Privacy Policy
Last updated: 7 September 2026
BULALAPP is a business registered in the Philippines. This policy explains what BULALAPP ("we", "us") collects when you use our apps and websites, why we collect it, and what control you have. We keep this short and plain, because we collect very little.
What we collect
| Data | Why |
|---|---|
| Email address | To create your account, send your beta invite, and reply to you. Nothing else. |
| Access tokens for accounts you connect (e.g. YouTube, TikTok, Facebook) | So we can publish the posts you schedule, to your own account, at the time you choose. |
| Your posts and their details (title, description, hashtags, cover, schedule) | To prepare and publish them for you. |
| Videos and images you upload | To publish them. They are deleted from our storage after the post goes out, or when you delete them. |
| Basic usage logs (errors, upload results) | To fix failures and show you whether a post succeeded. |
What we do not do
- We do not sell or rent your data to anybody.
- We do not use your content to train models, or publish it anywhere you did not choose.
- We do not read or collect data from accounts you have not connected.
- We do not run advertising trackers on our apps.
Platform data
When you connect a platform account, we receive only what that platform's permissions allow — typically your account name and the permission to upload or publish content. We use it only to show you which account is connected and to publish what you scheduled. We follow the platform developer policies that apply to it, including the Google API Services User Data Policy and its Limited Use requirements.
Who we share, transfer or disclose your data to
This section covers all data, including Google user data. We do not sell or rent your data, and we do not share, transfer or disclose it to advertisers, data brokers, or anyone for their own purposes. We do not use Google user data to train machine-learning models. We share, transfer or disclose your data to exactly these parties, and no others:
- The platform you chose to publish to. When you publish or schedule a post, we send that post — your video, title, description, tags and thumbnail — to that platform's own API on your behalf: YouTube (Google), TikTok, Facebook or Instagram. This is the purpose of the app.
- Cloudflare, Inc. — hosts this website and runs our publishing service. Your requests pass through Cloudflare's network as a processor acting on our instructions.
- Supabase, Inc. — stores your scheduled posts, your uploaded media and your encrypted access tokens as a processor acting on our instructions.
Cloudflare and Supabase are service providers. They process your data only to operate BULALAPP and are not permitted to use it for their own purposes. Our caption suggestion feature sends only the topic and notes that you type yourself — it never sends Google user data.
We may also disclose data if we are legally required to do so by a valid legal process, or to investigate a security incident or a violation of our terms.
Storage and security
Data is stored with Cloudflare and Supabase, in transit over HTTPS. Access tokens are stored encrypted and are only used by our publishing service. Uploaded media is removed once it is no longer needed for a scheduled post.
Your control
- Disconnect any platform account at any time — from your dashboard, or from that platform's own settings. This immediately stops future publishing and we delete the stored token.
- Delete your account and everything in it yourself, at any time, from Settings → Delete my account. It happens immediately — you do not need to ask us, and we do not keep a copy. If anything cannot be removed, the app tells you so instead of pretending it is gone. You can also email us at [email protected] with the subject DELETE MY DATA, and we complete those deletions within 30 days.
- Download a copy of everything we hold for you, at any time, from Settings → Download my data. It is a JSON file containing your account id and email, your scheduled and published posts, the names of the accounts you connected (never the tokens), your templates, your counters, and your plan.
Retention
Account data is kept while your account exists. Media is deleted after publishing. Logs are kept for up to 90 days. Tokens are deleted when you disconnect or delete your account.
Children
Our apps are not intended for people under 18, and we do not knowingly collect their data.
Changes
If this policy changes materially we will note it on this page and, where appropriate, email you before the change takes effect.
Contact
Privacy questions or a deletion request? Email us at support@bulalapp.com and a real person will answer.