Privacy Policy

There are two kinds of people who use SocialPin: creators, who sign in to build and publish a creator page, and visitors, who browse creator pages and may sign in to save places. This policy covers both. Our Terms of Service also apply to your use of the Service.

Content that creators publish (their page, profile, places, reviews, ratings and imported video links) is public by design. Please do not publish anything you do not want others to see.

We collect the following, depending on how you use the Service.

• Account information: your email address, display name, username and profile photo, and your sign-in details. If you sign in with Google or Apple, we receive the basic profile information they share with us (such as your name, email address and photo). Passwords are handled by our authentication provider; we do not see or store them in readable form.
• Creator profile information: your creator name and page address (handle), bio and descriptions, branding (colors, logo, hero images, marker style), categories, featured places, favorites, your own terminology, page settings and any custom domain you connect.
• Uploaded images: profile pictures, logos, hero and other images you upload. We store them, and they appear publicly where you place them on your page.
• Imported content: the TikTok links you paste or select, and what we read from them (see Section 3), plus the place, ratings, dishes, summaries and categories created from them and the edits you make.
• Saved places: places you save, the lists you create, optional notes you write, and whether you choose to share a list.
• Onboarding preferences: interests you optionally select when you first sign in.
• Communications: if you email us, we receive your email address and what you send. We also keep service emails we send you (see Section 8).
• Device and browser data: standard technical information that our servers and providers receive whenever you load a page, such as your IP address, browser type, device type and the pages requested. See Sections 5 and 6.
• Subscription and payment information: see Section 9.

We do not currently run newsletter sign-ups, contact forms or surveys. We do not knowingly collect sensitive information such as government IDs or health data, and we ask you not to include any in captions, transcripts or notes.

SocialPin works with TikTok in two ways. You can paste links to TikTok videos, or, if you are a creator, you can choose to connect your own TikTok account. Both are optional.

When you paste a link, we read the video's public details through TikTok's public oEmbed service: the caption or title, the author's handle, a thumbnail and the video link.

When you connect your account, you are taken to TikTok to approve access through TikTok's official Login Kit. We then receive only what you authorize TikTok to share with us. At present that is:

• basic profile information: your TikTok display name, avatar and an identifier TikTok assigns to you for our app; and
• a list of your own videos: video ID, caption, cover image, share link, posted date and duration.

How we use it, and only this:

• We show you your videos so you can choose which to import, and we import the ones you select into your creator page.
• We process public video details and approved TikTok data to create your creator experience, for example to work out the place a video is about and to build the review (Section 7).
• We do not post to, edit, message from or otherwise act on your TikTok account, and we cannot see anyone else's account or private videos.
• We do not use TikTok data for advertising, we do not sell it, and we do not share it with data brokers or anyone other than the service providers listed in Section 10.

What we store: for a connected account, a connection record (your TikTok identifier, display name and avatar, and the access credentials TikTok gives us, which are encrypted and never sent to your browser). The list of videos you browse is fetched from TikTok each time and is not stored unless you import a video. For imported videos, we store the link, caption, thumbnail link and the details we derive from them.

Your control: you can disconnect TikTok at any time from the Import page, which revokes our access and deletes the stored connection record. You can also remove SocialPin in your TikTok app's settings. If TikTok tells us access was revoked or has expired, we delete the stored connection. Disconnecting does not delete content you already imported; to have imported content removed, contact hello@socialpin.app.

Ownership and embeds: we do not claim ownership of TikTok content. Videos remain yours or TikTok's, and where we show them in an embedded player, TikTok's own terms and privacy policy apply, and TikTok may collect information from your device when the player loads. SocialPin is not affiliated with or endorsed by TikTok.

We follow TikTok's developer rules: we protect personal information from TikTok in line with this policy, we only request the access we need, and we handle deletion and revocation requests as described here and in Section 12.

Location comes up in four different ways.

• Location in creator content: creators identify the places their videos are about. We use place names, addresses and the text in captions to find them, using Google Places data, and store the place details, including its address and map coordinates. This is information about a business or landmark, not about you.
• Place coordinates on maps: coordinates for places are used to draw pins and directions on a map. Directions links open your own maps app.
• Your device location, only if you allow it: when you tap Locate me or use Near Me, your browser asks permission to share your location. If you allow it, we use it in your browser to show nearby places and distances and to sort results by distance. We request approximate (not high accuracy) location. If a feature needs a location in the page address, such as Near Me, we round it to roughly one kilometer (two decimal places) before putting it in the address. We do not store your device location in your account or in our analytics, and we do not track your movements. Because the rounded location appears in the page address, it may appear in standard server and provider logs.
• Approximate location from your IP address: like every website, our hosting and map providers receive your IP address, from which they can infer a general area. We do not use it to build a profile of you.

Location sharing is optional. Nothing in SocialPin requires it except features whose purpose is your location, such as Near Me. You can decline the prompt, and you can turn location off at any time in your browser or device settings (usually under Site settings or Privacy, then Location). Without it, you can still explore every creator page and map.

So that creators can understand their audience, we record events about how creator pages are used: a page or place opened, a pin tapped, a video opened, a search, a category chosen, a place saved, a share, or a directions tap. Each event records the creator page, what was opened, the page path, the website you came from (for example, the domain of a link), any campaign tag in the link (utm_source), and the time.

• Events carry a random identifier that exists only in your browser tab (in session storage) and is not tied to your name or account. We do not store your IP address or full browser details with analytics events.
• Creators see only totals and trends for their own pages. They do not see who you are.
• We do not use third-party analytics or advertising trackers today. If we add one, we will update this policy first.
• We honor the “Do Not Track” and Global Privacy Control signals: if your browser sends either, we do not send analytics events.
• We also record events about a creator's own work (for example, a video imported or a review published) so it can appear in their dashboard.

Our hosting and database providers also keep technical logs, such as request times, IP addresses and error details, which we use to keep the Service running and secure.

We use cookies and browser storage only where needed to run the Service. We do not use advertising or cross-site tracking cookies.

• Sign-in cookies: set by our authentication provider to keep you signed in and secure your session. Strictly necessary.
• Connection cookie: a short-lived (about 10 minutes) security cookie used only while a creator connects TikTok, to make sure the response comes back to the same person.
• Preview cookie: used for creators previewing an unpublished page.
• Local storage: a temporary record of a place you tried to save before signing in, so we can finish it after you sign in. It expires within a short time.
• Session storage: the anonymous per-tab analytics identifier described above, and the source of your visit. It is cleared when the tab closes.
• Third parties: our map provider (Mapbox) may use browser storage and receive technical information to deliver and measure map tiles, and TikTok embeds may set TikTok cookies when you play a video. Their policies apply to those.

Because we use only strictly necessary storage and privacy-preserving first-party analytics, we do not show a cookie banner. You can block or delete cookies and site data in your browser settings, but parts of the Service (such as staying signed in) may not work. If our practices change, for example by adding analytics or advertising cookies, we will add a consent choice where the law requires one.

We use artificial intelligence providers (currently OpenAI, or another provider we configure) to help turn imported content into a draft creator post. We send them text, namely the video's caption or title and any transcript a creator provides, and ask them to:

• extract place names and locations;
• identify categories and dishes;
• summarize the creator's content;
• suggest metadata such as a rating, a recommendation and a verdict.

• AI results can be wrong or incomplete. A creator is asked to review generated place details and metadata, and anything that looks uncertain is flagged for review, before it is published.
• We do not use your information to train our own AI models. We cannot promise how an AI provider handles data beyond what its agreement with us says: providers may keep data for a limited time, for example to prevent abuse, under their own terms and privacy policies.
• Please do not put sensitive or private information about yourself or others into captions or transcripts you submit.

• Providing the Service: creating and securing accounts, hosting creator pages, saving places and lists.
• Creating creator experiences: building maps, places, reviews and branded pages from what creators add.
• Processing imported social content: reading TikTok links and approved TikTok data and creating draft posts.
• Identifying locations: matching places and showing them on maps.
• Generating summaries and metadata: using AI as described in Section 7.
• Personalization: using your optional onboarding interests and your saved places to tailor what you see, and sorting by distance if you share your location.
• Analytics: producing creator analytics and improving the Service.
• Fraud prevention and security: detecting abuse, protecting accounts and keeping the Service running.
• Customer support: answering your questions and requests.
• Communications: sending service emails such as sign-in links, password resets and account notices, and notifications to our team when an import needs attention. We do not send marketing email today.
• Legal compliance: meeting legal obligations, enforcing our Terms and protecting rights.

SocialPin is currently free to use. Paid plans are shown for information, and changing plans is arranged by email rather than online, so we do not currently collect payment card information. If we add online billing, a payment processor will collect and process payment details, we will receive only limited details (such as plan and billing status), and we will update this policy before turning it on.

SocialPin does not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not run behavioral advertising.

We share information only in these ways:

• Service providers who process it for us under their own terms: Supabase (database, authentication and file storage), Vercel (hosting), Mapbox (maps), Google (Places and Maps data, and Google sign-in if you use it), Apple (Sign in with Apple, if you use it), OpenAI or another configured AI provider (Section 7), Resend (service email) and, if we add one, an analytics provider.
• TikTok: when you connect your account, we exchange data with TikTok as described in Section 3, and TikTok receives the requests we make on your behalf.
• Public content: whatever a creator publishes, including their page, places, reviews, ratings, images and video links, is visible to anyone.
• Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of it, and we will tell you if your information becomes subject to a different policy.
• Legal reasons: where we believe disclosure is required by law or legal process, or necessary to protect the rights, safety or property of you, us or others, or to investigate fraud or abuse.
• With your direction: for example, when you share a saved list with others.

We keep information only as long as we need it for the purposes in this policy, and we do not keep it forever. Periods may change, and we update them here when they do.

• Account data: while your account is active, and then until we act on a closure or deletion request.
• Creator content and imported content: until you or we delete it or the account is closed.
• TikTok connection: until you disconnect, TikTok reports access as revoked, or the account is closed. Stored TikTok access credentials are deleted at that point.
• Analytics events: event-level analytics are kept for up to 24 months, and may be kept longer only in aggregated form that cannot identify you.
• Security and server logs: kept by our hosting and database providers for up to 90 days, subject to their own schedules.
• Legal and billing records, if any: for the period the law requires (generally up to 7 years).
• Backups: deleted data can remain in encrypted backups for up to 90 days before it is overwritten.

There is not yet a self-service button to delete your account. To delete your account and the personal information we hold, email hello@socialpin.app from the address on your account. We may ask you to confirm it is you.

We aim to complete verified requests within 45 days. Deletion is not instant: some data stays in backups for up to 90 days, and we may keep limited records we are legally required to keep (for example, for security, tax, or to resolve a dispute). Deleting your account removes your profile, saved places and lists, and creator pages and content, and deletes any stored TikTok connection.

Content on other platforms, including videos on TikTok, is not affected.

Depending on where you live, you may have the following rights. You can use the controls we provide or email hello@socialpin.app.

• Access: ask what personal information we hold about you and get a copy.
• Correction: ask us to fix inaccurate information. You can edit most profile and creator details in your account.
• Deletion: ask us to delete your personal information (Section 12).
• Portability: ask for a copy of the information you gave us in a commonly used format.
• Opt out: we do not sell personal information or use it for targeted advertising, so there is nothing to opt out of. We honor Global Privacy Control signals for analytics.
• Withdrawal of consent: where we rely on your permission, you can withdraw it at any time. For TikTok, disconnect on the Import page. For location, change your browser or device setting.
• Location controls: allow or block location in your browser or device settings at any time.
• Cookie controls: block or clear cookies and site data in your browser settings. See Section 6.
• Non-discrimination: we will not treat you worse for using these rights.

We will respond within the time the law requires. We may need to verify your identity first. If we decline a request, we will explain why. If you are not satisfied, you may appeal by replying to our email, and where the law allows you may also contact your state attorney general or privacy regulator.

If you are a California resident, the California Consumer Privacy Act as amended (CCPA/CPRA) may give you rights to know, access, correct and delete your personal information and to opt out of its sale or sharing. This section describes our practices for the last 12 months.

• Categories we collect: identifiers and contact details (name, email, username, IP address); account and profile information; internet or app activity (analytics events, saved places); general location (a rounded location only if you allow it, and approximate location from IP address); images you upload; and content you create or import, including information from TikTok you authorize. We collect these from you, from the sign-in providers you choose and from TikTok if you connect it.
• Why we collect them: for the business purposes described in Section 8.
• Disclosed to: the service providers listed in Section 10, for business purposes.
• Sale and sharing: we do not sell personal information and do not “share” it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing information of anyone under 16.
• Sensitive information: precise geolocation is sensitive personal information under California law. We request only approximate location, use it only in your browser to provide the feature you asked for, and do not use it to infer other characteristics. We therefore do not offer a right to limit its use.
• Your requests: email hello@socialpin.app. You may also use an authorized agent; we may ask for proof of authority.

Residents of some other U.S. states, including Colorado, Connecticut, Virginia, Texas, Oregon and others with comprehensive privacy laws, may have the rights to access, correct, delete and obtain a copy of their personal data, to opt out of targeted advertising, sales and certain profiling, and to appeal a decision on their request. Because we do not sell personal data, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, those opt-outs are not needed, but you can still make the other requests described in Section 13 and appeal by replying to our response.

SocialPin is operated from the United States, and our providers process information in the United States and may do so in other countries where they operate. If you use the Service from outside the United States, your information will be transferred to and processed in those places, which may have different data protection laws than yours.

Where the law of your country gives you rights over your personal data, such as access, correction, deletion, objection, restriction and portability, you can exercise them by emailing hello@socialpin.app. We rely on the legal bases that apply to the Service, such as performing our agreement with you, our legitimate interests in running and securing it, your consent (for example, location and TikTok connection) and legal obligations. We do not claim that the Service meets the requirements of any particular foreign law, and we will address requests under the laws that apply to us. You may also complain to your local data protection authority.

SocialPin is not intended for children under 13, and we do not knowingly collect personal information from them. If you are under 13, please do not create an account or send us information. If you believe a child under 13 has given us personal information, email hello@socialpin.app and we will delete it. We do not currently ask for your age at sign-up. Our Terms require users to be at least 13.

We use reasonable technical and organizational safeguards: encrypted connections, encryption of stored TikTok access credentials, database access controls that keep each creator's data separate and limit what each person can see, and limited access for our team. No system is completely secure, so we cannot promise absolute security. Please use a strong, unique password and tell us right away at hello@socialpin.app if you think your account was accessed without permission.

We may update this policy as the Service changes. We will change the “Last updated” date above and, for material changes, give notice, for example by email or in the Service, before they take effect where appropriate. If a change adds a new kind of data collection, such as a new analytics or advertising tool, we will update this policy first.

[Company legal name]

[Mailing address]

• Privacy questions and requests: hello@socialpin.app
• General support: hello@socialpin.app