Privacy policy

Last updated: October 23, 2026

Pulk ("we", "us") is a service that lets you upload short videos and schedule them for publication to social platforms you connect, such as YouTube. This page describes what data we collect and how we access, use, store, share, retain, and delete it — including Google user data.

What we collect

• Your email address (for sign-in).
• OAuth tokens for the social accounts you connect, stored server-side and used only to publish on your behalf.
• The videos you upload, stored in our cloud bucket.
• Scheduling metadata (post times, captions, status) so we can schedule and surface your posts.
• Product analytics (pages viewed, errors, and product events such as an upload failing), linked to your account ID and email when you are signed in, to improve the product.
• Information stored on or read from your device through cookies and similar technologies, described in Cookies and similar technologies below.

Cookies and similar technologies

Pulk, and third parties acting on our behalf, store, access, and collect information on and from your device and browser using cookies and similar technologies such as browser local storage. We use them only to run the service; we don't use advertising cookies or track you across other websites.

• Sign-in (strictly necessary). When you sign in, Pulk stores your session in cookies (named sb-…-auth-token) set through our authentication provider, Supabase, so you stay signed in. These are removed when you sign out.
• Connected-account cache. Pulk keeps a copy of your connected accounts' display names, usernames, and profile pictures in your browser's local storage so the dashboard loads quickly. It is replaced with fresh data from the platform on every visit and discarded after 24 hours.
• Product analytics. PostHog, our analytics provider, stores a random identifier in a cookie and in local storage (named ph_…_posthog) and collects the pages you view, errors, and product events, along with your IP address and browser and device type. When you are signed in, these events are linked to your account ID and email.
• Bot protection. Sign-in, sign-up, and password forms use Cloudflare Turnstile, which runs in your browser and collects technical signals from your device and browser to tell people from automated abuse.

You can block or delete cookies and local storage in your browser's settings. If you block the sign-in cookies, you won't be able to sign in to Pulk.

Google user data

If you connect a YouTube account, Pulk accesses Google user data through Google's OAuth 2.0 flow and the YouTube Data API. Pulk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Pulk uses YouTube API Services to publish to YouTube; Google's own handling of your data is described in the Google Privacy Policy.

Data accessed

Pulk requests the following OAuth scopes, and accesses only the data they cover:

• youtube.upload — the ability to upload the videos you schedule to your YouTube channel.
• youtube.readonly — read-only access to your YouTube channel information (channel name, ID, avatar) and the metadata and status of videos you publish through Pulk.
• userinfo.profile — your basic Google profile (name and profile picture), used to identify the connected account in your dashboard.

Pulk also stores the OAuth access and refresh tokens Google issues when you grant access, your YouTube channel ID, and, for each video you publish through Pulk, the YouTube video ID, its link, and whether it was published. Your channel name, username, and avatar are not stored on our servers: Pulk fetches them from the YouTube Data API each time you open your dashboard. Pulk does not retrieve or store YouTube statistics such as view, like, or comment counts.

Data usage

Google user data is used exclusively to:

• Upload and publish the videos you schedule to your YouTube channel, at the time you choose, with the title, description, and visibility you set.
• Display your connected channel (name, username, avatar) in your dashboard so you can pick where to publish.
• Show the status of posts published through Pulk (e.g. whether an upload succeeded).

We do not use Google user data for advertising, and we do not read your YouTube watch history, subscriptions, comments, or private videos not created through Pulk.

AI/ML training: Pulk does not use any Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Data sharing

We do not sell Google user data, and we do not share it with third parties, except:

• Infrastructure providers that process data on our behalf to run the service (cloud hosting, database, and storage providers), under contractual confidentiality and data-protection obligations.
• Google/YouTube itself, when we transmit your videos and metadata to the YouTube API to publish on your behalf.
• When required by law, such as in response to a valid legal request.

No other third parties receive Google user data, and no human at Pulk reads it except with your permission (e.g. for support), for security purposes, or where required by law.

Data storage & protection

• OAuth tokens and account metadata are stored server-side in our database, encrypted at rest. Tokens are never exposed to your browser or to other users.
• All data is transmitted over encrypted connections (HTTPS/TLS).
• Access to production systems is restricted to authorized personnel and protected by authentication and access controls.
• YouTube data we store is refreshed every day: Pulk re-checks each published video with the YouTube Data API. If a video no longer exists, we mark the post as removed and delete its YouTube video ID and link. If we can no longer access the channel (you disconnected it or revoked Pulk's access), we delete the YouTube video IDs and links we stored for it. No YouTube data is kept more than 30 days without being refreshed.

Data retention & deletion

• Google user data is retained only while your YouTube account is connected to Pulk.
• When you disconnect a YouTube account from your Account settings, we immediately delete its stored OAuth tokens and the YouTube video IDs and links of posts published to it.
• When you ask us to delete your Pulk account, all of your data — including all Google user data, uploaded videos, and scheduling metadata — is deleted from our systems within 7 days.
• You can also revoke Pulk's access at any time from your Google security settings page, or request deletion of your data by emailing hello@pulk.app. We complete deletion requests as soon as possible and always within 7 days.

What we don't do

• We don't sell your data.
• We don't access your social accounts beyond publishing.
• We don't use your data (including Google user data) to train AI/ML models.

Deleting your data

Disconnect any connected account yourself from Account settings. To delete your Pulk account and everything in it, email us at hello@pulk.app from the address you sign in with. We delete your videos, scheduling data, connected-account tokens, and all Google user data from our systems within 7 days and confirm by email.

Changes to this policy

If we make material changes to this policy, we will update this page and revise the "Last updated" date above.

Contact

Questions? hello@pulk.app.