Privacy policy

The short version

• Rendering happens on your machine. Your footage, projects and renders stay there unless you keep them in raea storage or publish them.
• raea keeps what it needs to run your account and do what you ask, and nothing to sell. raea doesn't sell or rent personal data, and doesn't use it for advertising.
• raea posts to a social account only when you press Publish. An agent can draft a post; it can't send one.
• You can remove a connected account, delete what you've stored, or delete your account at any time.

Who we are

raea (raea.io, the raea app, and the service at api.raea.io) is made by Shinyobjectz LLC, which is responsible for the data described here (the data controller). Questions about this policy or your data go to [email protected].

What raea keeps

• Your account: your email address, and the id of the account you signed in with (GitHub, Google or Apple). raea never sees those passwords.
• Your devices: a name for each computer you've signed in on, and a token that lets it act as you. The token is stored only as a hash.
• Your storage: files you choose to keep in raea storage (renders, footage, project media), with their size and fingerprint. They're kept in Cloudflare R2.
• Connected accounts: for each account you connect (YouTube, Google Drive, TikTok, Instagram, Facebook Pages, Threads, LinkedIn, X, Bluesky, Slack, Discord), its id and name, the permissions you granted, and the access tokens the network gave raea. Tokens are encrypted before they're stored and are never shown to the raea app or anyone else.
• Posts: what you published or scheduled, where to, the caption and fields you chose, and what each network answered (the post's id and link, or the error).
• Billing, if you pay: your plan and usage. Payments are handled by Stripe; raea never sees your card number.
• The waitlist, if you joined it: your email address.
• Service logs: requests to api.raea.io are logged by Cloudflare for security and debugging, and kept for a short time.

raea.io doesn't use advertising trackers or third-party analytics.

Connected accounts and publishing

When you connect a network, raea asks for the narrowest permissions that let it do what you asked: to read your account's name and id, list the pages or channels you can post to, and upload and publish the videos you choose. raea uses them only to show you those destinations and to publish what you press Publish on, at the time you choose. It doesn't read your feed, messages, followers or other content, and doesn't post anything on its own.

Removing a connection in the raea app deletes its tokens from raea and asks the network to revoke raea's access. You can also revoke raea from the network's own settings at any time; raea then marks the connection as needing to reconnect.

Google user data

raea's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. raea uses Google sign-in to identify you; the YouTube Data API to upload the videos you publish to your channel and to name that channel; and Google Drive (only files you pick in Google's picker) to bring those files into raea. Google user data is not used for advertising, not sold, not used to train AI models, and not read by people except with your permission, for security, or where the law requires it.

Who else handles your data

• Cloudflare runs api.raea.io, its database and raea storage.
• Stripe handles payments.
• The networks you connect receive the videos and captions you publish to them, under their own privacy policies.

raea shares personal data with no one else, except where the law requires it.

How long raea keeps it

Your account, storage, connections and posts are kept while your account exists. Stored files you delete are removed from storage. A connection you remove is deleted right away. When you delete your account, raea deletes all of it within 30 days, except billing records the law requires raea to keep.

Deleting your data

Remove a connected account in the raea app (Settings, then Connections), or revoke raea from the network's settings. To delete your account and everything raea keeps for it, email [email protected] from your account's address; raea confirms when it's done. The same address handles any request to see, correct or export your data.

Security

Everything travels over HTTPS. Network tokens are encrypted with AES-GCM before they're stored, device tokens are stored only as hashes, and stored files are reached only through short-lived signed links.

Children

raea isn't meant for children under 13, and doesn't knowingly keep their data. If you believe a child has an account, write to us and it will be deleted.

Changes

When this policy changes, this page shows the new date. A change to what raea keeps or who it shares data with is announced in the raea app before it applies.