Privacy Policy

We use the data described above to:

• Compute performance metrics (views, retention, engagement, follower growth) specific to your own channel or Page history
• Generate a personalized diagnosis of your content's performance, using Anthropic's Claude AI to explain patterns found in your own data — never to invent statistics or compare you against other creators
• Generate content ideas, hooks, scripts, captions, and a content calendar based on your own performance data
• Send you weekly performance reports via email (if you have opted in)
• Improve and maintain the App's core functionality

We do not sell your data to third parties. We do not use your YouTube or Facebook data for advertising purposes.

We take the protection of your sensitive data seriously and apply the following specific safeguards:

• Encryption of sensitive tokens. OAuth access tokens and refresh tokens obtained from Google and Facebook are encrypted at rest using AES-256-GCM encryption before being stored in our database. These encrypted tokens are never exposed to the client-side application (your browser) — they are only ever decrypted server-side, at the moment a request to Google's or Facebook's API is made on your behalf.
• Database-level access isolation. All data is stored using Supabase (PostgreSQL) with Row Level Security (RLS) policies enabled on every table containing user data. RLS is enforced at the database layer itself, not just in application code, meaning that even if a request bypassed our application logic, the database would still independently refuse to return another user's data. Each user can only ever access their own account, connections, content, and metrics.
• Password protection. Account passwords are never stored in plain text. They are hashed using PBKDF2 with a unique, randomly generated salt per user, and a high iteration count, making them computationally infeasible to reverse.
• Login abuse protection. We enforce rate limiting and automatic temporary lockouts on repeated failed login attempts, to protect accounts against brute-force password guessing.
• No storage of platform credentials. We do not store your YouTube or Facebook password at any point. Authentication with those platforms happens entirely through their own official OAuth login screens, and Fleyma never sees or has access to your platform login credentials.
• Minimum necessary access. We request only the specific OAuth scopes required for the App's core functionality (read-only access to your channel/Page details and analytics). While one of the requested Facebook permissions (business_management) is a broader scope as defined by Meta, Fleyma's code only ever uses it to read Page and insights data — we do not use any scope, including this one, to modify, delete, or post content on your behalf.
• Encrypted data in transit. All communication between your browser, our servers, and third-party APIs (Google, Facebook, Anthropic) is encrypted in transit using HTTPS/TLS.

We do not share your data with third parties except:

• With Anthropic, to process your performance data through the Claude API for the purpose of generating your diagnosis and content suggestions. As a commercial API customer, Fleyma's data is not used by Anthropic to train its models, and API inputs/outputs are automatically deleted from Anthropic's systems within 7 days.
• As required by law, or to protect the rights, safety, and security of 2B BossTech Ghana Ltd, our users, or the public.

You may, at any time:

• Disconnect your YouTube or Facebook account from within the App's settings, which immediately revokes the App's stored access token
• Request deletion of your account and all associated data by contacting us at support@fleyma.com
• Revoke the App's access directly from your YouTube (Google Account permissions) or Facebook (Business Integrations) settings at any time, independent of the App

Upon disconnection or account deletion, we delete your stored tokens and imported content/metrics data within 30 days.

Fleyma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

By using Fleyma, you also agree to be bound by the YouTube Terms of Service and acknowledge Google's Privacy Policy.

Fleyma's use of information received from Facebook APIs adheres to the Meta Platform Terms and Meta Data Policy.

Fleyma is not directed at, and does not knowingly collect information from, anyone under the age of 18.

We may update this Privacy Policy from time to time. We will notify users of material changes via email or an in-app notice.

If you have questions about this Privacy Policy or how your data is handled, contact us at:

Email: support@fleyma.com
2B BossTech Ghana Ltd
WH-0011-0065, H398, Agona Nkwanta, W/R, Ghana