Privacy Policy
Last updated: September 20, 2026
Hilbras Studio ("we", "us", or "our") operates the Hilbras Studio platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
1. Information We Collect
Account Information
When you create an account, we collect your name, email address, and username. Passwords are stored as bcrypt hashes and cannot be reversed.
Platform Connections
When you connect a social media account (e.g., Instagram, Threads, X, LinkedIn), we store an encrypted access token and your platform username. This allows us to publish content and fetch engagement data on your behalf. Tokens are encrypted using AES-256-GCM and can only be decrypted with the encryption key stored on our servers.
AI Provider Credentials
If you configure a third-party AI provider (e.g., OpenRouter, OpenAI), we store your API key in encrypted form. We never send your API key to our own servers — it is forwarded directly to your chosen AI provider and then discarded.
Content
Posts you create, schedule, or publish through the Service are stored in our database. This includes text, image URLs, scheduling information, and per-platform publish results.
Usage Data
We may collect anonymized usage data such as page views and feature usage to improve the Service. This data cannot be traced back to individual users.
2. How We Use Your Information
- To provide, maintain, and improve the Service
- To publish content to your connected social media accounts at your request
- To generate AI-powered content based on your prompts
- To display analytics and engagement metrics for your connected accounts
- To authenticate you and protect against unauthorized access
3. How We Share Your Information
We do not sell your personal information. We share information only in the following circumstances:
- With social media platforms: When you publish content, we transmit your post to the selected platform using official APIs. This is done solely at your direction.
- With AI providers: When you generate content, your prompt and platform context are sent to your configured AI provider. No personal data beyond what is needed for the request is shared.
- With infrastructure providers: Our Service is hosted on Vercel and uses Supabase for database hosting. These providers process data on our behalf under strict security obligations.
- Legal compliance: We may disclose information if required by law or to protect the rights, property, or safety of Hilbras Studio, our users, or the public.
4. Data Security
We implement industry-standard security measures including:
- AES-256-GCM encryption for all stored tokens and API keys
- bcrypt password hashing with salt
- JWT-based session authentication with httpOnly cookies
- TLS encryption for all data in transit
- Row-level database access — each user can only access their own data
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
5. Data Retention
We retain your data for as long as your account is active. When you delete your account, all data owned by the account — profile, credentials, platform connections, posts, media, chats and memories — is removed with it by the database cascade rules, and the request counters tied to your account are deleted in the same transaction. Platform tokens become unrecoverable immediately because the encrypted values are destroyed together with the account.
6. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your personal data
- Export your data in a portable format
- Withdraw consent for data processing at any time
You can exercise the export and deletion rights yourself from Settings → Data & account: export produces a machine-readable JSON file of everything your account stores (secret keys are never included), and deletion — confirmed with your password — permanently removes it all. For anything else, contact us at the email address below.
7. Third-Party Services
Our Service integrates with the following third-party platforms. Each has its own privacy policy:
- Meta (Instagram, Facebook, Threads)
- X (formerly Twitter)
- TikTok
- YouTube (Google)
We are not responsible for the privacy practices of these third-party services.
8. Children's Privacy
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.
10. Contact Us
If you have any questions about this Privacy Policy, please contact us at:
Email: privacy@hilbras.com
Website: https://hilbras-studio.vercel.app