BrandLoop — Privacy Policy
BrandLoop is built by Glippin Toys, LLC. The short version: we don't know who you are, and we like it that way.
Summary
- No sign-up, no email, no password. Your account is an anonymous ID created automatically on first launch. Moving to a new phone uses a one-time transfer code — still no identity needed.
- Platform credentials are encrypted at rest — and optional. For each channel you choose either Auto (your platform API keys are stored encrypted with AES-256-GCM on our backend, decrypted only inside a server cloud function at post time, never displayed back to you) or Manual (no credentials stored — BrandLoop generates the post draft and surfaces it in the in-app queue for you to publish yourself). Switching a channel from Auto to Manual deletes its stored credentials immediately.
- We don't post anything you haven't approved during setup. You pick the channels and the daily cadence; you can preview before anything goes live, and an optional approval hold reviews every post.
- No advertising. No cross-app tracking. We don't sell your data.
What we collect
| Data | Why | Retention |
|---|---|---|
| Anonymous account ID (random identifier from Firebase Auth — no email, name, phone, or password) | Keeps your brands together and enforces your plan limits | Until you delete your account |
| Brand profile (name, description, audience, voice preset or custom voice, content pillars, links, channel toggles) | Drives AI post generation in your voice for each brand | Until you edit or delete |
| Platform API keys (only for channels you set to Auto) — encrypted AES-256-GCM | Publish posts to the channels you've set to Auto, on your behalf | Until you switch the channel to Manual/Off, remove the brand, or delete your account — switching to Manual/Off deletes the keys immediately |
| Generated content (post drafts, AI images, video clips; publish history for Auto channels; pending queue for Manual channels) | Show you what was queued or posted; let you preview before going live | History: until you delete the brand/account. Manual queue items: 7 days (TTL). Generated images/videos: auto-deleted from storage after 90 days |
| Usage counters (runs, posts, images, video clips per month) | Plan metering | Until you delete your account |
| Subscription status (tier + active/expired, via RevenueCat) | Unlocking paid features | Until you delete your account |
| Hashed device identifier (free plan only) | Keeps the free tier's monthly allowance fair per device; stored as a hash, never linked to your account ID | Rolling monthly buckets |
| Push token (optional) | "Posts ready to share" reminders you opt into | Until you uninstall |
| Usage analytics (Firebase Analytics) | Anonymous app events (e.g. "brand created", "paywall viewed") tied to a device-level identifier — never a name or email; used only to improve the app | Google Analytics standard retention |
What we never collect
- Names, email addresses, phone numbers, mailing addresses
- Your X / Facebook / Instagram / TikTok passwords (we use the platforms' API key + OAuth flows; we never see your password)
- Your card number — payments are handled entirely by Apple's App Store / Google Play
- Anything from advertising SDKs, or data used to track you across other companies' apps
AI processing
BrandLoop's content is AI-generated. Your brand profile and post content (never your identity — we don't have one) is processed by:
- Anthropic (Claude) — writes and safety-reviews each post draft (paid API; Anthropic does not train on customer API data)
- Google Vertex AI (Imagen) — generates the post images from a description of your brand and the day's post
- Google Vertex AI (Veo) — animates a post image into a short video clip on video-enabled plans
Generated images and videos are stored on Google Cloud Storage behind public links so social platforms can fetch them (that's how posting works), and are automatically deleted from our storage after 90 days.
Payments
Subscriptions are purchased through Apple's App Store or Google Play — we never see your payment details. We use RevenueCat to check subscription status; it receives your anonymous account ID and purchase state, nothing more.
Where your data lives
BrandLoop runs on Google Firebase (Auth, Firestore, Cloud Functions, Secret Manager) and Google Cloud Storage in US-region Google Cloud. Encrypted platform credentials are stored alongside your brand record. Decryption happens only inside a server-side cloud function at the moment a scheduled post needs to publish; the decrypted value is never logged or returned to the app.
Third parties
- Firebase (Google) — authentication, database, cloud functions, secret storage, anonymous usage analytics
- Anthropic (Claude) — post text generation and safety review
- Google Vertex AI — image (Imagen) and video (Veo) generation
- RevenueCat — subscription status
- X (Twitter) — receives posts via the X API, using the developer keys you provided
- Meta (Facebook + Instagram) — receives posts via Graph API using tokens you provide (one-tap OAuth pending Meta review)
TikTok and Nextdoor are not third-party recipients of your data — they have no public posting API, so BrandLoop only generates the post and shows it to you in a manual queue to share yourself.
Your rights
- Delete account + all data: in the app — Plan & usage → Delete account & data (immediate, permanent: brands, posts, media, keys, and the account itself) — or email support@glippintoys.com. An active subscription is cancelled separately in your App Store / Google Play subscription settings.
- Disconnect a platform: per-brand, removes the encrypted credentials immediately
- Pause posting: per-brand toggle stops the daily scheduled publish without losing your profile
- Request your data: email support@glippintoys.com
Children
BrandLoop is intended for adult app builders, business owners, and creators; it is not designed for or marketed to children under 13, and we do not knowingly collect data from children.
Changes
We'll update this page and its date when the policy changes; material changes will be noted in the app's release notes.
Contact
Glippin Toys, LLC — support@glippintoys.com