Privacy notice

Who to contact

Alchemy Creative operates Alchemify at alchemify.io and is responsible for the account and service information described here. Contact hello@alchemify.io about privacy, access or deletion. If you put someone else’s information in a draft, you are responsible for having permission or another valid basis to use it.

Information used by the current beta

We use your invitation and email address to create your account and send sign-in links. We store your workspace and brand details, drafts, revisions and uploaded media so you can use the studio across devices. Account identifiers, session records and technical request information help us authenticate users, protect private workspaces and investigate faults. Support messages contain the information you choose to send.

Providing an email address is necessary to sign in. Brand and draft information is provided by you. Please avoid including sensitive personal information about yourself or others unless it is necessary and appropriate for your content.

The waitlist

If you join the waitlist, we store your email address, when you agreed to hear from us, whether you have confirmed, and the campaign name in the link you followed, if any. Resend sends our confirmation email and, after you confirm, emails about Alchemify's launch and product updates. Cloudflare Turnstile checks that the form is being used by a person; Cloudflare processes technical signals for that check. Unconfirmed sign-ups are deleted after 30 days. You can unsubscribe with the link in our waitlist email or by contacting us, and you can ask us to delete your waitlist record at any time.

Why we use it

We process account details and saved content to provide the service you request. We use limited technical and support information for our legitimate interests in keeping the service secure, reliable and supportable. Where a legal obligation requires records, we keep the relevant records for that obligation. We do not use the beta to make automated decisions with legal or similarly significant effects about people.

Service providers and location

Cloudflare hosts the application and handles web requests. Supabase provides authentication, the database and private file storage; the project’s primary region is London. Resend delivers authentication email. Cloudflare Turnstile checks the waitlist form, and Resend (waitlist email) sends waitlist messages. These providers may process technical, delivery or support data in other countries according to their service arrangements. Contact us for information about the arrangements applicable to your data. Email you send to our contact address is also handled by our business email provider. When you connect a social account, we send the content you approve, and the requests needed to publish it and fetch its results, to that platform: Meta (Facebook, Instagram and Threads), Google (YouTube), Pinterest or Bluesky. Each platform is responsible for its own processing.

Connected social accounts

You can connect Facebook Pages, Instagram, Threads, YouTube, Pinterest and Bluesky accounts to a brand. You sign in on each platform’s own permission screen, and we never see or store your social passwords. When you connect, we receive and store an encrypted access credential from the platform, the account’s identifier and name and, except for YouTube, its profile image, and the permissions you granted.

We use these only to publish the posts you approve, to the account and at the time you chose, to check whether each post was published, and to show the results the platform provides for those posts, such as views and engagement. We don’t request access to your private messages or comment inboxes.

You can disconnect an account in Settings at any time; we then delete the stored credential. You can also remove Alchemify’s access in the platform’s own app settings. Once a post is published, the platform holds it under its own terms and privacy policy, and deleting your Alchemify data does not delete posts already on the platform.

YouTube API Services

Alchemify uses YouTube API Services. If you connect a YouTube channel, you also agree to be bound by the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

What we access and why. You grant access on Google’s own permission screen and we never see your Google password. We ask Google for permission to view your YouTube account (youtube.readonly) and to upload videos (youtube.upload), and, only if you separately choose it, to manage caption tracks (youtube.force-ssl). We use that access only to list the channels your authorization returns, so you can choose the one that belongs to a brand, and to check later that the channel is still yours; to upload to that channel the video you approved, with the title, description, visibility, audience and disclosure choices you approved, plus any cover image or caption track you approved, and to read back that upload’s status; and, where YouTube results are enabled, to read the view, like and comment counts of videos Alchemify uploaded for you, by exact video ID. Alchemify acts only on videos it uploaded for you. It does not use YouTube Analytics or Reporting data and does not delete videos.

What we store and for how long. We store the access and refresh credentials Google issues, encrypted before they are saved. Your brand’s connection record holds the channel’s ID and title, the permissions Google granted, and when the credential expires and was last checked. While you choose a channel, the channel IDs and titles your authorization returned (at most 50) are kept for up to 10 minutes. For each video we upload we keep its YouTube video ID and link with the publication record and, where results are enabled, its latest view, like and comment counts. We do not store other YouTube account data, such as profile images, subscriptions, playlists or watch history.

Credentials are kept only while the connection is active. While connected, Alchemify renews them automatically, and each renewal re-checks that the stored channel ID and title still match Google’s. When you disconnect, we ask Google to revoke the grant and delete our stored credentials and saved video counts straight away. Saved video counts are also deleted 30 days after they were last refreshed. The channel and video identifiers remain with your brand’s connection and publication records, as saved content under Retention and deletion, until you ask us to delete them.

Revoking access. You can disconnect YouTube for a brand in Settings at any time. If Google cannot be reached, we still delete our stored copy and tell you that Google’s revocation was not confirmed. You can also revoke Alchemify’s access directly in your Google security settings. If you revoke through Google, we find out the next time Alchemify renews or checks the credential; we then delete it and stop using the connection. To have us remove the remaining channel and video information, contact hello@alchemify.io.

Deleting YouTube data on request. Email hello@alchemify.io and we will delete the YouTube API data we hold for you as soon as possible and within 7 calendar days. This does not delete videos or other data held by YouTube or Google; manage those in YouTube and your Google Account.

Sharing. We use YouTube API data only for the purposes above. We do not sell it, use it for advertising or serve third-party ads, or share it with anyone other than the providers described under Service providers and location, which store and process it for us. Contact hello@alchemify.io with privacy questions or complaints.

Features still being prepared

LinkedIn, TikTok and X connections, AI-assisted writing and Google website reporting are not enabled yet. Each will use the platform’s own consent screen and explain what is shared. We will update this notice before turning on any new data flow. Creating an Alchemify account alone does not connect your social accounts or send your drafts to an AI provider.

Storage on your device

Alchemify stores sign-in state, app files, preferences and offline drafts in browser storage. This allows the app to reopen and lets you edit drafts without a connection. Unsynced changes stay on that device until you reconnect and sync. Do not rely on signing out to erase all local draft copies on a shared device. Export any unsynced work you need before clearing this site’s browser data. The current beta does not install advertising pixels or website analytics tags.

Retention and deletion

Saved content is retained to provide your workspace while your account is active. You can request account or content deletion using the deletion instructions. We check account ownership and outstanding operations before removing data. Limited records may need to remain to resolve a security incident, dispute or legal obligation. Backup copies follow the hosting service’s backup lifecycle; deleting active records does not immediately erase every backup. Ask us for the handling of your particular request.

Your choices and rights

Depending on the law that applies, you can request access, correction, deletion, restriction or a portable copy of your data. You can object to processing based on legitimate interests. Contact hello@alchemify.io; we may need to verify your identity without collecting more information than necessary. You may complain to your local data protection authority. In the UK, contact the Information Commissioner’s Office.

Updates

This notice covers the current private beta. Material changes will be explained before the affected new features are made available.