Privacy Policy

The short version

Multiply holds your email address, the videos you ask us to distribute, the products and links you add, and the permission you grant to the platforms you connect. We use it to do the one job you signed up for.

We do not sell it, and we do not use your content to advertise to anyone else.

What we collect

Only what the service needs to work:

• Your email address, and the name and handle of your workspace.
• If you set a password, a scrambled version of it that cannot be turned back into the password. If you turn on two-step sign-in, the secret your authenticator app uses, encrypted, and your backup codes, scrambled the same way.
• The permission a platform gives us when you connect it, plus the display name, username and account identifier that platform returns.
• Details of videos you have published that we detect: the title, description, length, cover image, link, and whether the platform told us the video was AI-generated.
• The video files themselves, and the reformatted versions we make for each destination.
• The products and affiliate links you add.
• Clicks on your tracked links: the time, the country, the referring site, whether it looked automated, and any campaign tags on the link.
• Records of sign-in attempts, which include the IP address they came from.
• Counts of how much of your plan you have used.

What we do not store

We do not keep the IP address of someone who clicks your link or visits our homepage. It is combined with their browser description and turned into a one-way code using a value that changes every day, which lets us tell two clicks (or two visitors) apart without knowing who either person is, and stops even us reversing it later.

We do keep the IP address of sign-in attempts, because limiting those is how we stop someone hammering the sign-in form for other people's accounts.

We never store your password. If you choose to set one, we keep only a one-way scrambled version of it (made with scrypt and a random value unique to you), which lets us check the password you type without anyone, including us, being able to read it back. We never ask for it by email, and nobody at Multiply can look it up. If you forget it, we email you a link to choose a new one.

A password is optional. You can also sign in with a link we email you, or with Google. If you use Google, Google tells us your email address, that Google has confirmed it, and your name, and nothing else.

What we do with it

Each of these is the service doing what you asked:

• Signing you in.
• Noticing when you publish something new, and collecting a copy of it.
• Reformatting that video and sending it to the destinations you chose.
• Attaching your affiliate link and counting the clicks it gets.
• Showing you what happened, and counting it against your plan.
• Keeping the service secure, and diagnosing it when something breaks.

What we get from TikTok, and why

When you connect TikTok you approve permission to see your basic profile and the list of videos you have posted, which is what lets us notice a new one without you telling us.

Once TikTok has approved Multiply to post, you are also asked for permission to publish to your TikTok account. We use it only for posts you have approved, as our Terms describe, and before each one we ask TikTok which visibility options your account allows today, so we only offer you those. Until TikTok has finished reviewing Multiply, TikTok only lets those posts be seen by you. If you do not give that permission, noticing your new posts keeps working.

You can disconnect TikTok whenever you like, from the Connected accounts page. When you do, we delete our copy of the access you gave us and stop checking for new posts.

Cookies, and what we put on your device

We use a small number of cookies, all our own, and each one does a single job:

`multiply_session` keeps you signed in as you move between pages. Without it you would have to sign in again on every click. It holds a random identifier and nothing else — no name, no email, nothing readable. It lasts 30 days, or until you sign out, whichever comes first. Signing out deletes it.

`multiply_product` remembers whether you were last working in Repurposing or Slideshows, so the menu shows the right tabs. It holds one of those two words and lasts a year.

`mp_ref` is set only if you arrive through another creator's invite link, so they are credited if you sign up. It holds a signed reference to their account and nothing about you, and lasts 30 days.

`multiply_assistant_return` is set only while you are connecting an AI assistant, to bring you back to its approval screen after you sign in. It lasts 15 minutes.

`mx_backup_codes` is set only when you turn on two-step sign-in, so your backup codes can be shown to you once. It lasts 5 minutes.

None of them can be read by JavaScript running in the page, and none is sent when another website links to us. That is the whole list. We set no advertising cookies, no analytics cookies and no third-party cookies, and nobody else sets a cookie through us. We do not use device fingerprinting.

One thing is kept in your browser's own storage rather than in a cookie: your Need Help? conversation, so it is still there when you reload or move to another page. It stays on your device and is only sent to us as part of the question you are asking. It belongs to the account you are signed in with, is deleted from that browser when a different account signs in there, and is cleared after a week. We use no other local storage, session storage or similar technology.

Two things about your device do reach our servers as part of an ordinary web request. Your IP address is recorded on sign-in attempts, because limiting those is how we stop somebody hammering the sign-in form for other people's accounts. And when somebody clicks one of your tracked links or visits our homepage, their IP address and browser description are combined into a one-way code using a value that changes daily — which lets us count two clicks as two clicks without knowing, or being able to work out, who either person was.

Because we set no advertising or tracking cookies, there is no cookie banner to dismiss. Each cookie above exists only to make the part of Multiply you are using work.

One exception is worth naming, because it is the only time anything from another company loads inside Multiply. The setup guide has short how-to videos hosted on YouTube. Nothing from YouTube loads until you press play — not the video, not a thumbnail, not a request of any kind — and when you do, it loads from Google's privacy-enhanced address, which does not set advertising cookies. If you would rather nothing loaded at all, every video has a link to watch it on YouTube directly instead.

YouTube, and what Google requires us to tell you

Multiply's YouTube features are built on YouTube API Services — Google's official interface for apps that work with YouTube. Some of what follows we are required to tell you. We would tell you anyway, but you should know which parts are obligations.

When you connect a channel you approve two permissions. The first lets us upload a video to your channel. It is the only thing we ever write to YouTube, and the only thing we ever upload is a video you published yourself. The second lets us read which channel you just connected — we read its name, its identifier and its picture, once, so we can store the connection against it and show you which channel is linked on your Connected accounts page.

We do not read your existing videos, your subscribers, your comments or your analytics. We do not search YouTube, we hold no library of anybody else's YouTube content, and we cannot upload to a channel you did not connect.

From YouTube we store the channel's name, handle and identifier, the permission itself — encrypted, as described above — your answer to the made-for-kids question, and the identifier of any video we upload, so we can show you that it went out. We do not copy your existing YouTube videos or keep any record of them.

We do not share YouTube data with anyone. It is not sold, not used for advertising, not used to build a profile of you, and not used to train anything. It stays inside the services listed above that run Multiply itself.

You can disconnect YouTube at any time from your Connected accounts page. We delete our copy of the permission immediately and cancel anything still queued for that channel. You can also revoke it from Google's side, without involving us at all, on Google's security settings page linked below — that stops Multiply reaching your channel straight away. If you close your Multiply account, everything we hold from YouTube goes with it.

Data we obtained from YouTube is deleted when you disconnect the channel or close your account, and we do not keep an archived copy after either.

While a channel is connected, we re-read the channel name and picture from YouTube at least once every 7 days, so what we show you matches what YouTube currently says. If we can no longer read it, we delete our copy instead. Google's rules require this to happen at least every 30 days; we do it more often so a missed run never puts us past that.

• YouTube Terms of Service
• Google Privacy Policy
• Revoke Multiply's access from your Google account

Getting a copy of your video

TikTok does not offer a way for an app to download your video file, even with your permission. To reformat a video for other platforms we need the file, so we use a specialist third-party service to fetch a copy of the video you have already published publicly.

We are telling you this plainly because you should know how your content reaches us, rather than discovering it later.

AI assistants you connect

Multiply can let an AI assistant, such as Meta's Muse, use your account for you. This is not switched on yet; this section describes how it works once it is. Nothing is shared with an assistant until you choose to connect one.

When you do, Multiply shows you its own approval screen, with the assistant's name and what it is asking to do. Seeing your account is always included. Each of the following is a separate box you can leave unticked: posting and scheduling your videos, cancelling scheduled posts and declining TikTok posts; making AI slideshows, including posting a saved preset and setting presets to post automatically on a schedule; and connecting or disconnecting your social accounts and turning automatic posting on or off.

Once connected, an assistant can see the following:

• Your plan, how many videos you have left this period, your free trial status, and your slideshow token balance.
• Your connected social accounts: the platform, the account name, whether the connection is working, and when you connected it.
• Your recent videos: their titles, the first part of the original caption, where each one has been posted or is scheduled, links to the posts, and why a post did not go out.
• TikTok posts waiting for your approval, your automatic posting settings, the links and purposes you set up under Promo links, and your AI slideshows, what each was about, and their progress.

What an assistant cannot do, and what it must ask first

It never receives your password, and never receives the access your social platforms gave us. Connecting a new social account always happens on that platform's own sign-in page. It cannot buy anything, change your plan, withdraw referral earnings, or close your account.

It works only inside your own account, with the same plan, video allowance and slideshow tokens you use on the website, and it cannot spend more than you have. A TikTok post an assistant asks for always waits for you to review and approve it on Multiply, where you choose who can see it and the other TikTok settings. An assistant cannot approve it for you.

We mark posting, scheduling, cancelling, making a slideshow, disconnecting an account and changing automatic posting as actions the assistant must confirm with you. Muse asks you before every one of those, and that cannot be turned off. Getting a link to connect an account and declining a TikTok post are marked as smaller changes, which Muse asks about unless you tell it not to.

How an assistant's access is protected and kept

The access an assistant holds is stored only as a one-way fingerprint (a SHA-256 hash), so the copy in our database cannot be used to get into your account. The pass it uses expires after an hour. The one it renews with is replaced every time it is used, and stops working 60 days after it was last renewed.

You can disconnect an assistant at any time from Settings, under Connected AI assistants. Its access ends immediately and our copy of it is erased.

We keep a record of each request an assistant makes: what it asked to do, when, and whether it worked. That is how we show what happened, stop the same request being carried out twice, and limit how often an assistant can act. The answer to a change it asked for is kept for one day, so a repeated request gets the same answer instead of acting again. The record itself is deleted after 90 days, and a disconnected assistant's details 90 days after it was disconnected.

The one exception is when the law requires us to keep something longer, or we need it for an active security investigation or a dispute. Then we keep only that account's records, only for as long as the reason lasts, and delete them when it ends.

Closing your Multiply account removes every assistant connection and every record of its requests, subject to that same exception.

What happens to it after an assistant has it

Multiply does not sell what an assistant sees or does, and does not use it for advertising or to train AI models.

If you ask an assistant to make an AI slideshow, your description goes to the AI services that generate slideshows, exactly as it does when you use the website.

What an assistant receives from us is then handled by the company that runs it, under its own terms and privacy policy. For Muse, that is Meta. Using Muse with Multiply does not mean Meta endorses Multiply.

Who else handles it

These companies process data on our behalf so the service can run. They are not allowed to use it for anything else.

• Vercel — Runs the website and its servers.
• Neon — Hosts the database where your account and settings live.
• Cloudflare R2 — Stores your video files, slideshow pictures and the sounds you upload.
• Railway — Runs the background service that processes and sends your videos.
• ScrapeCreators — Fetches a copy of a video you have published, so we can prepare it for other platforms.
• Apify — A backup for the same job, used only when the first one fails.
• OpenAI — Our AI provider. It listens to and looks at your videos to work out what each one is promoting, writes caption lines and hashtags, helps write slideshow descriptions, makes the pictures for AI slideshows, and answers questions in the Need Help? chat. What it receives is your video's sound, still frames from it, its caption, what you type or upload when you make a slideshow, and the questions you type into the help chat. We do not store help chat conversations on our servers; your own browser keeps your recent conversation so it is still there when you change page (see “Cookies, and what we put on your device”).
• Stripe — Takes subscription and top-up payments, and pays referral earnings to your bank. You enter card and bank details on Stripe's own pages, so we never see or store them.
• Resend — Sends our emails, such as sign-in links, password reset links and notices about TikTok posts waiting for your approval. It receives your email address and the message.

How long we keep it

The original video we collect is kept while your account is open, because everything else is rebuilt from it.

The reformatted copies made for each destination are deleted about a week after they are made, and download packages after two days. Both can be rebuilt from the original, so keeping them costs storage for no benefit.

Your account, products and analytics stay until you delete them, which you can do yourself at any time from Settings → Data and privacy. Deleting an account removes all of it at once, including every platform permission we hold, and leaves no archived copy.

How it is protected

The permission a platform gives us is encrypted before it is written to the database, using AES-256-GCM, and it is never written to a log. Traffic to the site is encrypted in transit.

We are not going to claim a certification we do not hold. If you need to know something specific about our security before trusting us with your account, ask.

Your choices

You can disconnect any platform at any time, edit or remove your products, and hide your storefront.

You can delete your account and everything in it yourself, from Settings → Data and privacy. That is the whole of it — there is no separate request to make and nothing is retained afterwards.

Email support@videomultiply.com to ask for a copy of what we hold about you, or to correct it.

Children

Multiply is for people running a creator business and is not intended for children. We do not knowingly collect information from anyone under 13, and we will delete it if we find we have.

Changes and contact

When this policy changes we will update the date at the top. If a change materially affects how we handle your information, we will tell you rather than quietly editing the page.

Questions, requests, or anything that looks wrong: support@videomultiply.com.