Privacy Policy

ReelForgeX (“the App”) is a desktop application for Windows that helps a user turn their own long videos into short vertical clips that follow a brand brief, and publish those clips to the user’s own social media accounts. This policy explains what data the App handles and where it goes.

1. The App runs on your computer

The developer of ReelForgeX does not operate servers that receive your data. There is no ReelForgeX account, no analytics and no tracking. Projects, videos, rendered clips, settings, API keys and sign-in tokens are stored only on your computer. API keys and tokens are encrypted with the Windows Data Protection API (DPAPI) and are available only to your Windows user account.

2. Services you choose to connect

The App works with third-party services only after you connect them with your own credentials. Data is sent directly from your computer to these services, under their own terms and privacy policies:

• Google Gemini (through Google AI Studio or your own Google Cloud / Vertex AI project) — the text of the brief you load, speech transcripts, short audio segments and sampled video frames are sent for analysis: to understand the brief, recognize speech, pick moments and check clips. Google Privacy Policy.
• YouTube (YouTube API Services) — when you connect a channel, the App receives an access token to read your channel name, ID and avatar, upload the clips you choose, read the statistics of videos it uploaded, and, if you use the optional warm-up feature, search public YouTube videos. By using the App you are bound by the YouTube Terms of Service; see also the Google Privacy Policy. Section 5 lists exactly which YouTube API data the App accesses, collects, stores and uses.
• Google Drive (optional) — only to download a watermark image from a folder you specify.
• TikTok (Login Kit and Content Posting API) — when you connect a TikTok account, TikTok issues tokens limited to the permissions you approve: basic profile information (display name and avatar), video upload and video publishing. The App uses them only to show which account is connected and to publish a video when you explicitly press Publish, with the visibility and settings you select. TikTok Privacy Policy.
• OpenAI (optional) — if you select OpenAI for speech recognition, audio segments are sent to OpenAI for transcription.

3. What the App does not do

• It never sees or stores your passwords: sign-in happens on the service’s own web page in your browser.
• It does not post, delete or change anything on your accounts without your explicit action.
• It does not read your messages, subscriptions, comments, watch history or other account data beyond what is listed in section 5.
• It does not sell, share or transfer your data to the developer or to advertisers.

4. Update checks

To tell you about new versions, the App requests public release information from GitHub (api.github.com). No personal data is sent; GitHub may see your IP address as with any web request.

5. How the App uses Google user data and YouTube API Data

The App uses YouTube API Services. When you connect a YouTube channel, you grant the App two OAuth scopes: https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/youtube.upload. The tables below are the complete list of Google user data and YouTube API Data the App accesses, collects, stores and uses.

5.1 What the App accesses, and why

• Your channel details (channels.list, scope youtube.readonly) — channel id, title and avatar of the channels your Google account owns. Used to show which channels are connected and to let you choose where to publish.
• Upload of your clip (videos.insert, scope youtube.upload) — the App sends the video file, title, description, tags and visibility that you chose to the channel you chose. Nothing is uploaded until you press the publish button.
• Statistics of videos the App uploaded (videos.list, part statistics, scope youtube.readonly) — view, like and comment counts of the videos the App itself uploaded. Shown on the Analytics screen.
• Public videos for the optional warm-up feature (search.list and videos.list, part contentDetails, scope youtube.readonly) — only if you use warm-up: the App searches public YouTube videos for topic keywords you set and reads the duration of the results, to build a watch plan that you review before it runs. It reads public video id, title, description and duration; it does not read anything private about other users.

5.2 What the App collects and stores

• The OAuth refresh token of each connected channel (encrypted, see section 6).
• For each connected channel: channel id, title and avatar.
• For each video the App uploaded: the video id, link, and its latest view, like and comment counts with the time they were refreshed.
• For warm-up, if used: the public video id, title, description and duration of the search results, kept inside the warm-up plan.

All of this is stored only on your computer. The developer has no copy of it. The App does not read your subscriptions, comments, messages, watch history, playlists, or any private video, and it does not read statistics of videos it did not upload.

5.3 How it is used, shared and deleted

Google user data and YouTube API Data are used solely to provide the features above on your own computer. They are never sold, never shared with third parties, never used for advertising, and never used to develop, improve or train generalized artificial intelligence or machine learning models. The only transfer is the direct call between your computer and Google’s own API. Speech transcripts and video frames sent to Google Gemini (section 2) come from your own source video and are not YouTube API Data.

Statistics are replaced with fresh values each time you refresh Analytics. Disconnecting a channel in the App deletes its stored token and revokes the App’s access; you can also revoke access at any time at https://security.google.com/settings/security/permissions. Deleting a project or the App’s data folders removes the stored video ids and statistics (section 7).

ReelForgeX’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How your data is protected

• Encryption at rest. OAuth refresh tokens, API keys and other secrets are encrypted with the Windows Data Protection API (DPAPI) through Electron’s safeStorage before they are written to disk. The encryption key is bound to your Windows user account, so another account on the same computer cannot decrypt them.
• Encryption in transit. All requests to Google APIs use HTTPS (TLS). Sign-in uses OAuth 2.0 with PKCE, and the authorization code is received on a loopback address on your own machine.
• No servers, no transfer. The developer operates no backend. Your videos, projects, tokens and Google user data are never sent to the developer, to analytics services or to advertisers.
• Least privilege. The App requests only the two scopes listed above, and only when you connect a channel.
• Your control. You can disconnect a channel in the App at any time, which deletes the stored token and revokes the App’s access, or revoke access at the Google security settings page listed below.

7. Keeping and deleting your data

Your data stays on your computer until you delete it. You can disconnect any account in the App at any time; this removes its tokens from your computer. Uninstalling the App and deleting its folders (%APPDATA%\ReelForgeX and your projects folder) removes everything. In addition to the deletion steps above, you can revoke the App’s access to your data via the Google security settings page at https://security.google.com/settings/security/permissions, and in TikTok under Settings → Security → Manage app permissions.

8. Children

The App is not directed to children under 13 (or the minimum age required in your country) and does not knowingly process their data.

9. Changes

We may update this policy. The date at the top shows the latest version.

10. Contact

Questions about privacy: open an issue at github.com/Qwirlex/reelforgex/issues.