Privacy Policy

1. Who we are

Dirty Fire Productions ("we", "us", "our") operates the dirtyfire.app platform, a scheduling and automation tool that helps independent music creators publish short-form video reels to TikTok, Instagram, and YouTube. The platform is currently operated as a private, invite-only service for a small group of trusted creators.

2. Information we collect

We collect the following information when you use the platform:

• Account information: your email address, display name, and a bcrypt-hashed password. We never store your plain-text password.
• Platform OAuth tokens: when you connect TikTok, Instagram, or YouTube, we receive an access token and (where provided) a refresh token from that platform. These tokens are encrypted using AES-256-GCM before being stored in our database. We do not receive or store your social media passwords.
• Video metadata: reel ID, filename, file size, AI-generated title, caption, and hashtags. Your video files are stored on your own hardware — we do not upload them to our servers.
• Post history: timestamps, platform post IDs, and outcomes (success or error) for each publishing attempt.
• Usage data: server logs including IP address, request timestamp, and HTTP status codes. Logs are retained for 30 days.

3. How we use your information

We use the information we collect solely to provide the platform service:

• Authenticating your account and maintaining your session
• Publishing content to the platforms you have connected, on the schedule you have configured
• Generating AI-assisted metadata (titles, captions, hashtags) for your reels using a locally-hosted AI model
• Recording post outcomes and providing you with a post history log
• Diagnosing technical errors

We do not use your data for advertising, profiling, analytics products, or any purpose other than operating the service you signed up for.

4. Platform data (TikTok, Instagram, YouTube)

When you connect a social platform, that platform shares an OAuth access token with us. We use this token only to publish content you have explicitly uploaded and approved. We request the minimum necessary permissions on each platform:

• TikTok: user.info.basic, video.publish, video.upload
• Instagram (Meta): instagram_basic, instagram_content_publish
• YouTube: youtube.upload

We do not read your followers, messages, comments, analytics, or any other data from these platforms. You can revoke our access at any time from within your social platform's account settings, independently of this dashboard.

5. Data storage and security

• All data is stored in a PostgreSQL database running on-premises (your own hardware). No data is stored on third-party cloud services.
• OAuth tokens are encrypted at rest using AES-256-GCM with a key held in an environment variable, never in the database.
• Video files are never uploaded to our servers. They remain on your local storage at all times.
• Database volumes are not accessible outside the Docker network.
• The API is exposed only via Cloudflare Tunnel with TLS. No direct port exposure.

6. Data sharing

We do not sell, rent, or share your personal data with any third party, except:

• The platforms you connect: when publishing, your video and metadata are transmitted to TikTok, Instagram, or YouTube according to their own terms of service and privacy policies.
• Legal requirements: we may disclose data if required by law or in response to a valid legal process.

7. Your rights

You may at any time:

• Request a copy of all data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data — see our Data Deletion page for the full process
• Disconnect any connected social platform
• Pause or stop all publishing activity

To exercise any of these rights, contact us at privacy@dirtyfire.app.

8. Data retention

We retain your account data for as long as your account is active. Post history (audit log) is retained permanently as an immutable record. If you delete your account, we remove your personal data, platform tokens, and reel metadata within 30 days. Audit log entries are anonymized rather than deleted to preserve operational integrity.

9. AI-generated content

Titles, captions, and hashtags for your reels are generated by a locally-hosted AI model (Ollama) running on our infrastructure. This model processes only the reel filename and a derived track hint. No video content is analyzed. The AI model does not transmit data to any external service.

10. Children's privacy

The platform is intended for adult music creators. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at privacy@dirtyfire.app and we will remove it promptly.

11. Changes to this policy

We may update this policy to reflect changes in the platform or legal requirements. We will notify active creators by email at least 14 days before any material change takes effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data requests, or concerns: privacy@dirtyfire.app