Privacy Policy

1. Introduction

Social Preview ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use our social media preview tool at socialpreview.app ("the Service"). This policy is designed to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the Lei Geral de Proteção de Dados (LGPD) of Brazil, the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, the UK General Data Protection Regulation (UK GDPR), the Australian Privacy Act 1988, and other applicable international privacy laws.

2. Data Controller and Company Information

The data controller responsible for your personal data is:

• Company: MINDQUB SRL
• Registered address: Vespasian Street No. 47, Bucharest, Romania
• Contact email: [email protected]

The Service is hosted on Replit's cloud infrastructure, with servers and all data storage and processing located in the United States (see Section 12, International Users).

3. What Data We Collect

The data we collect depends on how you use the Service:

Images section (no account required)

When you use the Images section, no account is required. All image and video processing (thumbnails, avatars, banners, videos) occurs entirely within your browser. Your files are never uploaded to our servers; they exist only in your browser's memory for the current session and are gone when you close the tab. Published-site usage analytics, if enabled, are described below.

Stored on our servers (only when you sign in with Google)

If you choose to sign in with Google to access Video features, we collect and store the following account information:

• Your Google account identifier (used to recognise your account on return visits)
• Your Google display name
• Your Google profile picture URL (a link only — we do not copy the image)
• A one-way SHA-256 cryptographic hash of your email address (the original email address cannot be recovered from this hash, and is never stored in plain text)
• Your last login timestamp

We never store your Google password or have access to it. We never store your email address in plain text.

Stored in your browser

When you are signed in, a single secure session identifier is stored in a cookie (HttpOnly, Secure, 30-day expiry) to keep you logged in. The corresponding session record is stored server-side in our database. Sessions expire after 30 days.

Payment data

Billing is not currently available. We do not collect payment card details or charge for image or signed-in video previews.

4. How We Use Your Data

• To authenticate your identity and maintain your login session
• To display your name and profile picture within the Service
• To communicate with you about your account (if necessary)
• To comply with legal obligations
• To understand aggregate use of the published Service, such as which preview types and devices are used, when analytics is enabled

We do not use your data for advertising, profiling, or sale to third parties.

5. Cookies and Local Storage

We use the following cookies and local storage:

• Session cookie (essential) — A secure, HttpOnly cookie that identifies your login session. This is strictly necessary for the sign-in feature to function and cannot be disabled without logging out.
• Theme preference (functional) — Stored in your browser's localStorage to remember whether you prefer light or dark mode. Contains no personal data.
• Cookie consent (functional) — Stored in your browser's localStorage to remember that you have acknowledged our cookie notice.

Our published-site analytics do not require analytics cookies. We do not use advertising cookies or cross-site advertising trackers.

6. Third-Party Services and Subprocessors

We use a small number of third-party services, each with a narrow and specific function. When enabled in our publishing settings, Replit's built-in, cookieless Project Analytics measures page visits and the actions listed below. We do not use advertising or cross-site advertising tracking services.

• Google OAuth — Used for sign-in only. When you click "Sign in with Google," Google's servers authenticate you and share your basic profile information with us according to Google's own Privacy Policy.
• YouTube Data API — Used for read-only lookups of public video metadata (title, view count, thumbnail) when you paste a YouTube link. No personal data is sent; only the public video identifier you paste is used to retrieve its metadata.
• Replit — Provides cloud hosting and, when enabled, Project Analytics for the published Service. Analytics may process IP traffic data to report aggregate visitors, traffic sources, countries, browsers, devices, page views, and custom events. Servers are located in the United States.

Custom events report selected platform, preview page or device, sign-in start, and successful local image or video preview creation. Event properties contain only predefined categories (for example, platform and asset type), not uploaded files, filenames, captions, video titles, Google identifiers, or email addresses. Analytics is only collected on the published site when it is enabled; the tracker is not added by the app itself.

We do not share your personal data with any other third parties.

7. Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, we will permanently delete your profile and session data within 30 days. Anonymised, aggregated data (not linked to you) may be retained for service improvement purposes.

8. Data Security

We take appropriate technical and organisational measures to protect your data, including HTTPS encryption for all data in transit, secure database storage, hashing of email addresses, and HttpOnly session cookies. Despite these measures, no system is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us at [email protected] and we will delete the account promptly.

10. Your Rights Under GDPR (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Right of Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate personal data.
• Right to Erasure — Request deletion of your personal data ("right to be forgotten").
• Right to Data Portability — Request your data in a structured, machine-readable format.
• Right to Object — Object to processing of your personal data.
• Right to Restriction — Request restriction of how we process your data.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw at any time.

Our legal basis for processing your data is your consent (provided when you choose to sign in with Google) and our legitimate interest in providing and improving the Service. To exercise any of these rights, contact us at [email protected].

11. Your Rights Under CCPA/CPRA (California Users)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, opt out of the sale of personal information (we do not sell personal information), and not be discriminated against for exercising your privacy rights. To submit a request, email [email protected].

12. International Users

We are established in Romania (European Union), and the Service is hosted on servers located in the United States. Your data may therefore be processed and stored in the United States. By using the Service and signing in, you consent to the transfer of your information to the United States in accordance with this Privacy Policy and applicable data protection law, including the safeguards required under the GDPR for international transfers.

13. Governing Law

This Privacy Policy is governed by the laws of Romania, without prejudice to any mandatory data protection rights you may have under the laws of your country of residence. Where the GDPR or UK GDPR applies, those regulations take precedence for the relevant users.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Your continued use of the Service after changes constitutes your acceptance of the updated policy.

15. Contact Information

For any privacy-related questions, requests, or complaints, please contact us at:

MINDQUB SRL
Vespasian Street No. 47, Bucharest, Romania
Email: [email protected]

We will respond within 30 days (or sooner as required by applicable law).

If you are in the EEA or UK and believe we are processing your data unlawfully, you have the right to lodge a complaint with your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).