Legal
Privacy Policy
Effective date: August 28, 2026
1. Controller & contact
Controller: Viral Ops is operated by an independent, single-operator software project based in Germany.
Responsible person: Florian Kuhn
Postal address: Hauptstraße 51, 63546 Hammersbach, Germany
Privacy / legal contact: flowkuhn@gmail.com
General / support contact: podcast8878@gmail.com
Data Protection Officer: not currently designated (not required at this operating scale under Art. 37 GDPR).
See also the Impressum for the statutory provider identification under § 5 DDG.
2. Scope
This Privacy Policy applies to the public Viral Ops informational website and to Viral Ops' use of official platform APIs — Google/YouTube, TikTok, and Meta/Instagram — in connection with the software's authorized publishing and analytics workflows for accounts you connect and are authorized to manage.
3. Public website
This public website does not require an account, does not use advertising cookies, does not use analytics tracking, and does not use marketing pixels. Hosting infrastructure may generate normal technical server logs (such as request timestamps and IP addresses) as an ordinary part of serving web pages.
4. Data we process
Viral Ops is not publicly accessible and does not offer a public sign-up, so the data below is processed only for accounts an operator has explicitly connected and authorized.
4.1 Connected platform account data
All platform connections share the same underlying account and credential model, so the same rules — authorization, storage, retention and revocation — apply uniformly across TikTok, YouTube and Instagram, except where a platform's own API only makes a narrower set of data available.
4.2 TikTok data
Where authorized by the connected TikTok account and made available through TikTok's Login Kit and Content Posting API, Viral Ops may process:
- TikTok account identifiers needed to bind the connection (such as the account's open/union identifier)
- Basic connected-account profile information exposed by TikTok's Login Kit (such as display name and avatar)
- Creator information TikTok requires to be shown and freshly confirmed before each post (TikTok Direct Post is never unattended)
- Video post identifiers and publish-status updates reported by TikTok (including via TikTok's webhook for post-publish events)
4.3 YouTube data accessed
Where authorized by the connected account and available through the YouTube Data API or YouTube Analytics API, Viral Ops may process:
- YouTube channel ID
- Channel metadata
- Uploaded video IDs
- Video metadata
- Processing / status information
- View count
- Like count
- Comment count
- Engaged views
- Watch time
- Average view duration
- Average view percentage
- Likes
- Comments
- Shares
- Subscribers gained
- Subscribers lost
4.4 Instagram data
Where authorized by the connected Instagram professional account and made available through Meta's Graph API, Viral Ops may process account identifiers needed to bind the connection, published-post identifiers, and any post-performance metrics that API exposes for that account.
4.5 Authentication data / tokens
OAuth authorization codes, access tokens and refresh tokens for each connected platform account, stored only as needed to keep that connection working.
4.6 Content / media data
References to authorized source material and the short-form clips produced from it, and the metadata (titles, descriptions, captions) attached to them for publishing.
4.7 Analytics / performance data
Performance metrics a connected platform's own analytics API makes available for content published through that connection (see §4.2–4.4 above for what each platform provides), and — where an operator records it — revenue or cost information attributed to a connected account.
4.8 Technical / log data
Ordinary technical logs (timestamps, request identifiers, error information) generated as part of operating the software and its hosting infrastructure.
5. Purposes
Connected-platform data is used only for:
- Verifying the target account and preventing publication to the wrong one
- Managing the publishing workflow for that account
- Reconciling remote publish/processing state
- Retrieving content statistics available through that platform's own analytics API
- Internal analytics / performance reporting
- Application reliability and security
6. Legal bases (GDPR)
Where the GDPR applies, processing relies on: Art. 6(1)(b) — processing necessary to perform the service the operator has requested by connecting an account; Art. 6(1)(f) — legitimate interest in operating, securing and improving the software; and, where a connected platform's own consent flow requires it (for example TikTok's per-post creator-info confirmation), Art. 6(1)(a) consent obtained through that platform's own flow.
7. Data sharing / processors
Connected-platform data is not sold. It is not shared with advertising networks. Where infrastructure or service providers necessarily process technical data to operate the application (for example, hosting or cloud infrastructure providers), access is limited to what is necessary for the service to function, under a data-processing arrangement where required by Art. 28 GDPR.
8. Platform providers
Each connected platform (Google/YouTube, TikTok/ByteDance, Meta/Instagram) separately processes data as its own controller once information reaches it, under its own privacy policy: Google Privacy Policy, TikTok Privacy Policy, Instagram Privacy Policy. This Privacy Policy covers only what Viral Ops itself does with the data it receives from those platforms.
9. Data retention
Retention is enforced by an automated sweep in the application, not only by this document. Different categories of YouTube data are governed by different rules:
| Video titles, descriptions, channel/creator names, comment text | Refreshed or deleted within 30 days. |
|---|---|
| Analytics, reporting and statistics for the authorized channel | Retained while the authorization remains active, and reconfirmed at least every 30 days. Deleted if the authorization can no longer be confirmed. |
| Statistics for channels that have not authorized Viral Ops | Deleted within 30 days. |
| Metrics Viral Ops calculates itself | Deleted within 30 days under current permissions. See “Derived metrics” below. |
| Authorization credentials (any connected platform) | Retained only while the authorization is in force; destroyed on revocation. |
The same retention and deletion mechanism applies to data obtained through TikTok and Instagram: it shares the same underlying credential and account model as the YouTube connection described in the table above, and is reviewed on the same schedule.
10. Derived metrics
Viral Ops calculates some figures of its own from platform data — for example an engagement rate or a views-per-hour rate. These are not platform-supplied metrics. They are generated independently by Viral Ops, are not sourced from or approved by TikTok, YouTube, or Instagram, and are labelled as Viral Ops-derived wherever they are displayed alongside data supplied by a platform's own API.
Viral Ops has applied for the additional YouTube API data policy that would permit extended storage of statistical and derived data for up to 36 calendar months. That application has not been granted. Until and unless Google approves it, Viral Ops applies the ordinary retention rules described above and does not rely on the extended period. Video titles, creator names, descriptions and comment text remain subject to the 30-day rule regardless of that decision.
11. Deleting your stored data
You may ask Viral Ops to delete the data it has stored for a connected account. The application provides this as an explicit action (for YouTube: YouTube → Data & privacy → Delete stored YouTube data), and requests for any connected platform can also be sent to flowkuhn@gmail.com.
On such a request, stored platform API data is deleted as soon as practical and in any case within 7 calendar days. In practice the deletion is performed immediately when the request is made.
12. Revocation
There are two independent ways to withdraw authorization for any connected platform, and they carry different deletion timelines:
- Through Viral Ops. The application provides a disconnect action that revokes the token with the platform immediately and deletes the data stored under that authorization within 7 calendar days (in practice, immediately).
- Through the platform itself.
- TikTok: revoke Viral Ops' access from TikTok's own app settings (TikTok app → Profile → Settings and privacy → Security → Manage app permissions, or the equivalent web settings page).
- Google/YouTube: revoke access at any time from the Google security settings page (also reachable at myaccount.google.com/permissions).
- Instagram/Meta: revoke access from Meta's Business Integrations settings, reachable from your Instagram or Facebook account settings under Apps and Websites.
After revocation by either route, Viral Ops can no longer perform authenticated API requests using that authorization.
13. Security
Authorization tokens are encrypted at rest and are never exposed in the application's public responses, logs, or frontend. See the Security page for more detail on account authorization and platform boundaries.
14. International transfers
Some infrastructure or platform providers Viral Ops relies on (for example hosting infrastructure, or the platform providers themselves — Google, ByteDance/TikTok, Meta) may process data outside the European Economic Area. Where that happens, it relies on the safeguards those providers themselves provide for such transfers, such as the EU Standard Contractual Clauses, where applicable.
15. Your rights (GDPR)
Where the GDPR applies to you, you have the right to request access to, rectification of, or erasure of your data; to restrict or object to its processing; to data portability; and to lodge a complaint with a supervisory data-protection authority — in particular the one in the EU member state of your habitual residence, place of work, or the place of an alleged infringement. To exercise any of these rights with Viral Ops directly, contact flowkuhn@gmail.com.
16. Children
Viral Ops is not directed at, and is not knowingly used to process data about, children under the age of 16. It is an operator/creator tool, not a consumer product aimed at minors.
17. Google Privacy Policy
Data that Google receives in connection with the YouTube API Services is handled according to the Google Privacy Policy.
18. Google API Services User Data Policy
Viral Ops' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, where applicable. This is a separate document from the Google Privacy Policy linked above.
19. YouTube Terms
YouTube-related functionality is subject to the YouTube Terms of Service, and Viral Ops operates as an API Client under the YouTube API Services Terms of Service and Developer Policies.
20. Changes to this policy
This policy may be updated. Material changes are reflected in the effective date above, and the operator of Viral Ops must acknowledge the current version of this policy within the application before any new platform authorization can be started.
21. Contact
Questions about this Privacy Policy, and privacy/data requests, can be sent to flowkuhn@gmail.com. General product questions go to podcast8878@gmail.com.