Privacy Policy

Spoof Kitchen is operated by Spoof Social Studio Ltd (“Spoof”, “we”, “us”), a company registered in Nigeria (RC 9424008). Spoof Kitchen is a content workspace that helps creators upload once and publish across Facebook, Instagram, Threads, WhatsApp, YouTube, LinkedIn, X, and TikTok. This policy explains what we collect, why, how long we keep it, and the choices you have. It applies to spoofkitchen.com and the Spoof Kitchen app.

• We collect only what we need to run the product.
• We never sell your personal data.
• Connected-account tokens are encrypted at rest and are never visible to our staff in plain text.
• You can ask us to export or delete your data, or disconnect a social account, at any time by emailing us — see Data Deletion for the exact steps. We action requests within 30 days.

Account data

When you create an account we collect your email address, your display name, and optional profile details. We do not store a password — you sign in either with a one-time code we email you or with your Google account (see Signing in with Google). Sign-in and sessions are run by our own servers; your account records are kept in our database, hosted by Supabase.

Content data

Anything you upload or create inside Spoof Kitchen — videos, images, captions, transcripts, schedules, ideas, boards, and AI-generated assets. Media files are stored on Bunny.net CDN; metadata lives in our Supabase database.

Connected accounts

When you connect a social platform — Facebook, Instagram, Threads, WhatsApp, YouTube, LinkedIn, X, or TikTok — the connection is held in one of two places, depending on the platform: our own publishing service, which we operate on our own servers, or Zernio, a publishing provider we use for platforms we don’t connect to directly. YouTube connections are always held by our own service. Whichever holds a connection stores its OAuth access and refresh tokens encrypted at rest. Alongside the connection we store a profile reference — your platform account ID, handle, display name, avatar URL, and the scopes you granted. We request only the scopes the features you use need.

Depending on the features you use and the scopes you grant, we may also fetch content associated with the connected account — for example your published posts and their performance metrics, and, for platforms and features that support it, comments or direct messages — so we can display them in your workspace or let you respond to them. We only fetch what a feature you actively use requires.

Payment data

Subscriptions are processed by Paystack. We receive your transaction reference, plan, amount, and card brand/last four digits — never your full card number or CVV.

Usage data

Pages visited, features used, device type, browser, IP address, and approximate location (city-level). We use this to fix bugs and improve the product. Product analytics are collected by PostHog, which builds a profile keyed to your account once you sign in.

To show prices in the right currency, we look up which country your IP address belongs to. The lookup runs on our own servers against an offline database; your IP address is not sent to a third party for this, and we don't store the result. Country data from the Number Resource Organization (NRO), licensed under CC BY 4.0.

You can create a Spoof Kitchen account or sign in with your Google account instead of an emailed code. When you do, Google asks you to let Spoof Kitchen see your basic profile, and with your permission sends us:

• your name;
• your email address, and whether Google has verified it;
• a link to your Google profile picture; and
• your Google account ID — a number Google uses to tell us it is the same person signing in next time.

How we use it. Only to create your Spoof Kitchen account, sign you in, and show your name in the app. If you already have an account with the same email address, we sign you in to that account rather than creating a second one. We do not ask Google for anything else at sign-in: we cannot see your Gmail, contacts, files, calendar, or any other Google data, and we do not use your sign-in to read or change anything in your Google account.

Storage. These details are kept in our database with your account, together with the sign-in tokens Google issues so your session can be verified. We do not use those tokens to call any other Google service.

Sharing. We do not sell this data, share it with advertisers, use it for advertising, or use it to train AI models. It is shared only with the vendors that store and run our service (listed under Third parties) and with authorities where the law requires it.

Removing it. You can stop Spoof Kitchen using your Google sign-in at any time from your Google Account permissions page. To delete the data itself, delete your Spoof Kitchen account as described on our Data Deletion page; we remove it within 30 days.

Connecting a YouTube channel is separate from signing in with Google and asks for its own permissions — see YouTube.

• Operate, maintain, and improve Spoof Kitchen.
• Publish, schedule, and analyse posts on platforms you connect.
• Process payments and prevent fraud.
• Send transactional emails (receipts, security alerts, post failures).
• Send product updates and tips — you can unsubscribe at any time from the email footer.
• Comply with legal obligations.

We share data only with vendors who help us run the product:

• Supabase — hosting for the database holding your account and content metadata.
• Hetzner — the servers the application and our own publishing service run on.
• Bunny.net — storage and delivery of your uploaded media and AI-generated images.
• Zernio— the publishing provider that holds your connections to platforms we don’t connect to directly, and delivers posts to them. Content you publish to those platforms passes through Zernio.
• Paystack — subscription billing and card processing.
• Meta (Facebook, Instagram, Threads, WhatsApp), TikTok, Google (YouTube), X, LinkedIn — when you publish or read insights through their APIs, your content and metadata are sent to that platform under their terms.
• OpenAI and Google— AI inference. See “AI processing” below.
• Resend — delivery of sign-in codes and transactional email. Sees your email address and the message.
• PostHog — product analytics, including a profile keyed to your account once you sign in.
• Upstash — Redis rate-limiting counters keyed to your account or IP address. No content.
• Sentry — error monitoring. We send stack traces and diagnostics only: session replay is disabled and we do not attach IP addresses, cookies, or user identifiers to events.

We do not sell, rent, or trade your personal data. We disclose data to authorities only when legally required.

We support connecting Facebook, Instagram, Threads, WhatsApp, YouTube, LinkedIn, X, and TikTok. Platform credentials are held, encrypted at rest, by our own publishing service or by Zernio (see Connected accounts), and are used only to perform actions you initiate — publish a post, fetch insights, read comments or messages for a feature you use, refresh a thumbnail. We do not sell any of this data.

We keep a connected account’s profile reference and any posts, messages, or comments we’ve fetched for as long as the connection stays active. When you disconnect a platform or delete your account, we delete the stored profile reference, tokens, and cached content within 30 days — within 7 days for YouTube, see below.

To disconnect a platform or request deletion of this data, see Data Deletion or email privacy@spoof.media and we will revoke the connection and delete the stored profile. You can also revoke our access directly from the security or connected-apps settings of the platform itself, which takes effect immediately.

Spoof Kitchen uses YouTube API Services to let you publish to and manage a YouTube channel you connect. By connecting a channel you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. The connection is made with your permission on Google’s consent screen and is held by our own publishing service.

What we access and why

• Your channel’s basic details — channel ID, name, and profile picture — to show which channel is connected.
• Uploading videos — the video file, title, description, tags, category, privacy setting, and thumbnail you choose — to publish posts you create, when you choose to publish them. We can also list your playlists or create one when you ask us to add a video to it.
• Statistics and analytics— public counts on your videos and channel (views, likes, comments, subscribers, number of videos) and your channel’s YouTube Analytics (daily views, watch time, average view duration, likes, comments, shares, subscribers gained and lost, audience retention, and audience breakdowns by age group, gender, and country). Audience breakdowns are percentages and totals from YouTube — never data about individual viewers. We use these only to show you how your content performs.
• Comments and managing your videos— the comments on videos you published through Spoof Kitchen, so you can read and reply to them, hide or delete them, and delete a video when you choose to unpublish it. Where a feature you use works with a video’s transcript, we read that video’s captions.

We only act on your channel when you ask us to. We do not sell YouTube data, use it for advertising, use it to train AI models, or share it with anyone except the vendors that store and run our service and, to carry out your request, YouTube itself.

Storage and retention

Your YouTube access and refresh tokens are encrypted at rest on our own servers. They never reach your browser, are never shown to our staff in plain text, and are never shared with third parties. We store the channel details above, records of posts you published through Spoof Kitchen, the statistics and analytics we read, and comments on those posts. Statistics and analytics are kept for as long as your channel stays connected so you can see trends over time, and we check at least every 30 days that you still authorize us to read them. Other YouTube data we store is refreshed or deleted within 30 days. If your authorization can no longer be renewed, we delete the YouTube data tied to it.

Revoking access and deletion

You can revoke Spoof Kitchen’s access to your YouTube data at any time from the Google security settings page. When you disconnect your channel in Spoof Kitchen, delete your account, or ask us to delete your YouTube data (email privacy@spoof.media), we delete it within 7 days. If you revoke access from Google’s settings instead, we delete it within 30 days. Videos already published stay on YouTube until you delete them there.

Spoof Kitchen uses cookies and similar storage on your device as described under Cookies.

Spoof Kitchen’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This applies to both Google sign-in and YouTube.

We use AI models from OpenAI and Google to transcribe video, suggest captions, match trends, and generate images. Inputs you submit to AI features (audio, video frames, prompts, and the draft text you ask them to work on) are sent to those providers strictly to return a result for you.

We use these providers under their standard API terms: they do not use your inputs or outputs to train their models. They may retain the request for a limited period — up to 30 days under current OpenAI API terms — for abuse monitoring and legal compliance, after which it is deleted. We do not have a zero-retention agreement in place with either provider today.

We keep your data for as long as your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, except where we are required to keep records (for example, tax invoices: 7 years).

Depending on where you live (GDPR, NDPR, CCPA), you have the right to:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time.

You can cancel your subscription yourself from Settings → Billing. For everything else — access, correction, export, deletion, or disconnecting a platform — email privacy@spoof.media from your account address and we will action it within 30 days. We are working on self-serve export and deletion; until they ship, the email route is the way to exercise these rights and we honour it in full.

Strictly necessary — always on

Cookies that keep you signed in, remember your workspace, and record your cookie choice. The app cannot function without these, so they are not subject to consent and there is no way to turn them off while using the product.

Analytics — off until you accept

We ask on your first visit before setting any analytics cookie. If you accept, PostHog sets a first-party identifier so we can see which features get used. If you reject — or simply ignore the banner — nothing is stored on your device and no analytics events are sent. Rejecting changes nothing about how the product works.

Your choice lasts six months, after which we ask again. To change it sooner, clear this site’s cookies in your browser and the banner will reappear. We do not use advertising cookies, and we never share analytics data with ad networks. To have an existing analytics profile deleted, email privacy@spoof.media.

Data is encrypted in transit (TLS 1.2+) and at rest. Accounts have no passwords to steal — you sign in with a short-lived one-time code sent to your email, or through Google. Access to production data is restricted to the smallest possible team and audited. If we discover a breach affecting your data, we will notify you within 72 hours.

Spoof Kitchen is not for anyone under 13 (or under 16 in the EEA). We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will delete the account.

We will post updates here and, for material changes, notify you by email at least 14 days before the change takes effect.

Spoof Kitchen is operated by Spoof Social Studio Ltd (RC 9424008), 38 Adedoyin Street, Off Aguda, Surulere, Lagos, Nigeria. For privacy questions or requests:

• Email: privacy@spoof.media
• General: hello@spoof.media