Privacy Policy

Last updated October 13, 2026

This describes what Boosted Designs LLC collects when you use Variation Poster, why, who else sees it, and how long we keep it. It reflects what the software actually stores.

What we collect

What	Why
Your email address	To identify your account, sign you in, and send password resets and service notices.
Your password, stored only as a scrypt hash	To verify sign-in. We never store the password itself and cannot recover it.
Your Google account identifier, if you sign in with Google	To match you to your account. We do not receive your Google password.
The videos you upload, their filenames and captions, and technical details such as length and dimensions	To create variations and publish them.
The handles of the social accounts you connect	So you can see which account is connected where.
A record of each post: which video, which platform, at what time, which variation, and whether it succeeded	To avoid repeating a clip too soon, and so you can see what went out.
Post statistics returned by the platforms: views, likes, comments, reach, shares and saves	To show you how posts performed. These cover only posts made through Variation Poster.
Session records: a random token, your browser’s user-agent string, and timestamps	To keep you signed in and let you be signed out everywhere when a password changes.
Your Stripe customer and subscription identifiers, and the brand and last four digits of your card	To manage your subscription and show you which card is on file.

What we do not collect

Card numbers. Payment details are entered on Stripe’s systems and never reach ours. There is no field anywhere in Variation Poster that accepts a card number, an expiry date or a security code.
Passwords for your social accounts. You authorise each platform directly. We never see those credentials.
We do not use advertising trackers or third-party analytics on the signed-in application, and we do not sell personal information.

Who else sees your information

We use these companies to run the service. Each receives only what it needs:

Who	What they receive
Upload-Post	Holds the authorised connections to your social accounts and performs the publishing. Receives the video files we send and returns post statistics.
Instagram, TikTok, YouTube, Facebook	Receive the posts you schedule, under their own privacy policies.
Stripe	Your email, payment details and billing history.
Railway	Runs the servers, and therefore handles data in transit.
Railway / Cloudflare R2 (file storage)	Stores your uploaded videos.
Brevo	Your email address, to deliver password resets and service notices.

We may also disclose information if the law requires it, or to protect our rights or somebody’s safety. If our business is sold, account information may transfer with it; you will be told before that happens.

How long we keep it

Videos you remove are deleted from storage immediately, along with their thumbnails. This cannot be undone.
Profiles you remove are deleted from Upload-Post, disconnecting those social accounts from us, and every video belonging to that profile is deleted.
If you cancel and do not subscribe again, your profiles and videos are deleted at the end of the period you paid for.
If you close your account, that happens immediately.
Password reset links are stored only as a hash, expire after two hours, work once, and are deleted after that.
Records of posts — what was published, where and when — are kept after the videos are deleted, so our own history stays intact. They no longer contain the video.
Billing records are kept by Stripe for as long as tax and accounting law requires.

Your choices

See or change your details. Your email, password and email preferences are on the Account page.
Delete your content. Remove a video or a profile at any time; both delete the underlying files immediately.
Close your account. The Account page does this, and it deletes your videos and disconnects your social accounts.
Ask us for a copy of your data, or for it to be deleted. Email laughsfromabove@gmail.com and we will respond within 30 days.
Email preferences. Service and security emails, such as password resets, are sent regardless — you cannot use the service without them.

Depending on where you live you may have additional rights, including access, correction, deletion, portability, and the right to object to certain processing. Contact us and we will honour them.

Instagram and Facebook (our team accounts)

Boosted Designs LLC runs ten "Team" Instagram accounts and Facebook Pages for the SoloSin Character Battle series. When you comment on one of their posts or message one of them, Meta sends us that comment or message so we can answer it. For this we receive and store:

the comment or message text, and its id;
your Instagram or Facebook account id (scoped to our app) and your username or name;
whether you follow the team account, when you tap a button in our messages;
when we replied, and what happened (sent / failed).

We use this only to reply to you (your free-spot odds, the entry link, one TikTok LIVE follow-up within 24 hours) and to avoid messaging you twice. We do not sell it, use it for advertising, or share it with anyone except the services listed above that run our servers. It is kept for up to 12 months, or until you ask us to delete it.

To have this data deleted, follow the steps on our data deletion page or email laughsfromabove@gmail.com. You can also remove our app any time in your Facebook settings under Apps and Websites (or Instagram: Settings → Website permissions → Apps and websites).

Security

Passwords are hashed with scrypt and are never stored or logged in readable form. Sessions use random tokens in cookies that JavaScript cannot read. Password reset links are stored only as a hash, so a copy of our database would not yield a working link. Access to your videos is checked against your account on every request.

No service can promise perfect security. If a breach affects your personal information we will tell you and the relevant authority as the law requires.

Children

Variation Poster is not for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Where your data is held

Our servers and storage are located in the United States. The companies listed above may process data elsewhere, including the United States.

Changes

We may update this policy. If a change materially affects you we will email you before it takes effect, and the date at the top will change.

Contact

Boosted Designs LLC
Stone Mountain, Georgia, USA
laughsfromabove@gmail.com