Legal
Privacy policy
What we collect, why, and how you stay in control.
What we collect
- Account: your email address and a password stored only as a salted scrypt hash. We never store your password in readable form.
- Your workspace: niches, saved posts, brand kit, brand profile and post results you enter. Stored encrypted on our servers so it opens on all your devices.
- Your photos, videos and logo: files you add to My photos, saved to your account so they sync across devices. You can remove any file at any time.
- Usage counts: how many downloads and AI uses you made each day, to apply plan limits.
- Billing: your Stripe customer and subscription status. Card details are handled by Stripe and never reach our servers.
Connecting Instagram is optional and uses Instagram’s own sign-in page. With your permission we read your account identity, recent posts and available insights, and publish only the posts you choose to post or schedule. To publish, finished images are stored at a private link until Instagram fetches them, then deleted. We never comment, send messages or change your existing posts. Disconnect anytime in Account.
Canva
If you connect Canva, we create designs in your Canva account at your request and export the pages you return to ReelRumor. We store an encrypted access token and the design reference. Disconnect from Canva’s settings or ask us to remove it.
AI features
When you use Rewrite with AI or create new posts, we send the post text and your brand profile to our AI provider (OpenAI or Anthropic) to produce the result. Photos, videos, passwords and access tokens are not sent. Review AI output before you post.
Emails
We send account emails (welcome, sign-in links, password resets) and billing notices from KnockKnock@reelrumor.com. We don’t sell or rent your email address.
Cookies and local storage
We use one essential, HttpOnly session cookie to keep you signed in and protect your account. Your browser also keeps an offline copy of your workspace and photos. We do not use advertising trackers in the app.
Sharing
We share data only with the services that run ReelRumor: our hosting provider, Stripe (payments), Zoho (email), and, when you use those features, Instagram (Meta), Canva and our AI provider. We do not sell personal information.
Retention and deletion
Sessions expire after 30 days and sign-in links after 15 minutes. Your data stays until you delete it or your account. In Account, Delete my account permanently removes your workspace, photos, brand kit, connections and sign-in records, and cancels Pro. Billing records kept by Stripe follow Stripe’s retention rules.
Children
ReelRumor is not for children under 13, and accounts for anyone under 18 need a parent or guardian’s permission.
Your rights
You can access, correct, export or delete your data. Email KnockKnock@reelrumor.com and we will respond within 30 days.
Changes
We will update this page when our practices change and show the new date at the top.