Privacy Policy

MetaGraphy is operated by Hokosha Inc. ("Hokosha", "we"). This policy describes how we handle information in the course of providing the service.

Contact for privacy matters: hokosha.inc@gmail.com.

2.1 Account information

When you create an account we receive your email address and, if you use "Sign in with Google", the name, email address and profile picture associated with your Google account together with Google's account identifier. Sign-in and account management are handled by a managed authentication service. We never receive or store your Google password.

2.2 Content you create and upload

The projects you build and the content you create or upload are stored for you in private storage and are not publicly accessible.

2.3 Usage and billing

We record your membership plan, your credit balance and usage (which model was used, when, and how many credits it consumed), and the status of your subscription. Payments are processed by Stripe; card details are entered on Stripe's pages and we do not receive or store full card numbers. We store the Stripe customer and subscription identifiers and the payment status Stripe reports to us.

2.4 Social publishing — connected social accounts

Only if you choose to connect a social account (available on eligible plans). For each account you connect — YouTube (Google), Instagram / Facebook (Meta), TikTok, X, and other platforms as we enable them — we receive and store:

• the authentication tokens the platform issues to MetaGraphy when you approve the connection on the platform's own consent screen (we never see your platform password);
• the basic profile of the connected account (such as its ID, name and picture) and its connection status;
• a history of the posts made through MetaGraphy (content, target account, time and result).

2.5 Technical and log data

Like most online services we collect IP address, browser and device information, and server request and error logs. We use these for security, abuse prevention and troubleshooting.

2.6 Cookies and analytics

See section 10.

• To provide MetaGraphy — sign you in, run generations, store your projects and assets, meter credits, and bill your membership.
• To publish and schedule your own content to your own social accounts, on your instruction. We use the tokens described in 2.4 only to do what you ask in the app: publish a post now, publish it at a scheduled time, cancel it, refresh the list of your connected channels, and check the result.
• To store the connection status of your social accounts and tell you when a connection needs to be renewed.
• To show you publish results and basic analytics — whether a post was published, the link to it, and, where the platform provides them, basic statistics of posts made through MetaGraphy.
• To support you, keep the service secure, prevent abuse and comply with law.
• To improve the service using aggregated, non-identifying usage statistics.

We do not sell personal information, and we do not use your content, your prompts or your social-account data to train AI models or for advertising.

To generate content, MetaGraphy sends the inputs you provide (such as prompts, reference files, or recorded voice for speech recognition) to third-party AI model providers acting on our behalf. They process the input in order to return the result. Which model handles a given block is shown in the app.

5.1 How connecting works

When you click Connect in the app you are sent to the platform's own sign-in and consent screen (Google, Meta, TikTok, X …). You choose the account and approve the permissions listed there. The platform then issues tokens to MetaGraphy and redirects you back to the app. You can review the permissions at any time in that platform's settings.

5.2 Where tokens are stored

Tokens and connected-account profiles are stored securely on systems we manage. They are used only to carry out your instructions as described in section 3, and are not shared with or sold to third parties, apart from the platform that issued them and the service providers that host our systems. Access is restricted and appropriate safeguards are applied.

5.3 Media copies

To publish a post, a copy of the selected image or video is transferred from your MetaGraphy storage to our systems so it can be uploaded to the platform. That copy is temporary: it is automatically deleted about 7 days after the post is published (a scheduled post keeps its copy until it is published or cancelled). Your originals stay in your MetaGraphy storage and are not affected.

5.4 When connection data is deleted

• When you disconnect an account in the app (Social → Connected accounts → Disconnect): the account's tokens and profile are deleted from our systems and any posts still queued for that account are cancelled.
• When you delete your MetaGraphy account: all connections are removed (see the data deletion instructions).
• When your plan no longer includes social publishing: queued posts are cancelled at once and, after a grace period, the connections are removed (see the Terms of Service).
• When a platform tells us a token was revoked or is invalid: the connection is marked as needing re-authorisation and its token is discarded.

Your publishing history (what was posted, when, and its result) stays in your account until you delete the entries or the account.

MetaGraphy uses YouTube API Services to connect your YouTube channel and publish to it. By connecting a YouTube channel you also agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

6.1 What YouTube / Google data we access

• Basic Google account information (email address, name, profile picture) — to identify which Google account you connected.
• Channel information (channel ID, name, thumbnail) — to show the connected channel in the app and let you pick a target.
• Uploading and publishing videos to your channel with the title, description and privacy status you set in MetaGraphy, and reading the resulting video's status and link.
• Basic analytics / statistics of videos published through MetaGraphy (for example view counts), read-only, to show you results.

We do not read your private videos, comments, subscriptions or watch history, and we never post, edit or delete anything on your channel except the videos you publish through MetaGraphy.

6.2 Refresh tokens

Google issues MetaGraphy a short-lived access token and a refresh token. We store the refresh token so that we can publish videos you have scheduled for later on your behalf without asking you to sign in again. Access tokens are refreshed automatically when needed.

6.3 Limited Use

In particular, Google user data is used only to provide the features you see in the app, is not used for advertising, is not sold, and is not transferred to third parties except as needed to provide those features (to Google itself, and to our hosting providers acting as processors) or as required by law.

6.4 How to revoke access

• In MetaGraphy: Social → Connected accounts → Disconnect. This deletes the stored tokens and channel data from our systems.
• In your Google Account: myaccount.google.com/permissions → Metagraphy → Remove access. Our stored tokens then stop working; disconnect in the app as well (or email us) to have them deleted immediately.

Stored YouTube data (channel information, tokens, video statuses) is deleted when you disconnect the channel or delete your account; entries in your publishing history (video title, link, status) remain until you delete them.

When available, connecting an Instagram professional account, a Facebook Page or a Threads profile uses Meta's login flow. With your permission we access the basic profile of the account you choose (ID, username / name, picture) and the permissions needed to publish photos, videos, Reels and Stories to it and to read the publishing status and basic insights of the posts made through MetaGraphy. We store the tokens and profile as described in section 5. Meta's handling of your data is described in the Meta Privacy Policy.

To revoke: disconnect the account in MetaGraphy (Social → Disconnect), or remove Metagraphy in Instagram (Settings → Security → Apps and websites) or Facebook (Settings → Business integrations). If you remove access on Meta's side only, our tokens stop working; disconnect in the app or follow the data deletion instructions to have them deleted immediately.

When available, connecting a TikTok account uses TikTok's login flow. With your permission we access your basic profile (open ID, display name, avatar) and the permissions to upload and publish videos and photos to your account and read the status of the posts made through MetaGraphy. Tokens and profile are stored as described in section 5. TikTok's handling of your data is described in the TikTok Privacy Policy.

To revoke: disconnect in MetaGraphy (Social → Disconnect), or in the TikTok app: Settings and privacy → Security & permissions → Manage app permissions → Metagraphy → Remove access. Disconnect in the app or follow the data deletion instructions to have our copy of the tokens deleted immediately.

The same pattern applies to X and to any other platform we add (for example LinkedIn, Threads or Mastodon): we access the basic profile of the account you connect and the permissions needed to publish and read the status of your posts; tokens are stored on our infrastructure (section 5) and deleted when you disconnect. Revoke on the platform side under its connected-apps settings (X: Settings → Security and account access → Apps and sessions). Only the platforms shown as available in the app are enabled at any given time.

This website and the app use cookies and similar technologies for two purposes: essential cookies and local storage that keep you signed in and remember your preferences (including those set by our sign-in service and by Stripe during checkout), and analytics — we use Google Tag Manager and Google Analytics to understand, in aggregate, how the site and app are used (pages viewed, browser type, approximate region). You can block analytics cookies in your browser settings or install the Google Analytics opt-out add-on. Google's use of the data is described in the Google Privacy Policy. We do not currently use advertising cookies.

We share information only with service providers who process it on our behalf, and with the social platforms you choose to connect, which act on your instruction. We do not sell personal information. These providers include:

• cloud hosting and infrastructure providers;
• our payment processor (Stripe);
• analytics providers (Google);
• the social platforms you choose to connect (Google / YouTube, Meta, TikTok, X and others);
• AI model providers used to generate content.

We may also disclose information when required by law or legal process, to protect the rights and safety of users and the public, or as part of a merger or acquisition (in which case this policy continues to apply).

Hokosha is located in Japan, and your account data, content and social-account tokens are stored primarily in Japan. Some providers listed in section 11 process data in the United States or other countries whose data-protection rules differ from Japan's. Where we transfer personal information to such providers we do so under their contractual privacy and security commitments; where a transfer happens because you connect a social account, it happens on your instruction and with the consent you give at connection time. Under Japan's Act on the Protection of Personal Information (APPI) you may ask us for information about the safeguards in place for a specific transfer.

• Account, content and billing records — for as long as your account exists; after account deletion they are deleted or anonymised within a reasonable period, except billing records we must keep under tax and accounting law.
• Social-account tokens and profiles — until you disconnect the account, delete your account, or the connection is removed after a plan change (section 5.4).
• Temporary media copies used for publishing — about 7 days after the post is published.
• Publishing history — until you delete the entries or your account.
• Server logs — a limited period for security and troubleshooting.

We take reasonable organisational and technical security measures to protect your information against unauthorised access, loss and alteration — including encryption of traffic in transit and restricting access to production systems to authorised personnel. No method of storage is perfectly secure, so we cannot promise absolute security; in the event of a breach we will notify you and the relevant authorities as required by law. Further information about our security measures is available on request.

Subject to applicable law (including Japan's APPI), you can:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate information;
• Delete your content, individual social connections (Disconnect in the app) or your whole account — see the data deletion instructions;
• Withdraw consent for a social connection at any time by disconnecting it or revoking access on the platform;
• Object to or restrict certain processing, and request portability where these rights apply;
• Complain to a supervisory authority — in Japan, the Personal Information Protection Commission.

To exercise a right, use the in-app controls where they exist or email hokosha.inc@gmail.com from the address registered on your account. We will respond as required by applicable law and may ask you to verify your identity first.

MetaGraphy is not directed to children under 13 (or the higher minimum age in your country) and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy as MetaGraphy evolves — for example when we enable a new social platform. The current version is always at metagraphy.ai/privacy with its effective date at the top; material changes will be announced in the app or on this site.

Hokosha Inc. — KDDI Annex Building 1F, 2-3-3 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan — hokosha.inc@gmail.com