QueueLoom

Privacy Policy

Effective date:

1. Overview

QueueLoom (“the Service”) is a free web service at queueloom.com, run by the site operator (“we”, “us”). Anyone aged 18 or over can create an account (“you”, “the user”) to connect their own social-media accounts (such as YouTube channels, Facebook Pages, Instagram professional accounts and TikTok accounts), schedule and publish their own content to those accounts, and see analytics about that content. Each user has a private workspace; other users cannot see it. The operator also uses the Service for their own channels, under the same rules as every other user.

This policy explains what information the Service processes, why, who can see it, how it is protected, how long it is kept and how you can delete it.

2. Information we process

  • Your QueueLoom account — username, optional display name, optional contact email (we don't verify it and don't send email), a hash of your password (Argon2; we never store the password itself), your role, the time and version of the Terms and Privacy Policy you accepted, and the IP address used to sign up.
  • Connected account identifiers — the IDs, names, nicknames and handles of the channels, Pages and accounts you connect, and the platform user ID that authorised the connection.
  • OAuth credentials — access tokens, refresh tokens, their expiry times and the permissions (scopes) granted by the platform when you connect an account.
  • Post metadata — titles, captions, hashtags, privacy and interaction settings, disclosure choices, scheduled times and target accounts for content you create.
  • TikTok posting records — when you post to TikTok: the creator settings TikTok returned at that moment (nickname, allowed privacy levels, interaction settings, maximum video length), your choices, and a record of your explicit consent (time, IP address, the declaration you agreed to and a fingerprint of the exact content).
  • Uploaded media — video files you upload for publishing, with their technical metadata and a SHA-256 fingerprint.
  • Publishing status — the result of each publishing attempt, including platform post IDs, links, processing status, error messages and timestamps.
  • Analytics and engagement metrics — aggregate figures the platforms return for your own accounts and posts, such as followers, views, likes, comments, shares and watch time, together with the raw platform responses used to compute them.
  • Optional comment management — if you separately opt in, publicly visible comments/replies and public author display names/channel identifiers on the videos you published, together with timestamps and comment IDs. We also store your drafts, approvals and scheduled replies.
  • Support requests — what you send through the support form and any contact details you give.
  • Operational data — an activity log of actions in your workspace, sign-in sessions, and the IP address and browser type used to sign in, kept for security and troubleshooting.

Outside the opt-in Comments inbox, the Service collects aggregate engagement figures, not individual viewer profiles. With separate comment-data acknowledgement, it stores the public commenter details needed to show and respond to comments on your own published videos. We do not profile commenters across unrelated channels.

3. How information is used

Information is used only to provide the functionality you request — connecting accounts, uploading and publishing your content, showing publishing status, retrieving and displaying your analytics — and to keep the Service secure: preventing abuse, rate-limiting sign-ins and sign-ups, investigating misuse and diagnosing errors. It is not used for advertising, profiling or any unrelated purpose.

4. Who can see your data

  • You see everything in your workspace.
  • Other users cannot see or act on anything in your workspace. Videos are served only to their owner.
  • The operator can see your account record (username, display name, contact email, role, status, sign-up and sign-in times and IP addresses), counts of what your workspace contains (brands, accounts, posts, storage used), the activity log for security and abuse investigation, and your support requests. The operator's admin pages do not show your posts, videos or tokens. As the person running the server, the operator has technical access to the database and files; they access workspace content only when needed to keep the Service running or secure, to handle a request from you, or when required by law.

5. OAuth credentials and tokens

When you connect an account, the platform issues OAuth tokens to the Service. These tokens:

  • are used only to perform actions you request — publishing content, checking the connection, reading analytics and, if you separately opt in and grant the platform scopes, managing comments on your own published videos;
  • are stored encrypted at rest and are never displayed in the interface or written to logs;
  • are deleted when you disconnect the account, delete it, or delete your QueueLoom account, with the option (and, on account deletion, an automatic attempt) to also revoke access at the platform;
  • are not sold, not shared with advertisers and not disclosed to any other third party.

6. Sharing and disclosure

We do not sell, rent or trade any information, and we do not share it with advertisers, data brokers or analytics providers. Information leaves the server only:

  • when the Service sends your content and requests to the platform you chose to publish to or read analytics from (for example, uploading your video to TikTok); and
  • where disclosure is required by law.

The Service does not load third-party advertising, tracking or analytics scripts.

7. Platform-specific information

Google / YouTube. The Service uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy. QueueLoom’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the Service’s access at any time from your Google Account permissions page.

Meta (Facebook and Instagram). Data obtained through Meta’s APIs is used only as described in this policy. You can remove the Service’s access from your Facebook settings under Apps and Websites (or Business Integrations). See the Meta Privacy Policy.

TikTok. Data obtained through TikTok’s APIs is used only as described in this policy. You can remove the Service’s access from your TikTok app under Settings and privacy → Security → Apps and services permissions. See the TikTok Privacy Policy.

8. Cookies

The Service uses only essential cookies: a session cookie while you are signed in (expiring after 168 hours), a short-lived security token for the sign-in, sign-up and support forms, and a short-lived cookie for on-screen notices. No advertising or tracking cookies are used.

9. Storage and security

Data is stored on the server that hosts queueloom.com. Traffic is served over HTTPS, passwords are hashed, OAuth tokens are encrypted at rest, workspaces are isolated from each other, and data files are readable only by the service account on the server. No method of storage or transmission is completely secure, but we take reasonable measures to protect the information described here.

10. Retention and deletion

  • OAuth tokens are kept only while an account is connected.
  • Synced commenter data — comment text, public commenter names/channel identifiers and imported comment IDs are refreshed or permanently deleted within 29 days of their last successful retrieval. Reply drafts tied to an expired imported comment may also be removed. First-comment jobs and your own outgoing comment history stay in your workspace until you delete them.
  • Raw analytics data (verbatim platform responses kept for debugging) is retained temporarily according to the Service’s configured retention period — currently 90 days — and then removed. The aggregate metrics derived from them are kept until you delete them.
  • Posts, media, outgoing comment drafts and publishing history, consent records and your activity log are kept until you delete them, the associated brand or account, or your QueueLoom account.
  • Sign-in sessions expire automatically and can be revoked at any time in Settings.
  • Support requests are kept until they are resolved and are deleted with your account.
  • Backups of the database, if made, are kept on the operator's infrastructure and overwritten over time; deleted data can remain in a backup until that backup is removed.

Deleting your data. You can delete your whole account yourself at any time under Settings → Delete account. Before deleting, the Service tries to revoke its access at every platform you connected (where the platform offers that and no other connected account uses the same login), then permanently deletes your workspace: brands, connected accounts and their tokens, posts and publishing history, metrics, consent records, videos, sessions, support requests and activity log. A single record that “a user account was deleted” (without your username or content) is kept in the operator's audit log. You can also disconnect or delete individual accounts, posts and videos, and revoke access directly with each platform as described in section 7. Content you already published on a platform stays there until you delete it on that platform. If you can't sign in, ask for deletion through the support form.

11. Children

The Service is not directed to children and is not intended for use by anyone under 18.

12. Changes to this policy

We may update this policy as the Service changes. The effective date at the top of this page shows when it was last revised. Material changes take effect when published here.

13. Contact

For privacy questions, access or deletion requests, use the support form. Requests are stored on the server and answered by the operator of queueloom.com; signed-in users see the reply on their support page.