Privacy Policy - NewsShorts Studio

This Privacy Policy explains how DT (“we”, “us”) handles information in connection with NewsShorts Studio (the “Service”). It should be read together with our Terms of Service. By using the Service you acknowledge the practices described here.

Who We Are and Scope

NewsShorts Studio is a self-hosted web application that turns publicly available news stories into short AI-assisted videos and picture posts and publishes them to the social-media accounts that the user connects. It is operated from the user’s own computer or server, and the information described below is stored in that installation’s database and file storage. This policy applies to people who sign in to and administer the Service (“you”). The Service does not offer accounts to, track, or collect personal information from the audiences who watch the content that is published.

In short: we use account connections only to show you which account is connected and to post the content you create to it; we do not sell your information, we do not use it for advertising, and you can disconnect and delete it at any time.

Information We Handle

Information you provide

Administrator credentials. The administrator password is stored only as a salted hash.
Settings and content choices. News sources, schedules, styles, prompts and instructions, intro and ending media you upload, and other configuration.
API credentials. Client IDs, client secrets and similar keys you enter for third-party services.

Information from connected third-party accounts

When you connect a platform account (YouTube/Google, X, Facebook/Instagram, TikTok), the platform gives the Service an access token and usually a refresh token. Depending on the platform and the permissions you grant, we also receive basic account details such as the account or Page identifier, display name, user name and profile picture, and (for TikTok) the posting options your account allows. Tokens are stored encrypted. We do not receive your platform password.

Content the Service creates

Headlines, summaries and article text retrieved from the news sources you choose; AI-written scripts and picture descriptions; generated pictures, narration audio, finished videos and thumbnails; post titles and descriptions; and reports that log each run, including upload results returned by the platforms.

Technical information

Server logs and run reports may contain IP addresses, browser information, time stamps and error messages. A session cookie keeps you signed in (see Section 9).

Information we do not collect

We do not collect payment-card details, contacts, precise location, biometric identifiers, or the personal information of viewers of published content.

How We Use Information

to provide, operate and secure the Service, including signing you in and keeping you signed in;
to generate scripts, pictures, narration and videos from the stories you select;
to publish, schedule and report on content for the accounts you connected, and to show which account is connected;
to maintain backups and restore points of your installation;
to diagnose problems, prevent abuse and comply with law and with platform requirements; and
to improve the Service, using only the information described in this policy.

Where the law requires a legal basis (for example under the GDPR), we rely on performance of our contract with you (providing the Service), our legitimate interests in operating and securing it, your consent where we ask for it (for example when you authorize a platform connection, which you can withdraw at any time), and compliance with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose information only as follows:

Recipient	What is sent	Why
Anthropic (Claude API)	Story headline, summary and article text, your style and instructions	To write the video script or picture-post text
Microsoft (Edge text-to-speech)	The narration text	To produce the synthetic voice
Google / YouTube	Finished video, title, description, comment; access token	To upload and describe your video and add the first comment
Meta (Facebook and Instagram)	Finished video or picture, text, comment; access token	To post to your Page or professional account
X Corp.	Finished video or picture, text, reply; access token	To post to your account
TikTok	Finished video, title and posting options; access token	To read your account name and avatar and post your video
Webhook you configure	Finished video or picture and its text	To pass content to a service you choose
Network / tunnel provider you use (if any)	Encrypted web traffic	To make the Service reachable at your web address

Local software on the same computer, such as the image generator and video encoder, processes content without sending it elsewhere. We may also disclose information if required by law or legal process, to protect rights, safety and security, or in connection with a business transfer, in which case this policy continues to apply to the transferred information until you are told otherwise. Each recipient handles information under its own privacy policy.

Google and YouTube API Services

The Service’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube permissions only to upload videos you choose to publish, to set their title, description and status, and to post the first comment you configure. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security or abuse investigation, or as required by law.

The Service uses YouTube API Services. By using it with YouTube you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke the Service’s access to your Google account at any time at security.google.com/settings/security/permissions, and you may find more information on how Google handles data at policies.google.com/technologies/partner-sites.

TikTok. With your authorization through TikTok Login Kit we read your open ID, display name and avatar (user.info.basic) to show which account is connected, and we use the Content Posting API (video.publish) to post videos that you choose or schedule to that account, honouring the privacy, comment, duet, stitch and disclosure options you select. We store the access and refresh tokens encrypted and use them for nothing else. You can revoke access in your TikTok account’s app-permission settings.
Meta. We use the Page or professional-account token you provide to publish videos, pictures and comments to that Page or account. You can remove the Service in your Facebook or Instagram settings under Apps and Websites / Business Integrations.
X. We use the token you authorize to post videos, pictures and replies to your account. You can revoke access in your X account’s Connected Apps settings.

We use data from these platforms only to provide the features described in this policy. We do not combine it with data from other sources to build profiles, do not use it to make decisions about eligibility for credit, employment or insurance, and do not sell it.

Retention

Access tokens and API credentials: until you disconnect the account or remove them in the Service.
Finished videos, pictures and reports: until you delete them in the Service.
Temporary working files: deleted automatically after a configurable period (14 days by default).
Backups and version snapshots: kept until you delete them; they can contain a copy of the database, which includes encrypted tokens.
Server logs: kept for troubleshooting for as long as the installation’s operator keeps them.

Security

We use reasonable technical and organizational measures: tokens and secrets are encrypted at rest with a key stored separately from the database, the administrator password is hashed, sessions expire, and traffic over the internet should be carried over HTTPS. No system is completely secure, and we cannot guarantee absolute security. Keep your password, your encryption key file and your backups private. If we become aware of a breach affecting your information, we will notify you and the authorities as the law requires.

Cookies and Similar Technologies

The Service sets one strictly necessary session cookie to keep you signed in, and may store your display preferences (colour theme and mode) in your browser’s local storage. We do not use advertising, analytics or tracking cookies. You can clear them in your browser at any time, but the Service may then ask you to sign in again.

Your Rights and Choices

Because the information is stored in your own installation, you can view, correct, export and delete most of it directly in the Service. In addition, depending on where you live, you may have rights to access, correct, delete, port or restrict the use of your personal information, to object to certain processing, to withdraw consent, and to complain to a data-protection authority.

European Economic Area, United Kingdom and Switzerland

You have the rights described in the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority.

California and other U.S. states

Residents of California (CCPA/CPRA) and of other states with comparable laws may request to know, access, correct and delete personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we do not knowingly sell information of anyone under 16. We will not discriminate against you for exercising your rights. To exercise a right, contact us as described in Section 15; we may need to verify your identity, and an authorized agent may submit a request on your behalf with proof of authority. We aim to respond within 30 to 45 days.

Data Deletion Instructions

To delete your information and disconnect the Service from every account:

In the Service, open Platforms, clear the access token, refresh token and client secret fields for each platform and save. Delete videos and reports you no longer want on the Videos and Reports pages, and delete old backups on the Backup / Restore page.
Revoke the Service’s access in each platform: Google at security.google.com/settings/security/permissions; Facebook and Instagram under Settings > Apps and Websites (or Business Integrations); X under Settings > Security and account access > Apps and sessions; TikTok in your account’s app-permission settings.
If you cannot do this yourself, email us at the address in Section 15 with the subject “Data deletion request”, identifying the platform and account. We will delete the information we hold and confirm within 30 days. Content already published on a platform is controlled by that platform and must be removed there.

International Transfers

Information is stored where your installation runs, and the third-party services listed in Section 4 may process it in the United States and other countries. Where the law requires, we rely on appropriate safeguards for those transfers, such as standard contractual clauses or adequacy decisions.

Children

The Service is for adults and is not directed to children under 13 (or under 16 where the law sets a higher age). We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. We will post the new version with a new “last updated” date and, for material changes, make a reasonable effort to notify you. Your continued use of the Service after the effective date means you accept the update.

Contact

For privacy questions or to exercise your rights, contact:
DT
[MAILING ADDRESS]
Email: [CONTACT EMAIL]