Go-Zapp Privacy Policy

Last updated: June 2026

Go-Zapp ("the app") is operated by Steve Marsh Creative. It is a productivity tool that generates short-form videos from text using AI voice synthesis and optionally posts them to social media platforms on behalf of the authenticated user.

What we collect

• Text input — the text you type is sent to the TTS API to generate speech. It is not stored beyond your session unless you explicitly save a project.
• API keys — keys you enter (TTS provider, music) are stored server-side and accessible only to your authenticated account.
• Projects — saved projects (audio, background media, metadata) are stored on the server and associated with your account only.
• Social media OAuth tokens — access tokens and refresh tokens obtained when you connect a social media account are stored server-side and used solely to post content you explicitly authorise. No other account data is read or retained.
• AI-written captions — only if you click Write with AI in the Post sheet, your script and one still frame of your background are sent to Anthropic to draft a title and caption for you to edit. Nothing is sent unless you click it, and the app does not store the request.
• Usage analytics — when you sign up, sign in, generate audio or post a video, the server records that it happened (with the voice provider or platform, never your text, captions or titles) and sends it to TelemetryDeck, a privacy-focused analytics service. Your email is not sent: the event carries a one-way hash of your account instead. It is used only to see which features are used and whether people come back.

Data protection

All data is transmitted over HTTPS/TLS. OAuth tokens and user data are stored on an encrypted persistent volume (AES-256 encryption at rest) accessible only to the app process running under your authenticated session. No sensitive data is written to logs. Access to stored data is restricted to the authenticated account holder — no third party, including Steve Marsh Creative staff, can access your tokens or project files. Tokens are never exposed in URLs, client-side code, or API responses beyond the server session that holds them.

How we use your data

• To generate TTS audio via the configured voice provider.
• To search and preview background music via the Jamendo API.
• To post videos to TikTok, Facebook, Instagram, or YouTube only when you explicitly click Post.
• To draft a post title and caption with Anthropic's Claude, only when you ask for one.
• To understand how the app is used, via TelemetryDeck as described above.
• We do not sell, share, or transfer your data to any third party beyond the services listed above.

Social media permissions

When you connect a social media account, Go-Zapp requests only the minimum permissions required to publish content on your behalf. These tokens are stored encrypted at rest, transmitted only over HTTPS, and can be revoked at any time by disconnecting the account within the app or directly via the platform's own settings.

YouTube

Go-Zapp's YouTube integration uses YouTube API Services and requests the following scopes:

• youtube.upload — to upload videos to your YouTube channel when you click Post.
• youtube.readonly — to read your channel name for display in the app so you can confirm which account is connected.

By connecting a YouTube account you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Go-Zapp does not store, read, or share any YouTube data beyond the channel name used for display. Security procedures are in place to protect the confidentiality of your Google user data. We use encryption to protect your information — OAuth tokens are encrypted at rest and transmitted exclusively over HTTPS. Tokens are used solely to fulfil upload requests you initiate and are never shared with third parties. You can revoke access at any time via your Google account security settings.

Data retention

Saved projects are retained until you delete them or storage limits are reached, at which point the oldest projects are automatically removed. OAuth tokens are retained until you disconnect the account.

Deleting your data

You can delete everything this app holds about you, at any time, without asking anyone:

1. Disconnect each social account — Settings → Social Accounts → Disconnect. This deletes the stored access and refresh tokens for that platform immediately, and nothing further can be posted on your behalf.
2. Delete your saved projects — Projects → the × on each project. This removes its metadata, audio, background media and any rendered video from the server.
3. Cancel anything scheduled — Scheduled → Cancel on each queued post, which deletes the queued video from the server.

Deletion is immediate and permanent; there is no recovery window and no backup copy is kept. Content already published to a social platform is held by that platform under its own terms and must be deleted there.

To have an entire account and all of its data removed for you, email contact@stemarsh.com from the address the account is registered to. Requests are actioned within 30 days.

Government and legal requests

We have never received a request from a government or law enforcement agency for user data. If that changes, we will say so here.

If we receive one:

• We review whether the request is legally valid and binding on Steve Marsh Creative before responding. We do not disclose data informally or voluntarily.
• We challenge requests we believe to be unlawful, overbroad or improperly served, including by asking for them to be narrowed or withdrawn.
• We disclose only the minimum data the request actually covers — never a whole account where a subset will satisfy it.
• We keep a written record of each request, what was disclosed, the legal basis relied on, and who was involved in the decision.
• We notify the affected user unless we are legally prohibited from doing so.

Contact

Questions or requests: contact@stemarsh.com