Privacy Policy

This Privacy Policy explains how Viral Again (“RearFront”, “we”, “us”) collects, uses, stores, shares, and deletes information when you use the RearFront social-media management platform at rearfront.com (the “Service”). It also describes how we handle data from the social platforms you connect (Facebook, Instagram, TikTok, X, Pinterest, and YouTube).

1. Who we are

The data controller is Viral Again, at House #13, Street #1, Overseas-7, Phase-8, Bahria Town, Rawalpindi, Pakistan. For privacy questions, contact rearfront@viralagain.com.

2. Information we collect

• Account information — name, email, workspace and team details you provide when you create an account (authenticated via our identity provider).
• Connected social accounts — when you connect a Facebook Page, Instagram professional account, TikTok, X, Pinterest, or YouTube account, we receive the account identifier, display name, and the OAuth access and refresh tokens needed to act on your behalf.
• Content you create — posts, captions, media, schedules, approvals, comments, and campaign data you produce in the Service.
• Platform data — content, metadata, and analytics (e.g. views, engagement, audience insights) that the connected platforms return through their official APIs, only for the accounts you have explicitly connected.
• Usage and device data — log data, IP address, and basic device information used to operate and secure the Service. We do not sell this data.

3. How we use your information

• To publish, schedule, recycle, and manage content to the accounts you connect, at your direction.
• To display analytics and reporting for those accounts.
• To provide collaboration, approval, and team workspace features.
• To operate, secure, debug, and improve the Service.
• To comply with legal obligations and the connected platforms’ developer policies.

We do not use platform data for advertising, do not sell it, and do not transfer it except as needed to provide the features you request (see §6).

4. Google API Services — Limited Use

RearFront’s use of information received from Google APIs (YouTube Data API) adheres to the Google API Services User Data Policy, including its Limited Use requirements. We only request the youtube.upload and youtube.readonlyscopes, use that data solely to provide and improve user-facing features, do not transfer it except as necessary to provide those features or for security/legal reasons, do not use it for advertising, and do not allow humans to read it unless you consent, it is necessary for security, or it is required by law. RearFront’s use of YouTube data is also subject to the YouTube Terms of Service and the Google Privacy Policy.

5. How we store and secure data

• OAuth tokens are encrypted at rest using authenticated envelope encryption (per-tenant AES-256-GCM data keys wrapped by a key-management-service master key). Tokens are decrypted only in memory at the moment they are needed to call a platform API, and never logged.
• Tenant isolation— each workspace’s data is isolated at the database level with row-level security, so one customer’s data is never visible to another.
• Data is encrypted in transit (TLS) and access is restricted and audit-logged.

6. Sharing and sub-processors

We share data only with infrastructure sub-processors that operate the Service (e.g. cloud hosting, database, object storage, our authentication provider, and the AI provider used for optional content assistance), each under contract. A current list is available on our Sub-processors page. We do not sell your data or share platform data for advertising.

7. Data retention

• We retain your content and account data while your account is active.
• When you revoke a connection or delete your account, we delete the associated tokens and platform data within 7 days, and complete deletion of remaining data within 30 days, except where retention is required by law.
• Authorized platform data we store is refreshed or deleted on at least a 30-day cycle.

8. Your rights and how to delete your data

Depending on your location you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. You can disconnect any social account at any time in the Service, which immediately revokes and deletes its stored tokens. To request deletion of your data, follow the steps on our Data Deletion page, or email rearfront@viralagain.com.

9. Platform-specific notes

RearFront acts only on accounts you own or administer, uses each platform’s official API only (we do not scrape), and requests only the minimum permissions its features need. The exact permissions we request per platform, and what each is used for, are:

• Facebook — pages_show_list, pages_read_engagement, pages_manage_posts, publish_video, business_management: to list the Pages you manage, read their engagement, and publish posts and videos to them at your direction.
• Instagram — instagram_basic, instagram_content_publish, instagram_manage_insights (plus pages_show_list, pages_read_engagement for the linked Page): to publish to, and read insights for, the Instagram professional account linked to your Page.
• X — tweet.read, tweet.write, users.read, offline.access: to identify your account and post on your behalf, and to refresh access so scheduled posts publish at their set time.
• TikTok — user.info.basic, user.info.stats, video.publish, video.upload, video.list: to identify your account, show your stats, upload and publish videos you author, and list your posts.
• Pinterest — boards:read, pins:read, pins:write, user_accounts:read: to list your boards and account and create pins on boards you own.
• YouTube — youtube.upload, youtube.readonly: to read your own channel and videos so you can pick a destination and see status, and to upload videos you publish.

Your use of connected platforms remains subject to their own terms and policies, including the Meta Platform Terms, TikTok Developer Terms, the X Developer Agreement, the Pinterest Developer Guidelines, and the YouTube Terms of Service.

10. Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

11. Changes

We may update this policy and will post the new version here with a revised date. Material changes will be communicated in-product or by email.

12. Contact

Viral Again, House #13, Street #1, Overseas-7, Phase-8, Bahria Town, Rawalpindi, Pakistan — rearfront@viralagain.com.