Privacy Policy

The short version

OmniPulse reads analytics for the social accounts you choose to connect, so it can tell you what is working. We do not sell your data, we do not run advertising or analytics trackers, and the only cookies the app sets exist to sign you in and keep you signed in. This public website sets no cookies at all.

This website

The public pages (home, pricing, about, and these policies) are static pages. They set no cookies, store nothing on your device, load no third-party scripts, and include no analytics or advertising. Our hosting provider processes your IP address and the request (for example the page and your browser's user agent) to deliver the page and protect the site from abuse. If you email us, we use your message and address to reply.

What we collect

• Account details. Your email address and a hashed password. We never store the password itself, only a scrypt hash of it. If you sign in with Google instead, we receive your email address and whether Google has verified it (the openid and email scopes), and use it only to create and sign in to your account.
• Connected platform accounts. When you connect YouTube, TikTok, Instagram, or X, we store the access and refresh tokens that platform issues, the permissions you granted, and the account's public profile (ID, name, handle, profile picture). Tokens are encrypted with a key unique to your workspace.
• Content and metrics. Metadata about your posts (titles, captions, formats, timestamps, URLs) and their performance metrics, retrieved from those platforms' official APIs. The platform sections below list exactly what we read from each.
• Files you import. If you upload a platform data export, we parse it into your workspace. Imported data is labelled as such so it is never mistaken for first-party API data.
• Things you type. Prompts and conversations with the AI Coach, and the notes and ideas you save.
• Coach memory. Facts the AI Coach saves about your channel during a conversation, so later conversations can use them.
• Media you upload. Videos and images you upload to publish, for repurposing, or for thumbnails, the clips and variants generated from them, and the speech-to-text transcripts produced from your videos.
• Posts you schedule. The title, description, tags, visibility, and publish time of posts you schedule, and the result the platform returns when they are published.
• Comments and messages. If you turn on the inbox for a connected account, the comments on your posts and the direct messages sent to that account, including the sender's public name, handle, and platform ID, and the replies you send from OmniPulse. See “People who comment on or message you” below.
• Competitors you track. Public data (channel and post metadata and public metrics) about creators you choose to track as competitors, retrieved from the platforms' public APIs. This is third-party public data, not data from their private analytics.
• Push subscriptions. If you turn on browser notifications, the Web Push subscription endpoint and keys your browser gives us, so we can deliver alerts.
• IP address and request logs. Your IP address is used to rate-limit sign-in and sign-up attempts, and our services keep request logs for security and debugging.
• Browser extension data. If you install the OmniPulse browser extension, the limited page data described in the “Browser extension” section below.
• Billing details. Your plan, subscription status, and billing email. Card numbers are handled by Stripe and never reach our servers.

What we do not collect

• No advertising, analytics, or tracking cookies. There is no Google Analytics, no pixel, no session recorder.
• No cross-site tracking, and no profile of you built from activity elsewhere on the web.
• No access to your platform accounts beyond the permissions you grant. Connecting an account asks only for read access. Permission to publish videos or to reply to comments and messages is requested separately, only when you turn that feature on, and is only used when you ask OmniPulse to act.
• No card numbers or full payment details.

YouTube and other Google data

OmniPulse uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

OmniPulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, permission by permission

• Google sign-in (openid, email), only if you choose “Continue with Google”: your email address and whether it is verified.
• View your YouTube account (youtube.readonly), requested when you connect a channel: your channel's ID, title and thumbnail, the list of videos you have uploaded, and each video's title, description, publish time, duration, privacy status, and public statistics (views, likes, comment counts). For channels you choose to track as competitors we read the same public information.
• View YouTube Analytics reports (yt-analytics.readonly), requested when you connect a channel: aggregate reports for your own channel through the YouTube Analytics and YouTube Reporting APIs, such as daily views, watch time, likes and subscribers gained per video, traffic sources, device types, and audience-retention curves. These reports are aggregates; they do not identify individual viewers.
• Upload videos (youtube.upload), only if you turn on publishing for a channel: used solely to upload the videos you schedule in OmniPulse, with the title, description, tags, and visibility you chose, and to set the thumbnail you chose for them. It is used only when a post you scheduled is due.
• Manage your YouTube comments (youtube.force-ssl), only if you turn on the inbox for a YouTube channel. OmniPulse can request this permission, but it does not yet read, post, or moderate YouTube comments with it; today the inbox syncs Instagram only. When YouTube comment features ship, this section will say exactly what they do before they are used.

How we use it

Only to provide the features you see in OmniPulse: showing your channel's performance, computing velocity and performance scores against your own history, alerts about your videos, tracking the competitors you chose, the AI Coach's answers about your channel, and publishing the videos you scheduled. We do not use Google user data for advertising, we do not sell it, we do not use it to determine credit-worthiness or for lending, and we do not use it to develop, improve, or train generalised AI or machine learning models. People at Alex Software Holdings LLC do not read your Google user data unless you ask us to (for example in a support request), it is needed for security purposes such as investigating abuse, or the law requires it.

How we share it

Only with the service providers listed under “Who your data is shared with”, and only to run the features above: our hosting and database providers store it, and when you use the AI Coach or AI idea generation, the relevant channel data and your question are sent to the AI provider that produces the answer. We do not transfer Google user data to anyone else, except as required by law or as part of a merger or acquisition with notice to you.

How we store and protect it

Google access and refresh tokens are encrypted with a per-workspace key and only our identity service can decrypt them. Your channel data is stored in our databases scoped to your workspace; see “How it is protected” below.

Retention and deletion

We keep YouTube data while the channel is connected, on the schedule in “Retention” below. Disconnecting the channel deletes its stored tokens, asks Google to revoke OmniPulse's access, and stops all collection, and the data we collected from the channel is deleted within a few hours and never later than 7 days. If you revoke access from your Google Account instead, we delete that data 7 days after we detect the revocation, so reconnecting within that week keeps your history. Public statistics about competitor channels you track are kept for at most 30 days, after which we fetch them again or drop them. Deleting your workspace deletes all of it. The data deletion page explains both.

How to revoke access

Disconnect the channel in Settings → Connections, or remove OmniPulse at any time from your Google Account's third-party access settings (https://security.google.com/settings/security/permissions). Once access is revoked we can no longer read anything from your channel.

Instagram and Facebook data

Instagram accounts connect through Facebook Login, because Instagram's analytics are only available for professional (Business or Creator) accounts linked to a Facebook Page. With the permissions you grant, we access:

• Your Facebook Pages and linked Instagram account (pages_show_list, business_management, pages_read_engagement): the list of Pages you manage, to find the Instagram professional account linked to one of them, and an access token for that Page. We also read which permissions you granted, so the app only offers what you allowed.
• Your Instagram profile and posts (instagram_basic): username, name, profile picture, follower and following counts, and your posts, reels and stories (caption, media type, permalink, timestamp, like and comment counts).
• Insights (instagram_manage_insights): aggregate performance metrics for your account and your media, such as reach, views, saves, shares, and profile views, including story metrics delivered to us by Instagram webhooks before the story expires. We also use Instagram's Business Discovery feature to read public profile and post data of competitor accounts you choose to track.
• Comments and messages (instagram_manage_comments, instagram_manage_messages, pages_manage_metadata), only if you turn on the inbox for that account: comments on your media and the direct messages sent to your account, so you can read, prioritise, hide, delete, and reply to them in OmniPulse; and a webhook subscription on your Page so new comments and messages arrive promptly.

We use this data only to show you your own performance and inbox and to act when you ask (send a reply, hide or delete a comment). We do not sell it, use it for advertising, or share it except with the service providers listed below. You can remove OmniPulse from your Facebook account's business integrations settings at any time, and request deletion as described on the data deletion page.

TikTok and X data

For TikTok we request user.info.basic, user.info.profile, user.info.stats, and video.list: your profile, follower counts, and your videos with their public statistics. For X we request tweet.read, users.read, and offline.access: your profile and your posts with their metrics. Both are read-only and used the same way as the data above.

Cookies and device storage

• op_session holds your signed session so you stay logged in to the app. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, and HTTPS-only in production. Signing out deletes it.
• op_g_state and op_g_verifier are set only while you sign in with Google, to protect that sign-in against forgery. They are HttpOnly and expire after five minutes.
• All of these are strictly necessary for signing in, so there is no consent banner. There are no advertising, analytics, or third-party cookies, and we do not let third parties serve content or advertisements in OmniPulse.
• If you turn on browser notifications, your browser stores a service worker and a push subscription for OmniPulse. Turning notifications off removes the subscription.
• The browser extension keeps its sign-in tokens, a random device identifier, and a cached copy of its configuration in the browser’s extension storage. Removing the extension deletes them.
• The public website stores nothing on your device.

Who your data is shared with

We share data with the following processors, only to the extent needed to run the service:

• The platforms you connect (YouTube, TikTok, Instagram, X). Requests carry your token so they can return your own data, and, when you publish or reply, the video, post, or message you chose to send.
• AI providers (Anthropic, OpenAI). When you use the Coach, AI idea generation, or ask for a suggested reply in the inbox, the relevant content is sent to the configured provider to produce a response. For a suggested reply that is the comment or message you are answering, up to the 20 most recent messages of that conversation (including the other person's handle), any note you add, and a short summary of your writing style from your creator profile.
• Stripe, for subscription billing.
• Resend, for transactional and alert email. It receives your email address and the content of the email (for example an alert about one of your posts).
• Browser push services (operated by Google, Mozilla, or Apple depending on your browser). Only if you enable Web Push: the alert text is delivered through your browser's push endpoint.
• Amazon Web Services (AWS) and our other hosting and database providers, which run the service and store the data at rest, including an archive of the raw responses returned by platform APIs.
• Cloudflare, which hosts this public website and processes the requests made to it.

We do not sell your data, and we do not share it for advertising. We may disclose data if the law requires it.

How it is protected

• Platform tokens are encrypted with a per-workspace key. Only the identity service decrypts them; other services get a short-lived access token from it when they need to call a platform, and never store it.
• Every request is tied to your workspace by a signed session, and every database query is scoped to that workspace.
• Passwords are stored as scrypt hashes, never in plain text or reversible form.
• Sessions are short-lived signed tokens rather than long-lived credentials.

Browser extension

The OmniPulse browser extension is optional. It only runs on YouTube (including YouTube Studio), TikTok, Instagram, and X pages, and talks only to the OmniPulse API.

• To show overlay metrics, it sends our API the platform content IDs of the videos or posts on the page you are viewing, along with the platform and the kind of page. This can include other creators’ public videos that appear on that page.
• It computes a hashed form of the page address to recognise which page you are on. That hash, your search terms, and the titles you type in YouTube Studio are processed inside the extension and are not sent to us.
• When you use the Coach, save an idea, or open the dashboard from the side panel, it sends what you typed plus the content ID, platform, and page type of the page you are on.
• Assisted capture (TikTok and Instagram) is off by default. Only after you give explicit consent does it read the analytics shown on your own creator analytics pages; it refuses other creators’ profiles, feeds, and search pages. You can revoke that consent at any time.
• It does not read your messages, passwords, or cookies, and it does not see your browsing on any other website.

People who comment on or message you

When you turn on the inbox, OmniPulse processes personal data about people who are not OmniPulse users: those who comment on your posts or send you direct messages. We process it on your behalf, only to show it to you, to help you prioritise and reply, and to send the replies you write.

• We store what the platform gives us: their public name, handle, and platform ID, and the text and attachments of their comment or message.
• We do not use it to build profiles, for advertising, or for anything other than your inbox.
• It is deleted when you turn off the inbox or disconnect the account, and when you delete your workspace.
• Someone who wants their comments or messages removed from OmniPulse can ask you or contact us at the address below.

Retention

• Account and workspace data is kept while your workspace exists.
• Data collected from a YouTube channel is deleted within 7 days of disconnecting it in OmniPulse, and 7 days after we detect that access was revoked from your Google Account.
• Public statistics about YouTube competitor channels (subscriber, view, like and comment counts) are kept for at most 30 days.
• Raw metric snapshots are kept for 400 days.
• Hourly metric rollups are kept for 180 days.
• Daily metric rollups are kept for the life of your workspace, because long-term trends are much of the point of the product.
• Videos you upload are kept until you delete them or your workspace is deleted.
• Inbox comments and messages are kept while the inbox is on for that account, and deleted when you turn it off or disconnect the account.
• Data exports you request stay available to download for 7 days, then are deleted.
• When you delete your workspace, its data is deleted, except financial records we are legally required to keep, which are retained in anonymised form.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing.

You can export a copy of your workspace data or permanently delete your workspace yourself from Settings → Privacy & your data. Export produces a downloadable archive of your data (excluding secret material such as password hashes and platform tokens); the delete removes your workspace across our databases. Financial records we are legally required to keep are retained in anonymised form, and a deletion confirmation is recorded in our audit log. If a deletion is subject to a legal hold or a financial-record retention requirement, it is refused until that hold lifts.

If you would rather we handle a request for you, email info@alexsoftwareholdingsllc.com and we will act on it within 7 days. You can disconnect a platform account yourself at any time from Settings → Connections. Disconnecting deletes its stored tokens and asks the platform to revoke access where the platform supports it. Step-by-step instructions are on the data deletion page.

Children

OmniPulse is not directed at children. You must be at least 13 years old, and old enough to hold accounts on the platforms you connect, to use it. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change how data is handled in a way that affects you, we will update this page and the date at the top of it.

Contact

Questions about this policy: info@alexsoftwareholdingsllc.com. OmniPulse is operated by Alex Software Holdings LLC.