Privacy Policy
Last updated: October 16, 2026
This policy covers the Rawfeed Games website at rawfeedgames.com and Rawfeed Social, our Windows desktop application. For privacy questions, contact rawfeedgames@gmail.com. It explains how information is handled when you visit the site, connect social accounts, prepare content, or publish with your approval.
Information we handle
- Connected account data: account and channel identifiers, display names, handles, profile images, authorized content metadata, granted scopes, connection status, and access or refresh tokens returned by Google/YouTube, Meta (Facebook, Instagram and Threads), TikTok, X, and Reddit. The application requests the scopes used by the enabled provider flow. OAuth sign-in does not give Rawfeed Social your provider password; any password you separately choose to save is handled as an optional local credential record described below.
- Account credentials you choose to save: usernames, email addresses, phone numbers, account or channel IDs, passwords, developer secrets, API keys, recovery codes, and private notes. These are optional and separate from OAuth sessions.
- Content and local app data: project names and logos, drafts, titles, captions, selected formats, local media files and metadata, publication receipts, operation journals, and saved account or publication settings. The app may use IndexedDB for local projects, drafts, media, and metadata.
- Technical and security data: OAuth state and PKCE values used to prevent request forgery, local connection timestamps, error status, and app configuration needed to complete a connection.
Why we use it
We use this information to connect the account you select, display truthful connection state, prepare and validate content, send an action you explicitly approve, reconcile an uncertain operation, preserve publication receipts, and protect the application against forged or stale requests. We do not use provider data for advertising, profiling, or unrelated analytics.
Storage and sharing
OAuth tokens and account connection records are stored in native encrypted storage on the Windows computer. Saved login credentials and developer secrets are stored in the separate native encrypted credentials vault. Normal account lists and logs show metadata rather than secret values. A secret is used or revealed only when the user explicitly requests the relevant action, such as showing or copying a saved value. Portable credential backups are encrypted with a password chosen by the user; OAuth sessions, media, and publication journals are outside that backup.
Local drafts, projects, media, receipts, and journals remain on the computer until the user removes them through the available project or draft controls or removes the local application data. Logical project or draft removal keeps publication receipts, shared media still referenced by other records, and account vaults so that those records are not destroyed accidentally. The application does not currently provide a general account-disconnect or credential-delete control; local connection and credential files can be removed separately from the computer, with guidance available by email.
When a provider requires a public HTTPS media address, Rawfeed Social can use the configured Firebase Hosting preview channel. Each staged file is deployed with a one-hour expiration and no-store headers; the address is readable by anyone who has it while the channel is active. Firebase documents that an expired preview channel and its releases are scheduled for deletion within 24 hours, subject to the documented version exceptions. The local temporary copy is cleaned up after staging. This is temporary hosting, not a permanent media library. See Firebase preview channel management.
The app shares data with a provider only when the user connects an account or approves a preparation or publication action. It also sends staged media to the configured Firebase Hosting project when a provider requires a public URL. Rawfeed Games' public website and callback pages are hosted services: a visit or callback request can provide the host/CDN with ordinary request metadata such as IP address, time, URL, user agent, and security logs. The current static site uses self-hosted fonts and has no product analytics or behavioral tracking configured. The app does not sell personal information or share it for targeted advertising. Provider and hosting services process data under their own terms and privacy policies.
Retention and deletion
Provider tokens are retained in the encrypted vault while the connection is useful and may be refreshed when the provider permits it. A provider can invalidate a token or require reconnection. To stop provider access, revoke Rawfeed Social in the provider's account security or connected-app settings, then remove local application data or connection files from the computer. Revocation is controlled by the provider; the app does not promise to delete a provider account, post, or cloud copy.
For a Google or YouTube connection, access can also be revoked from Google security settings. Google API data is handled under the Google Privacy Policy and the applicable YouTube and Google API terms.
Rawfeed Social's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the requested app features, not for advertising or training general-purpose AI models.
You can remove local projects and drafts with the app's delete controls. Removing local application data, connection files, credential files, or encrypted backup files is a separate computer-file action; it does not revoke an OAuth grant or delete a provider-side account. Contact rawfeedgames@gmail.com for guidance locating those files. The app has no general cloud deletion button and does not automatically delete data from Google, YouTube, Meta, Instagram, Threads, TikTok, X, Reddit, or Firebase beyond the documented preview expiry.
You may contact rawfeedgames@gmail.com to ask about data held by Rawfeed Social or to request help locating local records. We may need enough information to verify the request and cannot recover a lost vault or a forgotten portable-backup password. Requests and retention are subject to applicable law and the provider's own controls.
Depending on the law that applies to you, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information, or to object to processing or withdraw consent. Contact us to exercise those rights or raise a concern. You may also contact the relevant data protection authority. Processing needed for a feature you request, for security, or to meet legal obligations may continue where applicable law permits it.
Step-by-step guidance is available on our Data deletion page. Data processed independently by a provider or hosting service remains subject to that service's controls and retention rules.
Security and limits
The app uses native encryption, loopback or configured HTTPS OAuth callbacks, state validation, and PKCE where supported. No security measure is perfect. Anyone who obtains a temporary public media URL may read that file before it expires. Protect the Windows account, the app data directory, backup passwords, and provider accounts.
This policy may be updated when the app, providers, or legal requirements change. The current version is the version published on the official Rawfeed Games website.