Privacy Policy

Who we are

Creovel (“we”, “us”) is run by an independent developer based in Nepal. For any question about this policy or your data, email pranjalregmi412@gmail.com.

What we collect

When you create an account

• Your Google account's email address, name and profile picture, when you continue with Google. Used to sign you in. Creovel never sees your Google password.
• Email address and password, for accounts created with email before Google sign-in. Your password is stored only as a secure hash by our authentication provider; we can't see it.

When you verify your YouTube channel

You sign in with Google and grant Creovel read-only access to your YouTube account (the youtube.readonly permission). We use it to read:

• your channel's ID, name and handle;
• your channel's profile picture;
• your channel's public subscriber count, total views and number of videos;
• your channel banner;
• your latest public uploads: their titles, thumbnails, publish dates and view counts (to show your 3 newest videos, your average views and how often you upload).

That's all. We don't read private or unlisted videos, comments, watch history, messages or any other YouTube or Google data, and Creovel can't upload, post, comment or change anything on your channel. This information is refreshed each time your channel is re-checked, and deleted with your account.

To keep your tier accurate, we store the access and refresh tokens Google gives us, encrypted (AES-256-GCM), and use them only to re-check your subscriber count. This happens when you use Creovel and your last check is more than 7 days old, or when you choose to refresh it.

When you connect Instagram

You sign in with Instagram and grant Creovel read-only access (the instagram_business_basic permission, available for Professional accounts). We read your account id, username, name, profile picture, follower count and number of posts, and your latest posts: their captions, images or video thumbnails, links, dates and like counts. We store the access token Instagram gives us, encrypted, only to re-check your follower count. Creovel can't post, comment or message on Instagram.

When you connect a Facebook Page

You sign in with Facebook and let Creovel see the Pages you manage (the pages_show_list and pages_read_engagement permissions). We read each Page's id, name, picture, link and follower count so you can choose one, then store that Page's details and its access token, encrypted, only to re-check its follower count. We don't read your personal profile, friends or messages, and Creovel can't post as your Page.

Your profile

• display name, bio, niche, main content format, the kinds of collaboration you're open to, your country, optionally your city, the languages you create in, and whether you're open to collabs right now.

What you do in the app

• Connection requests, including the intro message you write, and whether they were accepted or declined.
• Swipes on Discover. These are private: only you can see your own swipes. Other creators only ever learn about a mutual match.
• Messages. Chats are end-to-end encrypted. Your device encrypts each message before it's sent, and only you and the person you're talking to have the keys to read it. We store the encrypted text, the time it was sent, and whether it has been read, but we can't read what it says. Messages sent before encryption was introduced are stored as plain text.
• Collabs. Collab applications are end-to-end encrypted like messages; we store only their type and status. When a collab is finished, we store the link to the published video each of you adds and the 1–5 star rating and optional note you give each other.
• Creos. A record of Creos you earn and spend, and, if you joined through someone's invite link, who invited you.
• Blocks and reports. Who you block, and reports you file. A report can include recent messages from your chat only if you choose to attach them; your device decrypts and sends them with the report.
• Pods. Which pods you're in or invited to. Pod messages are end-to-end encrypted like your chats: each message's key is encrypted separately for every member, and we can't read them.
• Streaks and Daily Picks. The days you opened Discover (kept for 60 days) to count your streak, and the 3 creators picked for you each day (kept for 7 days).
• Email preferences, and a record of the notification emails we send you.
• Encryption keys. We store your public key (so others can send you encrypted messages) and a backup of your private key that is itself encrypted with your recovery code. We never receive your recovery code, so we can't open that backup.

Technical information

• Cookies. We use only the cookies needed to keep you signed in, plus a short-lived cookie (10 minutes) that protects the YouTube sign-in step. No advertising or tracking cookies.
• Server logs. Our hosting provider records basic request information (such as IP address and browser type) to run and secure the service.
• Sign-in protection. To stop password-guessing, we count sign-in, sign-up and password-reset attempts per email address and per IP address. We store only a one-way hash of each, and delete it after 24 hours.
• Your browser stores your encryption keys locally so it can decrypt your messages. They never leave your device except inside the encrypted backup described above.

How we use it

• to place you in the right tier based on your verified subscriber count;
• to show your profile to other verified creators in your tier;
• to suggest matches, ranked by niche, location, language and shared collaboration goals;
• to deliver connection requests, matches, collabs and messages;
• to email you about new matches, requests, collabs and messages (each type can be turned off in your Profile; emails never include what anyone wrote);
• to review reports and keep people safe;
• to keep the service secure and prevent spam and fake accounts.

We don't sell your data, we don't use it for advertising, and we don't use it to train AI models.

Who can see your information

• Verified creators in your tier can see your profile, your channel's name, handle, picture and subscriber count, and your tier. Creators outside your tier can't see you, except people you're already connected with.
• Your number of finished collabs, your average star rating, the video links from finished collabs, your channel banner and stats, your latest public videos, your badges and your longest streak appear on your profile and card for the same creators. The notes in ratings are only visible to the two people in that collab.
• Nobody else on Creovel can see your email address, your swipes, the people you passed on, your Creos, who you blocked, or reports you filed. Blocked creators aren't told.
• Messages can only be read by the two people in the conversation.
• There are no public profiles, and Creovel asks search engines not to index the app.

Service providers

We use a small number of providers to run Creovel. They process data only to provide their service to us:

• Supabase: database, sign-in and account emails.
• Vercel: hosting the website.
• Resend: sending notification emails.
• Google: sign-in and YouTube verification through the YouTube API Services.
• Meta: Instagram and Facebook Page verification.

These providers may store data on servers outside your country. We may also disclose information if the law requires it.

Google and YouTube data

Creovel uses YouTube API Services. By verifying your channel you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

Creovel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Creovel's access to your Google account at any time in your Google security settings. After that, Creovel can no longer re-check your subscriber count, and your verification will lapse until you reconnect.

How long we keep it

We keep your information while your account exists. If you delete your account, we delete your profile, your YouTube details and tokens, your requests, matches, swipes, messages and keys. Copies in our database provider's backups are overwritten as part of their normal cycle.

Your choices and rights

• You can edit your profile at any time on the Profile page.
• You can revoke Google access at any time, as described above.
• You can remove Creovel from your Instagram or Facebook settings at any time. When you do, or when you ask Meta to delete your data from Creovel, Meta tells us and we automatically delete that connected account, its token and its posts. Your tier then follows any other platform you have verified.
• You can ask for a copy of your data, a correction, or deletion of your account by emailing pranjalregmi412@gmail.com from the address you signed up with. We'll respond within 30 days.

Depending on where you live, you may have further rights under local law, such as the right to object to processing or to complain to a data protection authority. Email us and we'll help.

Security

Messages are end-to-end encrypted, YouTube tokens are encrypted at rest, every connection uses HTTPS, and database rules ensure people can only see what this policy says they can. No system is perfectly secure, though; if we learn of a breach that affects you, we'll tell you.

Age

You must be at least 13 years old (or older if your country requires it) to use Creovel. If you believe a child under that age has an account, email pranjalregmi412@gmail.com and we'll remove it.

Changes to this policy

If we change this policy, we'll update the date at the top and, for important changes, let you know in the app or by email before they take effect.

Contact

Questions or requests: pranjalregmi412@gmail.com. See also our Terms of Service.