Comprehensive Privacy Policy & Proprietary AI Architecture Disclosures

1. Executive Summary & Core Architectural Commitments

Welcome to GoViralReel ("GoViralReel", "the Application", "our Platform"), engineered and operated by Dakshyam Infotech ("we", "us", or "our"). GoViralReel is an advanced, proprietary AI video creation and social media growth engine designed specifically for short-form video creators, podcasters, marketers, and digital media professionals.

Unlike generic AI interfaces or simple API wrappers, GoViralReel operates a sophisticated, multi-tier proprietary backend known as the GoViralReel Neural Pipeline™. This architecture combines custom on-device machine learning algorithms (leveraging Apple Silicon Neural Engine & Metal Frameworks), custom audio pre-processing filters, proprietary viral retention scoring heuristics, custom phoneme-to-viseme alignment buffers, and low-latency cloud model orchestration.

Our Immutable Privacy Guarantees:

• Absolute Creator Ownership: You retain 100% full, exclusive copyright and intellectual property rights in all source video files, raw audio tracks, synthesized speech, custom voice clone models, script drafts, and final exported video clips.
• Zero Foundation Model Training: Neither Dakshyam Infotech nor any of our third-party infrastructure partners use your personal media, facial recordings, audio snippets, or script prompts to train foundation AI models.
• Ephemeral In-Memory Processing: Remote AI processing tasks execute purely in volatile GPU/CPU memory over encrypted TLS 1.3 tunnels and are permanently purged immediately upon completion of the inference task.
• Local On-Device Video Rendering: High-resolution source video footage never leaves your iOS device for clipping or trimming. All video slicing, aspect-ratio re-framing (9:16 vertical crop), and subtitle compositing execute directly on your iPhone hardware via Apple AVFoundation.
• Zero Data Monetization: We do not sell, rent, lease, or monetize user data, facial landmark vectors, voice recordings, or connected social media data to third-party data brokers, advertising networks, or analytics aggregators.

2. Proprietary Backend Intelligence vs. Sub-Processor Roles

To achieve studio-grade quality and millisecond-level precision, GoViralReel utilizes specialized foundational AI engines orchestrated by our custom, proprietary backend intelligence layer. The table below outlines how our proprietary technology transforms and enhances raw sub-processor outputs:

3. Social Media Integrations and Third-Party API Data

GoViralReel enables creators to optionally connect their official social media accounts to directly publish or upload video creations to YouTube, TikTok, LinkedIn, and Instagram. All social integrations are designed with strict privacy boundaries, least-privilege permission models, and user-initiated controls.

3.1. User-Controlled Publishing

GoViralReel enforces a strict User-Controlled Publishing Model:

• Explicit User Action Required: The application does NOT publish or upload content automatically without creator interaction. To publish a video, the user must navigate to the publishing interface, review or customize the video metadata (titles, captions, hashtags, visibility), select the target connected platforms, and explicitly tap "Publish Now".
• Scheduled Publishing Disclosures: If you select scheduled publishing (supported for YouTube channels), the video is queued on our backend and published at your designated future date and time with privacyStatus: private and a designated publishAt timestamp per the YouTube Data API specification. The schedule is executed strictly according to your selected time and metadata.
• Platform-Specific Data Transmission: Content and metadata are transmitted solely to the specific platform(s) selected for that particular video. If you select only YouTube, no data is transmitted to TikTok, Instagram, or LinkedIn.

3.2. Google / YouTube API Verification Disclosures

Our application requests three specific, individual Google OAuth scopes verified in our codebase:

• Scope: https://www.googleapis.com/auth/userinfo.profile
  What is accessed: Basic profile information of the authenticated Google user. Specifically, our application queries the YouTube channels resource (youtube.channels.list(part=['snippet'], mine=true)) using this authorization.
  Fields retrieved & used: YouTube Channel ID, Channel Title (display name), and Channel Thumbnail URL.
  Why it is required: To display your connected YouTube channel name and avatar within the GoViralReel interface so you can confirm which channel is currently connected.
  What is NOT accessed: We do NOT access your Gmail, Google Drive, Google Photos, Contacts, Calendar, browsing history, or any other Google service data.
• Scope: https://www.googleapis.com/auth/youtube.upload
  What it allows: Uploading video content to the authenticated user's YouTube channel via the YouTube Data API v3 (videos.insert endpoint).
  Actual data transmitted: Only the video file rendered by the user, accompanied by user-configured metadata: video title (up to 100 characters), video description (up to 5,000 characters), tags/hashtags, category ID (22 — People & Blogs), privacy status (public, private, or unlisted), and optional scheduled publish timestamp (publishAt).
  Workflow: Data is transmitted to YouTube ONLY when the user chooses YouTube in the publishing picker and triggers publishing.
• Scope: https://www.googleapis.com/auth/youtube.force-ssl
  Strictly limited operational use: While the youtube.force-ssl scope technically permits broader channel management in YouTube's OAuth system, GoViralReel uses this scope strictly and solely to query the authenticated user's own channel details (channels.list) and monitor the ingestion/processing status of the uploaded video (videos.list upload status check).
  What GoViralReel NEVER does: GoViralReel DOES NOT delete YouTube videos, DOES NOT edit or delete existing channel content, DOES NOT view or manage video comments, DOES NOT post ratings, DOES NOT manage playlists, and DOES NOT access YouTube Studio analytics.

3.3. TikTok Login Kit & Content Posting API Disclosures

• Scope: user.info.basic
  What it allows: Accessing basic account identity via TikTok's /v2/user/info/ endpoint.
  Actual fields queried: open_id, union_id, avatar_url, and display_name (with fallback to username).
  What is NOT collected: We do NOT access follower lists, following lists, account bio, likes count, total video count, direct messages, or watch history.
• Scope: video.publish (Direct Post Workflow)
  What it allows: Direct publishing of user-approved videos to the creator's TikTok profile via TikTok's direct publishing endpoint (/v2/post/publish/video/init/).
  Actual payload transmitted: Binary video file (via direct chunked FILE_UPLOAD), caption text including hashtags (up to 150 characters), creator-resolved privacy level (e.g. PUBLIC_TO_EVERYONE, MUTUAL_FOLLOW_FRIENDS, or SELF_ONLY, dynamically queried via /v2/post/publish/creator_info/query/), and interaction settings (duet, stitch, and comment toggles).
  User Initiation: Direct publishing occurs solely when the creator initiates publishing inside GoViralReel.
• Scope: video.upload (Inbox Draft Workflow — Distinct from Direct Publishing)
  How this differs from video.publish: video.upload is a separate permission used for the Creator Inbox Draft workflow (/v2/post/publish/inbox/video/init/). When this mode is used, GoViralReel uploads the video file to the user's TikTok account as an unposted draft. The video appears in the creator's TikTok inbox where the creator can review, apply TikTok native audio, filters, or text stickers, and complete the final posting manually within the TikTok mobile app.
  Draft Transparency: video.upload is never represented as automated public publishing; it is strictly a draft-staging capability.

3.4. LinkedIn Integration Disclosures

GoViralReel integrates with LinkedIn via OAuth 2.0 (OpenID Connect) and LinkedIn's Video & UGC Post API:

• Scopes Requested: openid, profile, email, and w_member_social.
• Scope: w_member_social allows GoViralReel to publish creator-authorized video content to the authenticated member's personal LinkedIn feed via LinkedIn's UGC Posts API (/v2/ugcPosts).
• Actual Payload Transmitted: Video binary uploaded via LinkedIn's digital media asset mechanism (urn:li:digitalmediaRecipe:feedshare-video), post commentary text, hashtags, author URN (urn:li:person:...), and public visibility setting (MemberNetworkVisibility: PUBLIC).
• No Organization / Company Page Management: GoViralReel does NOT request organization scopes (such as w_organization_social). The app cannot create or edit posts on LinkedIn Company Pages or access corporate administrative data.
• Profile Information: Via /v2/userinfo, the app accesses the member's unique subject identifier (sub), member name (given name and family name), and profile picture URL to display the connected account.

3.5. Meta / Instagram Graph API Disclosures

GoViralReel supports publishing videos as Instagram Reels via the official Instagram Graph API:

• Scopes Requested: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_messages, and instagram_business_manage_comments (per Instagram Login for Business standards).
• Account Information Accessed: Via graph.instagram.com/me, GoViralReel accesses the Instagram account ID (id) and username (username, e.g. @creator) solely to display the connected account state.
• Reels Publishing Workflow: Upon user command, GoViralReel creates a media container via /me/media with media_type: 'REELS', provides the video stream URL, attaches the creator's caption and hashtags, polls container readiness, and triggers publication via /me/media_publish.
• Token Handling: Short-lived tokens are exchanged for 60-day long-lived tokens via graph.instagram.com/access_token and refreshed automatically via graph.instagram.com/refresh_access_token.
• Account Disconnection: Users can disconnect at any time in GoViralReel settings, immediately removing stored credentials, or revoke app permissions via Instagram's "Apps and Websites" security settings.

3.6. Comprehensive OAuth Scope-by-Scope Reference Table

The table below provides a complete, transparent audit of all OAuth scopes implemented in the GoViralReel codebase:

3.7. OAuth Access and Refresh Tokens: Cryptographic Storage & Lifecycle

• Zero Client Exposure: OAuth tokens are exchanged directly between platform servers and our secure backend. Tokens NEVER touch your iOS device, are never stored in client UserDefaults, and are never returned in client API responses.
• Zero Plaintext Storage: Tokens are encrypted before insertion into database records (stored as access_token_enc and refresh_token_enc). Plaintext tokens exist solely in volatile memory during active API requests.
• CSRF State Verification: Every OAuth authorization initiates a cryptographic UUID state with a 15-minute expiration window (OAUTH_STATE_TTL_MINUTES = 15). Callbacks without matching, unconsumed state parameters are rejected immediately.
• Automatic Token Refresh: Access tokens near expiration are refreshed automatically using encrypted refresh tokens. If a refresh fails (e.g. user revoked permissions on the platform), the account status is updated to reauthorization_required and no further API calls are attempted.

3.8. Data Retention Lifecycles for Social Integrations

We apply strict data minimization and finite retention periods to all social integration data:

• Temporary Video Uploads: When a video is staged on our backend for platform ingestion, the file is stored in a private, access-controlled directory. Once the target platform confirms ingestion or when the publish worker completes, the temporary file is purged from backend disk storage.
• Social Account Profile Records: Public identifiers (platform user ID, handle, channel title, avatar URL) and encrypted tokens are retained only while the account status is connected.
• Publishing Job Records: Records in our publishing database retain job status (queued, processing, published, failed), platform post IDs (e.g. YouTube video ID), and error codes for 30 days to provide creators with publishing status history and diagnostics.
• Operational Server Logs: Anonymized server logs capture operational metrics and HTTP response status codes. Logs are automatically rotated and purged after 14 days and never contain OAuth tokens, passwords, or personal credentials.

3.9. Account Disconnection, Revocation & Immediate Deletion

You have full, autonomous control over your connected accounts:

• Instant In-App Disconnection: Tapping "Disconnect" in GoViralReel Settings immediately sends a POST request to /api/social/accounts/:id/disconnect.
• Immediate Upstream Token Revocation: Our backend invokes the official platform revocation endpoints (e.g., Google OAuth2 revokeToken, TikTok /v2/oauth/revoke/) to immediately invalidate the token on the third-party platform's servers.
• Immediate Database Purge: The database row containing the encrypted tokens and profile data is permanently and immediately deleted (prisma.socialAccount.delete). Associated publish jobs are cascade-deleted via database foreign keys.
• Direct Platform Revocation: You can also revoke GoViralReel's access directly at any time from your platform security dashboard:
  • Google: Google Account Permissions
  • TikTok: Settings & Privacy → Security & Permissions → Apps & Services
  • LinkedIn: Settings & Privacy → Data Privacy → Other Applications
  • Meta / Instagram: Accounts Center → Connected Experiences → Apps and Websites

3.10. Third-Party Data Sharing

We share data with third-party social platforms strictly to provide the features you explicitly choose to use:

• Google LLC (YouTube): Receives video streams and publishing metadata only when you select YouTube publishing.
• ByteDance Ltd. (TikTok): Receives video streams, captions, and privacy preferences only when you select TikTok publishing.
• LinkedIn Corporation: Receives video files and post commentary only when you select LinkedIn publishing.
• Meta Platforms, Inc. (Instagram): Receives video URLs, captions, and Reels parameters only when you select Instagram publishing.

We do NOT share your social media data, audience metrics, or account tokens with advertising aggregators, data brokers, tracking SDKs, or unapproved affiliates.

4. Data Categories Collected & Technical Processing Rationale

We adhere to strict data minimization principles. Below are the precise categories of data processed by GoViralReel:

• User Media Assets (Processed Ephemerally): Short video clips, extracted audio tracks, and user-submitted video URLs. Processed solely to generate transcripts, dubbing, or short clips, and purged immediately after processing.
• Custom Voice Embeddings: If you utilize our Voice Cloning feature, a 30–60 second reference recording is converted into a proprietary mathematical acoustic vector (embedding). The raw audio is discarded, and the numerical embedding is encrypted with AES-256.
• Connected Social Media Credentials: Encrypted OAuth 2.0 access tokens, refresh tokens, and public account metadata (account handle, profile picture). Used exclusively to authenticate and publish videos to your connected social channels when you command.
• In-App Purchase & Subscription Records: Anonymous transaction receipts and subscription entitlement identifiers verified securely through RevenueCat and Apple StoreKit. We never collect, process, or store credit card numbers or banking details.
• Technical Diagnostics & Telemetry: Anonymized device model, iOS version, app build number, memory utilization, and crash logs to optimize AVFoundation rendering performance and prevent memory pressure crashes during video export.

5. Data We Explicitly DO NOT Collect or Store

To ensure creator privacy, GoViralReel enforces strict technical guardrails preventing invasive tracking:

• ❌ No Biometric Facial Identification: We do NOT create, extract, or store facial recognition templates, faceprints, or iris scans capable of identifying an individual across media.
• ❌ No Geolocation Tracking: We do NOT collect, access, or track your GPS coordinates or precise location data.
• ❌ No Full Photo Library Access: We utilize Apple's modern PHPicker system, meaning the app only receives access to the specific videos you explicitly choose to import.
• ❌ No Background Audio or Keystroke Logging: We do NOT monitor microphone activity in the background or log keyboard typing outside explicit app text inputs.
• ❌ No Email / Gmail / Drive Reading: We do NOT access private emails, Gmail mailboxes, Google Drive folders, or contact books.
• ❌ No Third-Party Data Broker Sharing: We do NOT sell, license, or provide user personal data to data brokers, ad networks, or credit rating agencies.

6. Biometric, Audio & Voice Cloning Safety Standards

GoViralReel includes state-of-the-art voice synthesis and facial motion retargeting capabilities. To prevent abuse and protect individual likeness rights:

• Strict Consent Requirement: You may only clone your own voice or voices of individuals who have provided verified, explicit written consent. Creating non-consensual voice clones, synthetic impersonations, or deceptive deepfakes is strictly prohibited and results in immediate account termination.
• Encrypted Voice Isolation: Your custom voice models are cryptographically bound to your user ID and are inaccessible to any other user or system.
• Temporary Spatial Landmark Vectors: Lip-synchronization algorithms evaluate facial landmark coordinates solely in volatile GPU memory to deform mouth polygons. These spatial vectors are discarded immediately once the video frame is encoded.

7. Cryptographic Architecture & Infrastructure Security

We implement defense-in-depth security across our iOS client, network transport, and backend cloud infrastructure:

• Transport Layer Security (TLS 1.3): All network traffic between your iOS device, our backend gateway, and AI sub-processors is encrypted using TLS 1.3 with Perfect Forward Secrecy (PFS).
• AES-256-GCM Token Encryption: All sensitive database fields—including OAuth publishing tokens and voice embeddings—are encrypted at rest using AES-256 in Galois/Counter Mode with automated key rotation.
• Sandboxed Client Execution: Video rendering, audio extraction, and subtitle synthesis operate entirely within iOS application sandboxing with zero inter-process memory exposure.

8. Global Privacy Rights (GDPR, CCPA/CPRA, CalOPPA & COPPA)

We provide comprehensive data protection rights to all users globally:

• Right to Access & Portability (GDPR Art. 15 / CCPA § 1798.100): You may request a machine-readable export of all data associated with your account at any time.
• Right to Erasure / Right to be Forgotten (GDPR Art. 17 / CCPA § 1798.105): You can permanently delete your account, custom voice clone embeddings, and OAuth connections directly within the app Settings or by emailing support@dakshyaminfotech.store. All records are permanently purged within 30 days.
• Right to Rectification & Restriction: You may update your account credentials or restrict processing of specific social media integrations at your discretion.
• Children's Online Privacy Protection (COPPA): GoViralReel is intended exclusively for individuals aged 13 and older (or 16 in the EEA). We do not knowingly collect personal data from children under 13.

9. Contact & Data Protection Officer

For privacy inquiries, GDPR/CCPA data subject requests, or security vulnerability disclosures:

• Operating Entity: Dakshyam Infotech
• Data Protection Officer: Privacy & Compliance Division
• Direct Support Email: support@dakshyaminfotech.store
• Official Web Portal: https://goviral.dakshyaminfotech.store/