Flurra Privacy Policy

How Flurra protects connected account data.

Connected Instagram, TikTok, and YouTube accounts

Flurra lets users connect Instagram, TikTok, and YouTube through each platform's authorization screen. We only read social account data after the user signs in to the platform and authorizes Flurra.

• Instagram, TikTok, and Google/YouTube access tokens are exchanged server-side.
• Access and refresh tokens are encrypted before they are stored in Flurra's backend database.
• Tokens are never stored in localStorage and are never exposed in client-side API responses or browser state.

Data Flurra reads

After authorization, Flurra may read profile information, posts or videos, and available analytics or insight metrics needed to show creator performance and AI content recommendations.

Platform data access depends on the scopes approved by Instagram, Meta, TikTok, Google, and the user. If a scope is unavailable, Flurra shows a limited-data state instead of treating the account as failed.

Optional Instagram inbox and Threads connection

When available, you can separately authorize Instagram inbox access to read comments on your own media and conversations sent to your professional account, and send replies you explicitly submit in Flurra. These features use the instagram_business_manage_comments and instagram_business_manage_messages permissions. Inbox content is fetched directly from Instagram when you open or refresh it; Flurra does not store message or comment bodies in its database or send them to AI providers for analysis. Instagram remains the source of the conversation history.

An optional Threads connection uses threads_basic to verify your Threads identity and display your own posts. Threads credentials are encrypted server-side. This connection does not authorize publishing or access to private conversations. Public-profile research remains a separate feature. You can remove the connection from Connections in your workspace.

YouTube API Services and Google user data

Flurra uses YouTube API Services. By connecting a YouTube account, you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Flurra requests read-only access to YouTube data (the youtube.readonly and yt-analytics.readonly scopes). With that authorization, Flurra reads your channel profile, your recent videos, and their performance analytics — including view, like, and comment counts and audience retention curves — and stores them in Flurra's backend database to power your dashboards and content insights. Stored YouTube data is refreshed on an ongoing basis (retention analytics typically weekly, and in all cases at least every 30 days) so it stays consistent with what YouTube reports.

Flurra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Flurra does not:

• use Google user data for serving personalized or targeted advertising;
• sell Google user data, or transfer it to data brokers, advertising platforms, or other information resellers;
• use Google user data to train, develop, or improve generalized or non-personalized AI or machine-learning models;
• use Google user data for determining credit-worthiness or for lending purposes; or
• allow humans to read Google user data, except with your affirmative consent for specific data, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized and used for internal operations.

Any AI processing of Google user data is performed solely to provide or improve the specific user-facing Flurra features you request, and only by data processors bound to those same Limited Use restrictions.

Disconnecting YouTube from Flurra settings revokes Flurra's Google authorization and deletes the stored connection, tokens, and the YouTube Analytics data Flurra captured through the API. You can also revoke Flurra's access at any time from your Google security settings. If you delete your Flurra account, stored Google user data is deleted with it — Flurra does not retain YouTube data after the connection or account it belongs to is gone, except where retention is required by law.

How Flurra protects your data

Flurra treats connected-account data — including the Google user data it obtains through YouTube API Services — as sensitive, and protects it with the safeguards below.

• Encryption in transit. All traffic between your browser or the Flurra app and Flurra's servers, and between Flurra and Google's APIs, is encrypted with TLS 1.2 or higher. Flurra sends an HTTP Strict Transport Security header on every response, so browsers refuse to reach Flurra over plain HTTP.
• Encryption at rest. Flurra's database and its backups are encrypted at rest by its managed hosting providers. On top of that, every Google OAuth access and refresh token is individually encrypted with AES-256-GCM authenticated encryption before it is written to the database, using a key held only in Flurra's server environment and never stored beside the data it protects.
• Credentials never reach the client. The OAuth code exchange, token refresh, and every YouTube Data API and YouTube Analytics API call run server-side. Access and refresh tokens are never returned in API responses, never written to browser storage, cookies, or device storage, and never written to application logs or error reports.
• Authenticated, per-account authorization. Flurra accounts are authenticated through a managed identity provider (Clerk) that supports email verification and multi-factor authentication. Every request for connected-account data is authorized on the server and scoped to the signed-in user's own account and workspace, so one user cannot read another user's Google data.
• Protected authorization flow. The authorization request Flurra sends to Google carries a signed, expiring HMAC-SHA-256 state value that is bound to an httpOnly, SameSite cookie and compared in constant time when Google returns, so a third party cannot attach a YouTube channel to a Flurra account it does not own.
• Least privilege. Flurra requests only the read-only youtube.readonly and yt-analytics.readonly scopes. It holds no upload, editing, or channel-management access and is technically unable to post, modify, or delete anything on your channel.
• Restricted internal access. Production credentials, environment secrets, and database access are limited to the small number of authorized personnel who need them to operate the service, and are held in managed secret stores rather than in source control. Staff do not read Google user data except with your affirmative consent, to investigate abuse or a security incident, or where required by law. Access is reviewed and credentials are rotated when personnel or providers change.
• No onward exposure. Google user data is excluded from Flurra's product analytics and error-monitoring events, is never sold or transferred to data brokers or advertising platforms, and is disclosed only to the AI processors named below, which are contractually bound to the same Limited Use restrictions and may use it solely to deliver the feature you asked for.
• Bounded retention and deletion. Flurra stores only the YouTube data needed for the features described above, keeps it refreshed against YouTube, and deletes it — together with the stored tokens — when you disconnect YouTube or delete your Flurra account.
• Incident response. If Flurra becomes aware of a security incident affecting Google user data, it will investigate, revoke and rotate the affected credentials, delete or restore affected data as appropriate, and notify affected users and any applicable regulator without undue delay. Security concerns can be reported to support@flurra.io.

Disconnecting and deletion

Users can disconnect Instagram, TikTok, or YouTube from Flurra settings. Disconnecting removes Flurra's stored connection for that platform and prevents future syncs unless the user reconnects.

Users can also request deletion of connected account data by emailing support@flurra.io. See the dedicated data deletion instructions for details.

How data is used

Flurra uses authorized social data to populate dashboards, summarize performance by platform, show top posts, and generate contextual content insights for the user. Flurra does not sell connected account tokens. Publishing features and Instagram inbox replies act only on submissions you make through those features.

To generate insights, Flurra may process authorized account data with AI service providers — currently Anthropic (Claude), Google (Gemini), and OpenAI — acting as data processors on Flurra's behalf. These providers process the data only to deliver the requested analysis and are not permitted to use it for their own purposes, including model training.

AI assistants you connect to Flurra

If you choose to connect a compatible AI assistant to Flurra, you authorize that assistant to request data from your own Flurra workspaces through the permissions shown during sign-in. Read access covers saved creator preferences and brand context, connected-account summaries and recent content signals, saved drafts and their revision history, saved ideas, and internal content plans. Optional write access lets the assistant save an idea you supply to your Idea Bank. Flurra checks the account, workspace ownership, and permissions on each request. This connection does not provide social account tokens or permission to publish content, change billing, or edit existing drafts.

These assistants are services you choose to use separately from Flurra. Their handling of the information you share is governed by their own terms, privacy policies, and your settings with them. Connecting an assistant is optional. Review its privacy and data-use settings before sharing unpublished content or private brand information. Flurra's restrictions on Google API data described above continue to apply.

You can disconnect Flurra in the assistant's connector settings. Contact support@flurra.io if you need help revoking a Flurra authorization or deleting data stored in Flurra. Disconnecting does not delete content already copied into an assistant's conversations or storage; use that service's controls or contact it to manage those copies. Deleting your Flurra data follows our data deletion instructions.

Contact

Questions or deletion requests can be sent to support@flurra.io.