Privacy policy
Last updated: July 2026
- We collect only what's necessary to provide the service
- YouTube channel access is read-only by default; disconnecting deletes your synced channel data
- We do NOT use your content to train AI models
- We use HTTP-only cookies — no tracking cookies or cross-site tracking
- You can request deletion of all your data at any time
- GDPR and CCPA compliant
1. Information We Collect
1.1 Account Information
When you create an account, we collect your name, email address, and password (hashed with bcrypt, cost factor 12). We never store plain-text passwords.
1.2 Payment Information
When paid billing launches, payments will be processed by a PCI-compliant payment processor (such as Stripe). We will never see or store your full card number; we receive only transaction IDs and subscription status. During the current beta, access is provided through free credits and voucher codes, and no payment data is collected.
1.3 Content You Create
We store the thumbnails you generate, your text prompts, and reference images you upload. This data is stored in Azure Blob Storage with encryption at rest.
1.4 Automatic Data Collection
We collect basic analytics (page views, feature usage) via privacy-respecting analytics. We do not use advertising cookies or cross-site tracking.
YouTube API Services & Your Channel Data
Rexels uses YouTube API Services. By connecting your YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
What we access
When you connect your channel, Rexels requests read-only authorization to access: your channel profile (name, ID, thumbnail, subscriber and video counts), your video list and metadata (titles, thumbnails, publish dates, durations), and per-video analytics (views, impressions, click-through rate, average view duration) for roughly the last 90 days. We cannot upload, edit, comment, or change anything on your channel with this access.
Optional write access
One optional feature, live thumbnail testing, requires an additional YouTube permission that can update video thumbnails. It is granted only through a separate, explicit re-consent screen, is used solely to set thumbnails you have chosen to test, and is never requested as part of normal connection.
How we store and use it
Synced channel data is stored in our database (hosted on Microsoft Azure, encrypted at rest) and used for exactly one purpose: analyzing and scoring your own thumbnails against your own history so we can surface underperformers, rank candidates, and report accuracy back to you. We do not sell it, share it with advertisers, use it to train foundation AI models, or show it to other users. OAuth tokens are stored encrypted (AES-256-GCM).
Deletion and revocation
Disconnecting your channel in the app deletes your synced video and analytics data from our systems. You can also revoke Rexels' access at any time from your Google security settings, and you can request full deletion by emailing privacy@rexels.app.
2. How We Use Your Information
2.1 Service Delivery
To generate thumbnails, manage your account, process payments, and provide customer support.
2.2 Service Improvement
To understand feature usage, fix bugs, and improve the product. We use aggregate, anonymized data — never individual content.
2.3 Communications
Transactional emails (password resets, billing). We will never send unsolicited marketing emails without opt-in consent.
3. AI Training & Your Content
We do NOT use your prompts, images, or generated content to train or fine-tune AI models without explicit consent.
✓ We DO: Process your content through third-party AI providers to generate and analyze thumbnails. Current providers: Microsoft Azure (OpenAI models and Azure AI Vision image analysis), Google (Gemini via Vertex AI), and Black Forest Labs (FLUX, via Azure). Each processes data only to fulfil your request.
✓ We DO: Store your generated content for your access
✗ We DO NOT: Use your content to train, fine-tune, or improve any AI model
4. Data Retention & Deletion
| Data Type | Retention |
|---|---|
| Account data | Until account deletion |
| Generated content | Until manually deleted |
| Synced YouTube channel data | Until you disconnect the channel (deleted on disconnect) |
| Payment records | 7 years (legal requirement) |
5. Your Rights
All users have the right to: access, correct, delete, and export their data.
GDPR (EU/EEA): Right to erasure, portability, and restriction of processing.
CCPA (California): Right to know, delete, and opt-out of data sale. We never sell personal data.
Contact: privacy@rexels.app
6. Security Measures
- HTTPS/TLS 1.3 for all connections
- bcrypt password hashing (cost factor 12)
- Database encryption at rest
- HTTP-only cookies (immune to XSS theft)
- 72-hour breach notification commitment
7. Children's Privacy
Rexels is not intended for users under 16 years of age. We do not knowingly collect data from children.
8. Changes to This Policy
We will provide at least 14 days' notice for significant changes via email and a banner on the site.
9. Contact Us
Email: privacy@rexels.app
We respond within 30 days.