Privacy policy

Effective November 14, 2026.

Who we are

Tarat (https://tarat.app) is operated by Gazzilion (individual entrepreneur), IIN 991120350442, 61 Gogol St, Kostanay, Republic of Kazakhstan. For any question about your data, write to support@aicases.io.

What we collect

• Your email and password when you sign up. We store only a scrypt hash of the password, never the password itself.
• For each Instagram account you connect: the account ID, username, display name, profile picture URL, the ID of the Meta business portfolio you chose when connecting, and the access token issued by Meta.
• For each TikTok account you connect: your TikTok account ID (open_id), username, display name, profile picture URL, and the access and refresh tokens issued by TikTok.
• For each YouTube channel you connect: the channel ID, its name and handle, the channel picture URL, and the access and refresh tokens issued by Google.
• The files you upload for publishing, their captions, titles, the settings you choose for each post (who can watch it, comments, labels), the publishing time and the result: the post ID on the platform, its link and the error text if publishing failed.
• If you create an API key: a hash of the key and its last four characters.
• Technical data in server logs: IP address, browser type and request time. We use it to protect the service and investigate failures.

All tokens are stored encrypted. We never receive your passwords for Instagram, TikTok or Google: you sign in through the platform's own window.

Why we use it

• To publish your photos and videos to the accounts you connected, with the settings and at the time you chose.
• To show which account a post goes to, your post history and the status of each post.
• To keep the service secure and prevent abuse.

We don't sell your data, we don't show ads, and we don't use your files, captions or data from the platforms to train AI models.

What we do in your accounts

We never publish anything without your command, and we don't read your messages, comments, followers or other posts.

• Instagram. We read your profile name and picture (instagram_basic) and publish the photos and Reels you send (instagram_content_publish). Meta also requires every app on this login to request instagram_manage_messages; we never read or send your messages.
• TikTok. We read your profile name and picture (user.info.basic) and publish the videos you send (video.publish). Before each post we ask TikTok which privacy options and interactions your account allows, and you choose them yourself on the posting screen.
• YouTube. We read your channel's name and picture (youtube.readonly) and upload the videos you send (youtube.upload). We don't change or delete videos already on your channel.

YouTube API Services

Tarat uses YouTube API Services to upload videos to YouTube. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke Tarat's access to your Google account at any time on the Google security settings page, as well as by disconnecting the channel in your dashboard.

Tarat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data is stored and who can see it

Our servers are in Kazakhstan, hosted by Hoster.KZ. When you publish, the file, caption, title and post settings are sent to the platform you chose: Instagram (Meta Platforms), TikTok or YouTube (Google). That's how publishing works; from then on the platform's own terms apply. There are no other recipients. We disclose data to government authorities only when the law requires it.

Cookies

We store two cookies in your browser: one keeps you signed in, the other remembers the interface language. We don't use advertising or tracking cookies, and we don't place anything on your device on behalf of Instagram, TikTok or Google.

How long we keep it

• Uploaded files are deleted from our server 7 days after upload, or after publishing if the post is scheduled later.
• Account data, connections and post history are kept while you use the service.
• Channel name and picture from YouTube and TikTok are refreshed daily.
• If a platform tells us access was revoked, we delete the tokens right away. The remaining account data is deleted within 7 days for YouTube and within 30 days for other platforms.
• Server logs are kept for up to 90 days.
• When you delete your account, its data is erased from our database right away.

Your rights and choices

You can see your data in the dashboard, disconnect any account (we delete its tokens right away and, for TikTok and YouTube, also revoke them on the platform), delete your whole account in Settings, or email us. You can also revoke access in your Meta business portfolio settings, in TikTok or in your Google account. See Data deletion for details.

Consent

By signing up you consent to the collection and processing of your personal data under this policy, in line with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”. You can withdraw consent by deleting your account.

Age

The service is for people aged 18 and over.

Changes

If we change this policy in a meaningful way, we'll email you in advance.