Privacy Policy

1. Introduction

Prepublish ("we," "us," or "our") operates the Prepublish service at prepublish.ai. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our service.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

By using Prepublish, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our service.

2. Data Controller

For the purposes of GDPR, Prepublish acts as the data controller for the personal data we collect. You can contact us regarding any privacy matters at:

Email: contact@prepublish.ai

3. Data We Collect

3.1 Information You Provide

• Account Information: Email address when you create an account or subscribe
• Content: Scripts, video files, and audio files you upload for analysis
• Payment Information: Processed by our payment provider Polar.sh; we do not store credit card numbers
• Communications: Information you provide when contacting support

3.2 Information Collected Automatically

• IP Address: Used for rate limiting, fraud prevention, and to track daily analysis usage
• Device Information: Browser type, operating system, and device type
• Usage Data: Pages visited, features used, and interaction timestamps
• Cookies: Session cookies for authentication (see Section 10)

3.3 Content Analysis Data

When you submit content for analysis, we process your scripts and media files to provide our service. This content is:

• Sent to third-party AI providers for analysis (see Section 8)
• Stored temporarily to deliver analysis results
• Not used to train AI models without your explicit consent
• Deleted according to our retention policy (see Section 9)

3.4 Connected YouTube Channel Data

Connecting a YouTube channel is optional. Nothing in this section applies unless you choose to connect one. Prepublish requests two read-only scopes from Google and no write scope of any kind:

• youtube.readonly: identifies the channel you connected, lists that channel's own uploads so you can pick one, and reads the title, duration, publish date and view count of the video you pick
• yt-analytics.readonly: reads the audience retention curve of the single video you select, which is the curve the report is built from

When a channel is connected we store, for that channel only:

• The channel identifier, title, thumbnail URL, uploads playlist identifier and subscriber count
• The Google OAuth refresh token, encrypted at rest with AES-256-GCM. Access tokens are held in memory only and are never written to our database
• For each video you select: its retention curve, the script or transcript you supply for it, and the drop positions we compute from the two

Prepublish never modifies your channel. It does not read your comments, your revenue, your subscriber list, your private messages, or any other person's data. It does not request caption access, which Google grants only together with permission to edit and delete videos.

You can disconnect at any time from the channel page. Disconnecting revokes the grant at Google and deletes the stored refresh token immediately. Deleting a report deletes the retention curve and the words stored with it. YouTube data is never sold, never shared with third parties, and never used to train models.

By connecting a channel you also accept the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Prepublish's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our service to you (Article 6(1)(b))
• Legitimate Interests: For fraud prevention, security, and service improvement (Article 6(1)(f))
• Consent: For optional features like marketing communications (Article 6(1)(a))
• Legal Obligation: To comply with applicable laws (Article 6(1)(c))

5. How We Use Your Data

• Service Delivery: To analyze your content and provide script-level attention-risk assessments and improvement suggestions
• Account Management: To create and manage your account, process subscriptions, and authenticate access
• Communication: To send transactional emails (login links, receipts) and respond to support requests
• Security: To prevent fraud, abuse, and unauthorized access through rate limiting and monitoring
• Improvement: To analyze aggregate usage patterns and improve our service (using anonymized data)

We do not sell your personal data. We do not use your content to train AI models. We do not share your data with third parties for their marketing purposes.

6. Third-Party Service Providers

We use the following third-party services to operate Prepublish. Each provider processes data as described below:

7. Assistants and Connectors

Prepublish runs a hosted MCP (Model Context Protocol) server at mcp.prepublish.ai, which lets a third-party AI assistant run Prepublish checks on a script the user has written. Assistants that can connect include Muse, Claude and other MCP clients; those are examples, and Prepublish is not affiliated with, endorsed by, or partnered with any assistant provider.

What an assistant sends us is the material a user gives it for a check: the script text and the planned title, plus any optional details the user supplies (such as intended runtime, category, audience or niche) and, for a free full audit, an email address. We receive nothing else from the assistant: no inbox, no files, no contacts, no conversation history and no account data held by the assistant's provider. Text a user pastes into an assistant reaches that provider before it reaches us.

An anonymous request is identified only by a caller key we derive for it (from a token it presents, the caller's IP address, or a session identifier), stored with the analysis so that a repeated caller is limited rather than confused with every other caller. The free full audit can also take an email address the user supplies, which we use to send the result link. An API key changes that: it attributes the call to the Prepublish account that owns the key, so the request is handled as a signed-in user and counts against that account's plan instead of the anonymous allowance. Keys are created and revoked in the dashboard at prepublish.ai/dashboard, and the connector is documented at prepublish.ai/mcp-server.

Our MCP endpoint writes one log line per call: the protocol method, the tool name, whether the call succeeded, how long it took and the client's self-reported name. It does not write script text, email addresses or IP addresses to that log.

The assistant itself is operated by its own provider, not by Prepublish, and that provider's privacy policy governs what it does with the conversation, including any script pasted into it. Read that policy before sending a script through an assistant.

8. Service Providers Who Process Script Text

Script text submitted for analysis is processed by the providers below, each for the purpose named. The speech-to-text providers are involved only when a user uploads an audio or video file.

• Z.AI: the primary analysis model, which reads the script and produces the attention-risk assessment and rewrites
• Google Gemini: visual analysis of thumbnails and video frames, and a cross-provider fallback for the script audit. Google's handling of that data is described in the Google Privacy Policy
• Fireworks AI: a fallback for the script audit when Google Gemini is unavailable; it receives the script text only. fireworks.ai/privacy-policy
• Cerebras: a fallback for the script audit and the visual analysis when the providers above are unavailable, a check that ties each suggested fix to the exact passage of the script it is about, and the one-click passage rewrite in the editor. cerebras.ai/privacy-policy
• Groq: speech-to-text, only when a user uploads an audio or video file
• AssemblyAI: speech-to-text, used when a user uploads an audio or video file and the primary transcription path is unavailable. assemblyai.com/privacy-policy
• Resend: transactional email, including the link to a completed result, login links and receipts. resend.com/legal/privacy-policy

Prepublish does not use customer scripts to train models and does not sell them. Each provider named above processes that text under its own terms rather than ours, and those terms, not this page, are the authoritative statement of what the provider does with it. Where a provider publishes its own policy we link it above; for Z.AI and Groq, read the policy published by that provider. We do not paraphrase those policies here.

9. Data Retention

We retain your data for the following periods:

• Account Data: Until you delete your account or request deletion
• Analysis Results: Retained while your account is active; deleted within 30 days of account deletion
• Uploaded Content: Processed temporarily and deleted within 24 hours after analysis completion
• Server Logs: Retained for 90 days for security and debugging purposes
• Payment Records: Retained as required by tax and accounting laws (typically 7 years)
• Connected Channel Token: Held while the channel is connected; revoked at Google and deleted immediately when you disconnect
• Retention Curves and Reports: Held while your account is active; deleted when you delete the report, and within 30 days of account deletion

Users without an account: Analysis data associated with your IP address is retained for 30 days, then automatically deleted.

10. Cookies

We use the following cookies:

We only use essential cookies required for the service to function. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this may prevent you from using certain features.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including:

• European Union: Primary data storage (Hetzner, Germany)
• European Union (Sweden): Payment processing (Polar.sh)
• United States: Email delivery (Resend) and transcription (AssemblyAI)
• Other Regions: AI analysis providers may process data in various locations

For transfers outside the EEA, we rely on:

• EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all sub-processors

12. Your Rights

Depending on your location, you may have the following rights:

GDPR Rights (EEA Residents)

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limitation of processing
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

CCPA Rights (California Residents)

• Know: Right to know what personal information we collect
• Delete: Right to request deletion of your information
• Opt-Out: Right to opt out of sale (we do not sell personal data)
• Non-Discrimination: Right not to be discriminated against for exercising your rights

To exercise any of these rights, contact us at contact@prepublish.ai. We will respond within 30 days (or sooner as required by law).

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

13. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure authentication using cryptographic tokens
• Access controls and least-privilege principles
• Regular security monitoring and logging
• Secure hosting in EU data centers (Hetzner, Germany)

API keys are secrets. We store only a SHA-256 hash of each key, never the key itself, and the key is shown to you once, when you create it. Keep it out of shared code, screenshots and distributed clients. You can revoke a key at any time from the dashboard at prepublish.ai/dashboard, and a revoked key no longer authenticates.

While we strive to protect your data, no system is completely secure. In the event of a data breach affecting your personal data, we will notify you and relevant authorities as required by law.

14. Children's Privacy

Prepublish is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at contact@prepublish.ai, and we will delete such data.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending you an email. The "Last updated" date at the top of this page indicates when this policy was last revised.

Your continued use of Prepublish after changes become effective constitutes acceptance of the revised policy.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

You can also reach us through our contact form at prepublish.ai/contact.

We aim to respond to all inquiries within 30 days.