Privacy Policy

Last updated: 28 September 2026

Halka is a tool that publishes the same video to your own social media accounts in one pass. This document explains what we collect, where we store it, how long we keep it and who we share it with.

Data controller

Operator	Ali Oğuzhan Yüce — sole trader (individual)
Brand	aliousyucex
Country	Türkiye
Contact	aliousyuce@gmail.com
Response time	We typically reply within one business day.

Full details on the Imprint page.

What we collect

Your account

When you sign in with Google, Google sends us your name, e-mail address and the address of your profile picture. We never see your Google password; that sign-in happens entirely on Google's side.

You can also create an account with your e-mail address and a password; accounts that we create for you (for example for platform reviewers) sign in the same way. We never store that password in plain text: we keep only a salted scrypt hash of it, which cannot be turned back into the password.

We send e-mails to your address with a 6-digit one-time code to verify it or to reset your password, and to let you know when someone tries to sign up again with it. These are transactional messages about your account only; we do not send marketing e-mails. To limit how many of these messages go out we keep a sending log; it holds not your address itself but a one-way hash derived from it, the type of message and the time.

The publishing accounts you connect

When you connect an Instagram, YouTube or TikTok account we receive just enough from that platform to recognise the account and publish on your behalf: your user id on the platform, your user or channel name, the address of your profile picture, and the authorisation credentials (tokens) needed to publish. Exactly what we take from each platform is listed in the YouTube, Instagram and TikTok sections below.

The content you upload

Videos, cover images, thumbnails and the caption text you write.

Publishing records

Which video went to which account and when, the result, the reason if it failed, and the link to the post on the platform. Plus a monthly publication counter.

On Instagram and YouTube we regularly check whether a post published through Halka is still on the platform and write the result (live, removed or made private, plus the reason YouTube gives for a removal) to this record. On TikTok we learn this from the notifications TikTok sends us. Only you see it. If you hide a publication in Halka it only disappears from the lists; the record and the post on the platform stay as they are.

Audit trail

We record security-relevant events — connecting an account, refreshing or removing authorisation, requesting account deletion — together with the time, your IP address and your browser's user agent. We also record, with the time, when we notice that a post is no longer on the platform and when you hide a publication.

Where it is stored

What	Where	Who
Database (account, publishing records, tokens)	Nuremberg, Germany (EU)	Hetzner Online GmbH
Videos, covers and thumbnails	Cloudflare R2 object storage	Cloudflare, Inc.
Authentication	Google OAuth	Google LLC
Account e-mails (verification, password reset, repeated sign-up notice): recipient address and message content	Resend e-mail delivery service (USA); SMTP2GO as a fallback when Resend returns an error or is unreachable	Resend, Inc.; SMTP2GO

How we protect your data

We treat everything we hold about you as sensitive data: your Google account details (name, e-mail address, profile picture), the details and credentials of the accounts you connect (including your YouTube channel), and the videos you upload. We protect it as follows.

Encryption in transit: the panel is served only over HTTPS (TLS), and plain HTTP requests are redirected to HTTPS. Our server talks to Google, YouTube, Instagram, TikTok and our storage provider over HTTPS only.
Encrypted credentials: your platform tokens are never stored in plain text. A separate data key is generated for each user; tokens are encrypted with that key using AES-256-GCM, and the data key itself is encrypted with a master key held in the server environment. The master key is not in the database, so a copy of the database alone is not enough to read any token.
Encrypted, private media storage: videos, covers and thumbnails are kept in a private Cloudflare R2 bucket, which encrypts every object at rest with AES-256. Nothing in the bucket is public; files are uploaded and read only through signed links that expire (15 minutes for uploads, 1 hour for viewing in the panel, 6 hours for a platform fetching your video).
Isolation between users: the database enforces row-level security, so a request made on your behalf can only read or change your own records. The database is not reachable from the internet.
Passwords: we never see your Google password. For accounts that sign in with a password we keep only a salted scrypt hash.
Limited access: only the operator has administrative access to the servers. We do not look at your content or data unless you ask us for help, it is needed to investigate abuse or a security incident, or the law requires it.
Data minimisation: we request only the permissions needed to publish and to show which account your posts go to, and we store only the fields listed on this page.
Backups: the database is backed up twice a day on the same server in Germany. Backups are kept for 14 days and then deleted; tokens stay encrypted inside them.
Incidents: if a security incident affects your personal data, we will notify you and the Turkish Personal Data Protection Authority as the law requires.

Tokens are never shared with any third party. They are used only to send your content to the platform you connected, on your instruction.

YouTube API Services

Halka uses YouTube API Services to upload videos to your channel. By using it you are agreeing to the YouTube Terms of Service, and you can read how Google handles data in the Google Privacy Policy.

The only data we take from YouTube and store is: the channel id, the channel title, the address of the channel's image, the id and link of the videos we uploaded on your behalf, and the status of those videos on YouTube (live, private or removed, and the reason YouTube gives if it removed one). We do not download videos from YouTube, do not index content, and do not collect view or engagement data. The channel title, image and video statuses are refreshed from YouTube regularly, at least every 30 days, while the account stays connected.

Halka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke the application's access to your YouTube account at any time: press "Remove" on the Accounts screen in the panel, or revoke it directly from the Google security settings page. When you press "Remove", we revoke the authorisation at Google and delete the YouTube data and credentials we hold straight away. If you revoke access from Google's side instead, we can no longer refresh the stored channel title, image and video details; they and your credentials are deleted within 30 days.

Instagram (Meta)

You connect an Instagram account through Instagram's own login flow (Instagram API with Instagram Login). We ask for two permissions only: basic account information (instagram_business_basic) and content publishing (instagram_business_content_publish). Only business and creator accounts can be connected.

The only data we take from Instagram and store is: the user id Instagram issues for this app, your username, the account type, the address of your profile picture, the access credential, and the id and link of the posts you publish through Halka. We regularly check whether those posts are still on Instagram. We do not read your followers, likes, comments, messages, other posts or insights.

When publishing, Instagram downloads your video and cover image itself from a signed link we create, which expires after 6 hours; your caption is sent to Instagram with the post.

Deleting your Instagram data

In Halka: press "Remove" on the Accounts screen and we delete the token, the account details and the records of posts published to that account. Instagram's login flow offers no server-side way to revoke an app's authorisation; the deleted token also expires by itself within 60 days at the latest.
In Instagram: remove Halka in the "Apps and websites" section of your Instagram settings. Meta notifies us; we mark the account as "access removed" and delete the token.
A deletion request through Meta: when it arrives we delete everything we received from that Instagram account — the account connection, username, profile picture, tokens and the records of posts published to that account. Meta gives you a confirmation code and a link to our status page, where you can see how the request stands.

TikTok

You connect a TikTok account through TikTok's own login flow. We ask for the content upload permission to send your video to TikTok; if you granted the basic profile permission (user.info.basic) we also use it to show your account name and profile picture.

The only data we take from TikTok and store is: the user id TikTok issues for this app, your display name and profile picture address if you granted that permission, the access credentials, and the TikTok job id of the videos you send from Halka — plus the post id if the post was published publicly. When TikTok notifies us that a post became public or stopped being public, we write that to the publishing record. We do not read your followers, videos, analytics, comments or messages.

We upload your video to TikTok directly, in chunks. Right now the video lands in your TikTok inbox, and you choose the caption, who can view it and the other settings in the TikTok app and finish posting yourself. Once direct posting is enabled, the review screen fetches your current TikTok settings (who-can-view options, disabled interactions, maximum video length) from TikTok to show them to you; we do not store them. The title and settings you choose are sent to TikTok with the post.

Deleting your TikTok data

In Halka: press "Remove" on the Accounts screen and we also revoke Halka's access on TikTok's side; we delete the tokens, the account details and the records of posts published to that account.
In TikTok: remove Halka's access in the app permissions section of your TikTok settings; our tokens stop working immediately. When TikTok notifies us, we delete your tokens, display name and profile picture and mark the account as "access removed"; if your TikTok account was deleted, we delete everything for that account. To delete the publishing history as well, remove the account in Halka.

How long we keep it

Data	Retention
Video and cover image	21, 67 or 97 days from the moment you upload, depending on your plan (the scheduling window plus 7 days). Deleted automatically when that expires — except that media is never deleted while a publication is still pending or scheduled for a later date.
Thumbnail	As long as the publishing record exists, so the queue and history screens are not left blank.
Authorisation credentials	As long as the account stays connected. Deleted when you remove the account, remove Halka in Instagram or a deletion request arrives from Meta; on YouTube, within 30 days if access is revoked from Google's side.
Post ids and links on the platforms	With the publishing record. On YouTube, deleted within 30 days if access is revoked from Google's side.
Publishing records	As long as your account is open.
Audit trail	Survives account deletion, but the IP address, the user agent and the platform account ids are erased.
Unverified e-mail sign-ups	7 days. If the address is not verified within that time, the account is deleted automatically.
E-mail sending log (address hash, message type, time)	30 days, then deleted automatically.
Database backups	14 days, then deleted. Data you delete may remain in a backup until it expires.

Who we share it with

The video, cover image and caption you publish are sent to the platform you selected (Instagram, YouTube, TikTok). Nothing else is shared with anyone.

We do not sell your data, do not use it for advertising and run no third-party tracking.

Cookies

We use a session cookie only, to keep you signed in. No advertising or tracking cookies. Your interface language preference is kept in your own browser's storage and is not sent to us.

Exercising your rights

Access: your account details, connected accounts, videos and publishing history are already visible in the panel.
Correction: change your interface language, time zone and content languages on the Settings screen; change account labels on the Accounts screen.
Deletion: request it under "Close your account" on the Settings screen. You then have a 6-day grace period; at the end of it platform authorisations are revoked, then your media files are deleted, and your account record is removed last. This deletes only the data stored by Halka; it does not affect your posts or data on YouTube, Instagram or TikTok. To delete those, use the platform itself.
Removing a single account: press "Remove" on the Accounts screen; the token is deleted, the records of posts published to that account go, and the platform account id is erased from the audit trail. For YouTube and TikTok the authorisation is also revoked at the platform; for Instagram see the Instagram section above.

Children

This service is not intended for anyone under 18.

Changes

When we update this document we change the date above. We will notify you in the panel if a change is significant.

Write to aliousyuce@gmail.com with any questions — we typically reply within one business day. Deletion can also be requested from the panel itself, and the Settings screen is the fastest route.