개인정보처리방침

Privacy Policy (English)

Nullpointer Studio ("we") operates Tapby (tapby.link). This policy explains what we collect and how we use it. Last updated October 6, 2026.

Information we collect

• For accounts you connect (Instagram, LinkedIn, YouTube): account ID, username or channel name, and an OAuth access/refresh token, encrypted at rest with AES-256-GCM.
• Media files and captions you upload to schedule a post.
• For Instagram comment automation: the commenter's Instagram-scoped ID and comment text, used once to reply and send the requested link, then not kept.
• Server logs (IP address, timestamps) for security, kept up to 3 months.

How we use it

Only to provide the features you turn on: publishing the posts you schedule, replying to comments on the posts you select, and showing you the status of those actions. We do not sell data, use it for advertising, or use it to train AI models.

Google / YouTube data

Tapby uses YouTube API Services. If you connect a YouTube channel we request the youtube.upload scope to upload the videos you schedule and the youtube.readonly scope to show which channel is connected. By connecting, you agree to the YouTube Terms of Service and the Google Privacy Policy. Tapby's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not share Google user data with third parties. You can revoke access at any time at myaccount.google.com/permissions; stored tokens are deleted when you disconnect, and any remaining YouTube data is deleted within 30 days.

How we protect your data

We protect sensitive data, including connected-account tokens and data received from Google APIs, as follows:

• Encryption in transit: Tapby accepts traffic only over HTTPS (TLS), and HSTS blocks unencrypted connections.
• Encryption at rest: OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored. The encryption key lives only in server environment configuration, separate from the database. Tokens are decrypted in server memory only at the moment we call the platform API. The database and file storage are also encrypted at rest by our providers (Supabase, Vercel).
• Access control: only Nullpointer Studio's operators can access the database and secrets. Customer data is separated by workspace, and every request checks ownership, so one customer cannot read or change another customer's data.
• Least privilege: we request only the scopes a feature needs. For YouTube that is youtube.upload and youtube.readonly; we do not request permission to edit or delete videos.
• Logging and monitoring: administrative actions are written to an audit log and errors are monitored. Tokens are never written to logs.
• Incident response: if we become aware of a breach of personal data, we notify affected users and the relevant authorities within 72 hours as required by law, and contain the cause.
• Deletion: disconnecting an account deletes its stored tokens immediately; remaining data for that connection is deleted within 30 days.

Sharing

Data is sent only to the platform you are publishing to (Meta, LinkedIn, Google) and to our infrastructure providers (Vercel for hosting and file storage, Supabase (PostgreSQL) for the database), who process it on our behalf.

Deletion and your rights

Disconnect an account in Tapby, remove the app in your Instagram/Facebook/Google settings, or email us. See Data Deletion for details. To delete your Tapby account, use Delete account in Settings: sign-in is blocked and the tokens of your connected accounts are deleted immediately, your public pages go offline, and your subscription stops renewing. Sign in again within 30 days to restore the account; after 30 days the account and its brand data (pages, links, scheduled posts, uploaded files, DM automation data) are permanently deleted. Payment records are kept for 5 years after deletion, as required by Korean e-commerce law.

Contact

Nullpointer Studio · valid@nullpointerstudio.co