Romani Clip BotAI Social Media Assistant

Privacy Policy

Last updated: 2026-09-20

What we store: your Discord user ID and name; sign-in tokens for the platforms you connect (used only to post the videos you approve); the clips you send and the edited videos made from them; the editing preferences you choose to save (/preferences, /style and notes you ask the bot to remember - see and delete them any time with /memory); usage counts; and any bug reports, suggestions or questions you send with the /support command (kept so we can answer you and fix the problem).

What we do with it: only what the bot needs to do its job - edit your clips and post the ones you approve to your own accounts. We do not sell or share your data, and we do not post anything you did not approve.

Third parties: clip transcripts and frames, together with your saved editing preferences, are sent to Anthropic's Claude API to plan the edit; approved videos are uploaded to the platforms you chose (YouTube, TikTok, Instagram); for Instagram the video is served briefly from our own server under a random, unlisted address so Instagram can fetch it. Each platform is governed by its own privacy policy.

Deleting your data: use /disconnect for any platform, or /forgetme to delete your profile, tokens and videos. You can also revoke access from each platform's settings.

Google user data

When you connect YouTube, ClipBot requests the youtube.upload permission only.

  • Collected: an OAuth token that allows uploading videos to your channel. ClipBot does not access your channel's videos, subscribers, analytics, or any other Google data.
  • Used: solely to upload the videos you explicitly approve, with the title, description and privacy setting you chose. Uploads happen only when you press Approve.
  • Stored: the token is stored encrypted on our server (see "How we protect your data" below) and is never shared with, sold to, or transferred to any third party. It is deleted when you run /disconnect or /forgetme, or when you revoke ClipBot's access from the Google security settings page at security.google.com/settings/security/permissions.
  • ClipBot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • ClipBot uses YouTube API Services to upload your videos. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

TikTok user data

When you connect TikTok, ClipBot requests three permissions: user.info.basic, video.publish and video.upload.

  • Collected: an access token and refresh token for your TikTok account, together with the account identifier (open_id) and the list of permissions you granted. Right before each post we also ask TikTok for your current posting options (display name, the audiences you may post to, whether comments, Duet and Stitch are available, and your maximum video length).
  • Used: only to post, or send to your TikTok drafts, the specific videos you approve in Discord, with the audience, interaction and commercial-content settings you pick on the posting screen. Your display name is shown to you on that screen so you can confirm which account will receive the post.
  • Not collected or stored: your posting options and display name are fetched live and are not saved. ClipBot does not read your videos, followers, following, likes, comments, messages or analytics, and does not collect your TikTok profile for any other purpose.
  • Shared: your TikTok data is never sold, shared with or transferred to third parties, and is not used for advertising or profiling. The video you approve is sent to TikTok only.
  • Stored and deleted: tokens are stored encrypted (see below) only while TikTok stays connected. They are deleted immediately when you run /disconnect or /forgetme. You can also remove access in the TikTok app under Settings and privacy > Security and permissions > Manage app permissions, which makes any stored token useless.
  • Videos posted through ClipBot are subject to TikTok's Terms of Service, Community Guidelines and Privacy Policy.

Instagram user data

When you connect Instagram, ClipBot requests permission to publish content to your professional account. It stores an access token and your Instagram account ID, uses them only to publish the Reels you approve, does not read your media, followers, messages or insights, never shares this data, and deletes the token on /disconnect or /forgetme.

How we protect your data

Sign-in tokens for YouTube (Google), TikTok and Instagram are treated as sensitive data and are protected as follows:

  • Encryption in transit: all traffic between you, our server and the platforms' APIs uses HTTPS/TLS. The website only answers over HTTPS.
  • Encryption at rest: tokens are encrypted before they are written to disk, using authenticated symmetric encryption (AES with an HMAC-SHA256 integrity check). The encryption key is kept separately from the stored tokens.
  • Access control: token files are readable only by the service's own system account. Administrative access to the server is restricted to the operator and requires key-based authentication; tokens are never displayed, logged, or sent to anyone, and are not included in messages, previews or analytics.
  • Data minimisation: we request the narrowest permission each platform offers for posting (for Google: youtube.upload only) and store nothing else from your account.
  • Isolation: each user's tokens, clips and settings are stored separately and are used only for that user's own requests.
  • Retention and deletion: tokens are kept only while the platform stays connected and are deleted immediately on /disconnect, /forgetme, or removal from the service. Revoking access from the platform's own settings makes any stored token useless.
  • Backups: account data (profiles, the already-encrypted tokens, support reports) is backed up daily in encrypted form so the service can recover from a failure. Backups are kept for up to 14 days, so data you delete disappears from them within that time as they expire. Your clips and videos are not backed up.
  • Clips and videos: the clips you send and the videos made from them are deleted automatically about a week after the job is finished (approved, rejected or expired). A preview that is still waiting for your decision is kept until you decide or it expires after 14 days.
  • Maintenance: the server receives automatic security updates.

If we ever became aware of unauthorised access to stored tokens, we would revoke the affected tokens and notify affected users through Discord without undue delay.

Website accounts

Creating an account on this website is optional. If you create one we store: your username; your e-mail address (encrypted on disk); your password only as a salted scrypt hash (we cannot read it); when the account was created and last signed in to; whether and when you confirmed your e-mail address; the version of the Terms of Service and of this policy you agreed to, and when; your choice about marketing e-mails with its full history; and, if you link it, the Discord user the account belongs to. We use this to show you your own dashboard (performance of our agreement with you) and to keep accounts safe (our legitimate interest): sign-in attempts are counted per network address in memory for up to an hour, and addresses are not written to our logs.

How long: an account that is never confirmed by e-mail and never linked to a Discord user is deleted 30 days after its confirmation e-mail; an account that was never linked and has not been signed in to for 12 months is deleted; otherwise your account is kept until you delete it. Account → Delete my website login on your dashboard removes the account, and /forgetme in Discord removes everything including the account. Backups are kept for up to 14 days, on the server and in the operator's encrypted off-site copy, and then expire. You must be at least 13 to create an account; the service is not directed to children under 13, and if we learn that an account belongs to someone younger we delete it. In some countries the law asks for a parent's or guardian's permission for online services until the age of 14, 15 or 16; if that applies where you live, ask them before you create an account or tick the marketing box.

Marketing e-mails

We send marketing e-mails - news, offers, promotions and advertisements from Romani - only if you ticked that box, and only after you confirmed your e-mail address. It is optional, never pre-ticked and never a condition of using the service. You can withdraw at any time, without signing in, with the unsubscribe link in every such e-mail, or under Account on your dashboard; it takes effect immediately. We keep a record of your choice (when, where, and the exact wording you saw) as proof that we only write to people who asked. Marketing e-mails use only your e-mail address and your opt-in. Data from Google/YouTube, TikTok or Instagram is never used for marketing or advertising. We do not sell your data or share it with advertisers. Messages about your account itself - confirming your address, a password reset you ask for, a notice that your password or e-mail address changed - are sent regardless of this choice.

Your choices and rights

Without asking us you can: download what we hold about your account (Account → Download what we hold), correct your username and e-mail address, withdraw marketing consent, delete your website login, or delete everything with /forgetme. Wherever you live you may also ask us for access, correction, deletion or a copy of your data, or object to a use of it, by e-mail from your registered address; we answer within 30 days. You may also complain to your data-protection authority. Legal bases: our agreement with you (running the service and your account); our legitimate interest in security and abuse prevention (rate limits, security notices); your consent for marketing e-mails, which you can withdraw at any time.

Who handles your data: Romani Clip Bot is operated by Romani Clip Bot. Our server is hosted by Hetzner Online; our e-mail is delivered by Google Workspace; clips are analysed by Anthropic; and the bot talks to you through Discord. If we become aware of unauthorised access to account data (e-mail addresses, password hashes) or to stored sign-in tokens, we will revoke tokens, end sessions, require new passwords and notify affected users by e-mail and/or Discord without undue delay, and the authorities where the law requires it.

Contact: support@romanitalent.org, or message Romani, our Discord bot.

This website does not use tracking or advertising cookies and loads nothing from third parties. The cookies we set are all strictly necessary: the one that keeps you signed in to your dashboard (12 hours after you open your personal link from Discord or sign in, or 30 days if you tick Keep me signed in; removed when you sign out), a short-lived one that protects the sign-in and sign-up forms, and a 60-second one that carries a notice such as "Saved" to the next page.