Privacy

• We use your photos to make your videos — and to make Ugcly better. What we learn from how videos turn out goes back into improving the product.
• We never sell your data, and other customers never see the photos you upload. They're not stock, and they're not a public library.
• Your finished videos stay in your library — we don't delete them behind your back.
• Close your account and your uploads go with it. Delete it from your settings and we remove your photos and the videos made from them, apart from any we've added to Trending. Your payment records stay.
• We post to a connected account only when you schedule it. You connect Instagram or a Facebook Page yourself, and you can disconnect whenever you like.

Your account details (email, name, and a password we store hashed), the product photos you upload, the presenter you upload or pick from ours, the videos we generate for you, and — if a link brought you to Ugcly — which channel that was and the campaign details from that link, kept on your account for both your first visit and your most recent one.

If you connect an Instagram account or a Facebook Page to the planner, we also hold what that account tells us about itself and the key that lets us post to it. There's a section on that below.

Your plan sets how many finished videos your library holds, and we don't remove them to make space — when it's full, you delete one or upgrade. We keep the working files we create along the way for as long as the project exists; delete the project and they go too. We may keep small thumbnails, and we keep your uploads to power your account. The two campaign cookies under Cookies expire 365 days after they're set, and the campaign details saved on your account stay for as long as your account does.

You can delete your account from your settings. We delete the account, the photos you uploaded and the videos we made from them. The files come off our storage, not just out of your library, and there's no undoing it — except a video we've added to the Trending gallery other Ugcly users see, where our copy stays.

Your payment records stay. We're required to keep business records, and those hold the name, email address and billing address you gave at checkout, plus what you paid and when. Closing your account doesn't remove them.

How long we keep anything to do with a connected Instagram account or Facebook Page is in its own section below.

To make your video, your photos and content are sent to trusted third-party AI providers (for image, voice, and video generation). They process your content to produce your video.

Payments are handled by a secure third-party payment processor. We never see or store your card details.

The planner can publish for you. To let it, you connect your own Instagram professional account, or a Facebook Page, through Instagram's or Facebook's own login screen — and you choose what to allow there. Nothing is connected unless you do that.

For Instagram we ask for two permissions, instagram_business_basic and instagram_business_content_publish. For a Facebook Page we ask for three, pages_show_list, pages_manage_posts and pages_read_engagement. We save the list of what you granted.

Instagram sends us the account's id, its username, its profile picture, and whether it's a business or creator account — we check that last one, because a personal account can't publish this way. Facebook sends us your Facebook user id and the Pages you manage, each with its id, name and picture; if you manage more than one, we hold that list for ten minutes while you pick one, then drop it. Both also send an access token, which is the key that lets us post to the account you chose.

We store the account's id, its username or Page name, its picture, the permissions you granted, and the access token. Tokens are encrypted before they're written down, and no token is ever part of what we send to your browser. We keep our own copy of the profile picture, because the link Meta gives us for it stops working after a while. While an Instagram account stays connected we renew its token in the background, so you don't have to reconnect.

We use all of this for one job: publishing what you scheduled. At the time you picked, we send that account your photo or video and your caption, and ask it to publish. We keep the id of the post that gets created, and the platform's reply to our request, so the planner can show you what happened — credentials are stripped out of that reply before we store it.

We don't read your followers, your comments or your messages, and we don't read anyone else's posts. Reading the account details above and publishing your posts is the whole of what Ugcly asks Instagram and Facebook for.

Disconnect a channel and we delete its access token there and then, along with our copy of its profile picture; the channel leaves your planner. We keep a record of the account and of the posts already published through it, so your publishing history still reads straight. Remove Ugcly from your Instagram or Facebook settings instead, and Meta tells us — we do the same thing. Delete your Ugcly account and the lot goes: tokens, account records and publishing history. How to do each of those is in the next section.

You can remove what we hold yourself, at any time. There are three ways, depending on how much you want gone.

One connected account. Open the account menu at the top right, choose My Account, then Channels. Open the menu on the account's card and choose Disconnect. Its access token and our copy of its profile picture are deleted at that point, and the channel leaves your planner.

From Instagram's or Facebook's side. You can do it from the other end instead: remove Ugcly in your Instagram or Facebook app settings. Meta tells us, and we delete the token the same way. If you send a data-deletion request through Meta, we do the same and give Meta a confirmation code for it.

Your whole Ugcly account. Delete account is in the settings column under My Account. It removes your account, the photos you uploaded and the videos we made from them, and every Instagram account and Facebook Page you connected — tokens, account records and publishing history included. The two things that outlive an account are named above under How long we keep things.

Want help with any of that, or want to know what we hold about you? Write to [email protected].

We use cookies to keep you signed in.

We also set two campaign cookies of our own, ugcly_src and ugcly_src_last: one remembers the first time a campaign or link brought you here, the other keeps the most recent one. Both record the page you landed on, the site or search you came from, the campaign details in the link (source, medium, campaign, content, term), any advertising click ID the link carried, the link's other parameters, and the time you arrived. They're first-party, last 365 days, and we never share them with anyone.

We keep the page as its route only, so a shared video link is stored as /v/:id and never the ID itself. We remove the value of any link parameter whose name looks like a credential — anything containing token, code, key, secret, password, auth, session or email, and the same for passwd, one-time codes (otp), signatures (sig, signature) and web tokens (jwt). And we record nothing at all when you land on the email-verification or password-reset pages.

If a referral link brought you here, we also set ugcly_ref — it holds that referral code and when it was issued, and lasts 45 days. It's there so we can credit the person who referred you when you sign up. You won't get this one unless you arrive through a referral link.

On the home page we also set ugcly_hero — it remembers which headline you last saw and when, so that coming back shows you a different one instead of repeating the same one. A number and a time is all it holds: no identifier, no profile of you. It's ours alone, it lasts 180 days, and we never share it with anyone.

Questions about your data? Email [email protected].