Privacy Policy

Last updated: October 29, 2026

1. Who we are

Topmast is a scheduling, publishing and analytics tool used by our own team to manage our channels on YouTube, TikTok, Instagram and Facebook. There is no public sign-up. Data controller: Mateus Volpato de Araujo. Contact for any privacy matter, including the data subject service channel required by Brazil's LGPD: topmast.app@gmail.com.

2. What data we handle

• Data from connected accounts, received through each platform's official sign-in (OAuth): account or channel ID and name, access tokens, the list of published videos, their metrics (views, watch time, retention, reach, likes, comments and shares) and aggregated audience data provided by the platform (such as age range, country and traffic source), which does not identify individuals.
• Public comments on our videos: the commenter's public name, the text and the date, so our team can read them. In the current version, Topmast only reads comments; replies are made in each platform's own app.
• Our own content: the videos, titles, descriptions and publishing times our team creates.

We never ask for or store passwords. This public website uses no cookies, no trackers and no third-party analytics, and it shows no ads or third-party content. The internal dashboard, restricted to our team, uses only a session cookie needed to keep the login. Our hosting provider (Vercel) logs technical access data, such as IP address, for security and operation, under its own privacy policy.

3. Access requested from each platform

• YouTube (Google): youtube.upload, to upload and schedule videos; youtube.readonly, to read channel data, the video list and comments; and yt-analytics.readonly, to read metrics.
• Facebook and Instagram (Meta): see the authorized Pages and Instagram professional accounts, publish videos and Reels to them, read metrics (insights) and read comments.
• TikTok: user.info.basic, to identify the account; video.upload, to send the video as a draft to the app's inbox, where a person completes the post inside TikTok; and video.list, to read the video list and its numbers.

We do not request access to private messages, contacts, payment data or accounts that do not belong to our team.

4. How we use it

• To publish and schedule videos on the connected accounts. Every video is approved by a team member before it enters the publishing queue.
• To read the metrics of our videos for internal reports.
• To read comments on our videos.

Legal bases (LGPD): data from connected accounts is processed based on the consent given when the account is connected; public comments, based on our legitimate interest in reading comments on our videos. We do not use any data for advertising, we do not sell data, and we do not use data received from the platforms to train artificial intelligence models.

5. Platform services

Topmast uses YouTube API Services. When a YouTube account is connected, the YouTube Terms of Service apply, and data from YouTube is also subject to the Google Privacy Policy.

Topmast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We also use the official APIs of Meta (Instagram and Facebook) and TikTok, under the Meta Platform Terms and the TikTok Terms of Service.

6. Who we share it with

We do not sell, rent or hand over data to third parties for their own purposes. Data only passes through providers that work on our behalf and follow our instructions:

• website and dashboard hosting;
• cloud database;
• servers for video processing and temporary video storage;
• artificial intelligence tools used to analyze metrics and draft internal reports.

Some of these providers process data outside Brazil. We may also disclose data when required by law or by order of a competent authority.

7. Where we store it and for how long

• Data is kept in a contracted cloud database and on our team's servers and computers, with access restricted to authorized people.
• Access tokens are kept while the account remains connected and are deleted when access is revoked.
• API data that is not metrics (such as comments and video lists) is kept for no longer than 30 days unless refreshed by the platform.
• Metrics may be kept longer for historical comparison; in that case, access authorization is re-checked every 30 days.
• When access is revoked in Topmast or deletion is requested, we delete the account's data within 7 days. When access is revoked directly on the platform (for example, in Google security settings), we delete it within 30 days.

8. How to revoke access

• Google and YouTube: in your Google Account security settings, at myaccount.google.com/permissions, choose Topmast and remove access.
• Facebook: Settings & privacy › Settings › Business integrations (or Apps and websites) › remove Topmast.
• Instagram: Settings › Apps and websites › remove Topmast. If the account was connected through Facebook, also remove it through the Facebook path above.
• TikTok: Settings and privacy › Security and permissions › Apps and services › remove Topmast's access.

9. How to request data deletion

10. Your rights

Under Brazil's General Data Protection Law (LGPD, Law 13,709/2018) you may ask us to confirm whether we process your data, to access, correct, anonymize or delete it, to port it, to tell you who it is shared with, and to withdraw consent. Write to topmast.app@gmail.com; we reply within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD). As a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022), we have no appointed data protection officer; the email above is the data subject service channel.

11. Security

Access tokens are stored with access restricted to our team, and connections to the platforms use encrypted channels (HTTPS).

12. Children

Topmast is not intended for anyone under 18 and does not knowingly collect children's data.

13. Changes to this policy

If this policy changes, the date at the top is updated. Relevant changes are announced on this page.

14. Contact

topmast.app@gmail.com