
Subiu is operated by Rubens Pinho de Sá (individual), in São Caetano do Sul, São Paulo, Brazil. For anything about this policy, including access or deletion requests: rubens@obarbeirodacidade.com.br.
What we keep
| Data | What for |
|---|---|
| Name and email | To identify your account and talk to you about it. |
| Password | To sign in to your account. We only keep a cryptographic hash (scrypt) of the password — not even we can read the original. |
| Videos and photos you upload | To publish to the networks you choose. Instagram and TikTok download the video or photo from the stored file at publishing time. Photos are converted to JPEG (and, if needed, cropped from the center) in your own browser, before upload. |
| Captions, hashtags, titles and times | To build the post and publish it at the right moment. |
| Access authorization for connected networks | To publish on your behalf. Explained in detail in the next section. |
| Usage records | Date and time of access, IP address and browser, for account security; and the history of what was published, so you can check it later. |
Social network data
When you connect an Instagram, Facebook, Threads, YouTube or TikTok account, the network gives us an access authorization (token) and some basic profile information: the account ID, display name, @handle and picture. We keep this to show which account is connected and to be able to publish.
What we do with that authorization
- We use it to publish the content you scheduled, to check the network's own limits (for example, how many posts still fit in the next 24 hours) and, on Instagram and YouTube, to read the numbers of your posts (on Instagram: views, reach, likes, comments, shares and saves; on YouTube: views, likes, comments and total subscribers).
- These numbers are shown only to you, on the Results page, and are used to calculate the reach estimate when you schedule. The calculation happens inside Subiu: these numbers are not sent to any artificial intelligence service.
- Tokens are stored encrypted (AES-256-GCM) in a database that not even the part of the system that renders your screens can access. Only the publishing process can read them.
- We only ask for the permissions needed to publish and to read the numbers of your own posts. We do not ask for access to your direct messages or to your follower list.
What we don't do
- We do not sell, rent or share data obtained from the platforms.
- We do not use this data for advertising, to build profiles of people or to train artificial intelligence models.
- We do not publish anything you have not scheduled.
- We do not read or access third-party content in your account.
How to cut access
At any time you can click Disconnect on Subiu's Accounts page. We immediately delete the authorization (token), the name, the picture and the post numbers that came from that network; and, for YouTube, we ask Google to revoke the authorization within one minute. You can also revoke it from the network's own app, in its connected apps settings — in that case Subiu can no longer publish there and deletes the data it received from that network within 7 days.
YouTube and Google
Subiu uses the YouTube API Services to upload the videos you scheduled to your channel. By connecting a channel, you agree to the YouTube Terms of Service, and the data sent to YouTube is also handled under the Google Privacy Policy.
- What we access: the channel ID, name, @handle and picture (to show which channel is connected), the permission to upload videos and, for the channel's own videos, the title, thumbnail, duration and numbers (views, likes and comments), plus the total subscriber count — shown only to you, on the Results page. We do not read comment text, the subscriber list or anything about viewers.
- What we do: we upload the video, title, description and visibility that you chose, at the scheduled time. Nothing is published without a schedule from you.
- Who we share it with: no one. YouTube data stays on our server and only goes to YouTube itself.
- For how long: the channel name and picture are refreshed from YouTube at least every 7 days; video numbers every 6 hours. All of it is deleted within 7 days after you disconnect or revoke access (immediately when you use the Disconnect button).
- How to revoke: with the Disconnect button in Subiu or on your Google Account permissions page: security.google.com/settings/security/permissions.
Subiu shows no ads and uses no tracking cookies — only the session cookie that keeps you signed in.
How long we keep data
- Videos and photos: the file is deleted 30 days after publishing. The record (name, date, where it went) stays in your history. A video you never published stays until you delete it.
- Network tokens: until you disconnect the network, delete your account, or the token expires without renewal. When you disconnect, they are deleted immediately; if you revoke from the network itself, within 7 days.
- Login sessions: 30 days, or until you sign out.
- Account and history: while the account exists.
- Backups: one per day, kept for 30 days. A deleted account leaves the backups within 30 days and is never restored.
Where data is stored
The application and the database run on an Oracle Cloud server in the São Paulo region, Brazil. Video and photo files are stored on Cloudflare R2. These two providers are processors: they host the data for us and do not use it for their own purposes.
At publishing time, the video and caption are sent to the platform you chose (Meta, Google or TikTok), which then handles them under its own privacy policy.
AI caption suggestions
On the schedule page there is a “Suggest caption and hashtags with AI” button. Only when you click it, Subiu sends Google Gemini the video's audio (up to 10 minutes, compressed) and four frames taken from it, to get back a transcript and suggested caption, hashtags and title. The whole video is not sent.
- We use Gemini's free tier, under which Google may use the content sent to improve its products, according to the Gemini API Additional Terms. If the video has something you don't want to leave Subiu, don't use the button.
- The transcript and suggestions are stored in Subiu, linked to the video, so they don't need to be requested again. They are deleted together with the video.
- Nothing the AI suggests is published unless you choose and schedule it.
Your rights
Under Brazil's General Data Protection Law (LGPD, Law 13,709/2018), you may at any time ask to access, correct, take away (portability) or delete your data, and you may withdraw the consent you gave.
Most of this you can do yourself, inside Subiu. For the rest, write to rubens@obarbeirodacidade.com.br — we reply within 15 days.
To delete everything, there is a page just for that: how to delete your data.
Security
- All traffic is encrypted (HTTPS).
- Passwords are stored only as a salted cryptographic hash.
- Network tokens are encrypted and isolated in an area of the database that the system's screens cannot reach.
- The database separates data per user in the storage layer itself, not just in code — even a programming mistake does not show one account's content to another.
- The server does not expose any port directly to the internet.
No system is perfect. If an incident happens that may put you at risk, we will tell you by email and notify the ANPD (Brazil's data protection authority), as the law requires.
Children
Subiu is not intended for anyone under 18, and we do not knowingly collect data from children or teenagers.
Changes to this policy
If something changes, we update the date at the top of this page. If the change matters to you, we tell you by email before it takes effect.