What we store, and what we never see

The short version

• We store the email and password you sign up with, the handles you choose to watch, and the scripts you generate.
• The product sets one cookie, and it keeps you signed in. It loads no analytics at all.
• This marketing site is the exception: it runs Google Analytics so we can see which searches bring people here. No advertising pixel, no heatmap and no session recording anywhere.
• We never see your card. Stripe takes the payment and we store only the identifiers it hands back.
• Deleting your account deletes your data. We do not keep a shadow copy.
• We do not sell your data, and we do not share it for advertising.

What we collect, and why each piece exists

Every field below is one the product actually reads. Nothing is collected speculatively for a feature that might arrive later.

Email address

Your login, and the only way we can reach you about billing or a problem with your account.

Password

Stored as a bcrypt hash, never as text. We cannot read it, recover it or tell you what it is.

Name

Optional. Used to address you in the product. Leave it blank and nothing breaks.

Your own handle

Read during onboarding to work out your niche, which sets the view threshold your board uses, and read again whenever you ask UViral to learn your style or read your profile (below).

Your public profile snapshot

Name, photo, follower, following and post counts, taken from that same read and shown back to you so you can confirm we found the right account.

Handles you track

The accounts you asked us to watch, so your board has something on it.

Transcripts you generate

Kept so you can find them again under Transcripts, and so a reel you have already transcribed is marked as such on the board.

Your style profile

On Creator, only if you press Learn my style: up to 25 of your own recent public reels are transcribed and read to work out how you open, talk and close. The profile is kept so scripts can be written in that style, and any corrections you make to it are kept beside it.

Your profile read

Only if you run My profile: a snapshot of your own public reels over the period it reads, and what your breakout reels (three times your usual views or more) have in common. Your reels are kept against your account and are not added to the shared library.

Scripts you write

The idea you typed and the script written from it, plus any rewrite of a reel in your style, kept so you can find them again.

Your client list

Agency plan only: the client names and niches you enter, which tracked accounts you filed under each, and the reports built from them.

Connected apps

If you connect an AI app to UViral (MCP, in beta): the name of the app and a one-way hash of its access token, never the token itself, so you can see and revoke it in settings.

Billing identifiers

Your Stripe customer and subscription IDs, the status Stripe reports, and when the paid period ends. These decide what your plan lets you do.

Server logs

Our host records requests, including IP addresses, as part of running the service. We do not build profiles from them.

What you send to sales

If you use the Talk to the team form on the pricing section: your name, work email, company, what you said about revenue and anything you wrote in the box. This is the one entry here that is not about an account, because most people who send it do not have one. It is used to reply to you and to keep a record of what was agreed. It is never added to a mailing list and it is not passed to anyone outside the company.

A hashed address, for the free tool

The free transcript generator lets three new reels through per visitor per day. Counting that needs to tell visitors apart, so we store a one-way hash of the address mixed with a secret, never the address. It can answer how many today; it cannot answer who.

What we never have

• Your card number. The payment form is Stripe’s and the card goes straight to them. It does not pass through our servers.
• Your Instagram or Facebook password. We never ask for it and there is nothing in the product that could accept it. We read public profiles the way any visitor can.
• Your direct messages, drafts, insights or anything behind your login on any platform. We are not connected to your account and cannot post as you.
• Your readable password. A hash is not reversible. If you lose it you reset it; nobody here can look it up.

Cookies, and the one place the two halves differ

The product at app.uviral.co sets a single cookie, uviral_session. It holds a signed token that says which account you are, so you are not asked to log in on every page. It is marked HttpOnly, so page scripts cannot read it, and SameSite Lax, so it is not sent from other sites. It lasts 30 days, and logging out deletes it. That is the entire list for the product: no analytics, no third-party script, nothing else.

This marketing site is different, and the difference is deliberate rather than an oversight. uviral.co runs Google Analytics, which sets its own cookies, so we can see which searches and links bring people here. We kept it off the product because knowing how somebody found the page is worth having and watching what they then do inside the thing they paid for is not.

The free transcript tool also loads Cloudflare Turnstile, the check that asks whether you are a person. It is there because that tool is open to anybody and costs us real money on every reel it has not read before.

There is no advertising tag on either half, no heatmap and no session recording, and nothing here is sold or shared for advertising. There is also no cookie banner: analytics is the only non-essential thing loaded anywhere, and your browser’s own tracking protection or any blocker stops it without asking us. If you would rather we did not count your visit at all, block it and nothing on the page breaks.

Who else processes your data

Running the product means a handful of other companies touch parts of it. This is what each kind of them does. We do not publish their names here, but we will tell you: email team@thexmedia.com and ask.

A cloud hosting provider serves this site and the product, which means it sees request logs, including your IP address. A managed Postgres database holds your account, your tracked handles and your scripts.

Payment goes to Stripe, who take the card and keep it. Nothing about your card reaches us. They are named because you will see their payment form yourself at checkout.

Three more are involved in reading posts and writing scripts. One fetches public Instagram and Facebook profiles and reels on our behalf, including your own when you ask UViral to learn your style or read your profile. One turns the audio of a reel into a word-for-word transcript. One writes the hook breakdown, your style profile and the scripts you ask for. Under the terms we hold with them, nothing we send is used to train their models.

Most of these run in the United States, so your account data is stored and processed outside Canada and is subject to the laws of the country it sits in, including lawful access requests made there. Signing up means you accept that transfer. If it is a problem for you, tell us before you subscribe rather than after.

Creators in the library who never signed up

The board is built from public posts by accounts our users chose to watch. Those creators are not UViral users and did not agree to anything. We hold what is already public about a post: the handle, the caption, the view, like and comment counts, the link, and a transcript of what is said out loud in it.

We do not collect private or contact details about them, we do not republish their video, and we do not present anyone as endorsing this product. If you are a creator and you want your account out of the library, email team@thexmedia.com from an address or handle we can tie to the account, and we will remove it and stop reading it.

The free transcript tool widens that door, and it is fair to say so plainly: anybody can paste a link to any public reel, including one by somebody who has never heard of us. The same rules hold. We keep the words that were said and not the video, we take nothing private, and the same address removes a reel from it.

A removal there is permanent by design. We keep the row and mark it blocked rather than deleting it, because a deleted row is one the next person pasting the same link would simply recreate, and a takedown that quietly undoes itself is not a takedown.

What the AI vendors do and do not keep

Transcription sends the audio of a public reel to the vendors named above. Writing in your style sends more, and it is fair to say exactly what: the idea you typed, or the reel being rewritten, together with your style profile and what your profile read found. Your email, billing and login details are never part of any request, and nothing is used to train their models under the business terms we are on.

A script you write is stored against your account so you can find it again, and the transcript of a public reel is cached once for everyone rather than re-fetched per user. Transcripts of your own reels, read for your style or your profile, stay with your account.

How long we keep things

While your account is open

Everything above, so the product works.

When you delete your account

Your account, tracked handles, scripts and style profile are deleted with it. This is immediate and cannot be undone.

Billing records

Stripe keeps the payment history it is required to keep. We cannot delete records held in their system on their own retention clock.

The public library

Rows about public reels stay, because they are not personal data about you and other users depend on them. Nothing in them identifies you as having viewed a reel.

Server logs

Held on our host’s own schedule, in the ordinary course of running a service.

Your rights

Canadian privacy law, PIPEDA, gives you the right to see what we hold about you, correct it, and withdraw consent. You can do most of it yourself: your account page shows what we have, and deleting the account removes it.

For anything the product does not cover, email team@thexmedia.com. We answer within 30 days, which is what the law allows. If you are in the UK or the EU, the same requests work; write to the same address. If we get it wrong, you can complain to the Office of the Privacy Commissioner of Canada.

Security, stated plainly

Passwords are hashed with bcrypt. The session token is signed and cannot be edited by the browser holding it. Traffic runs over HTTPS. Admin access inside the product is a role recorded on the account, and every privileged action is written to an audit log before it happens.

None of that is a guarantee. No service can promise it will never be breached, and anyone who does is telling you something they cannot know. If we find a breach that affects you, we will tell you and the regulator, because we are required to.

Children

UViral is a paid tool for people running social accounts, and is not intended for anyone under 16. We do not knowingly hold data about children. If a child has signed up, email us and we will remove the account.

Changes to this policy

When this changes, the date at the top changes with it. If a change actually affects what we collect or who receives it, we will email account holders rather than quietly reposting the page.

Reaching a person

TheXMedia Inc., Ontario, Canada. Email team@thexmedia.com. There is no chat widget and no phone queue; that address reaches the people who built this.