Privacy Policy

Last updated: September 3, 2026

Gecko ("the app," "we," "us") is published by Rikraj Haldar, trading as Horrac ("Horrac"). This policy explains what data the app accesses, where it goes (including the parts that now run on servers we operate, not just on your own device), and how you can remove it.

The short version

When you connect a YouTube, Twitch, Instagram, or TikTok account, Gecko talks to that platform's own servers using an authorization you grant through their official sign-in screen. Some of what Gecko does happens locally, on your own device. Some of it happens on a small backend we operate (we call it "the relay"): keeping your credentials so background checks can run, generating Channel Reports and anomaly alerts automatically, and staging content for scheduled publishing. It needs to keep working even while the app itself is closed, which is why it lives on a server rather than only on your device. We never sell your data, never use it for advertising, and don't run any third-party analytics or tracking SDK inside the app.

What the app accesses, and why

None of these scopes grant access to private messages, other users' data, payment information, or the ability to read or modify your account settings. The publishing scopes let Gecko post on your instruction. They never let Gecko delete, edit, or read content you didn't create through the app, and Gecko never publishes automatically without you reviewing and confirming what's being scheduled first.

Gecko's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data is stored

Gecko has two places data can live, and which one depends on what you're using:

• Locally, on your device. Your settings, your local cache of connected-account data, and anything you haven't opted into the automated/background features stays only in your own device's application-data folder. Your account credentials are encrypted at rest locally too, not stored as plain text, using a separate encryption key from the server-side one described below.
• On our servers (the relay), for features that need to keep working while the app is closed. Specifically: your account credentials (encrypted at rest, see below), your Channel Reports and content-anomaly history, competitor-tracking data, cadence/hashtag insights, and anything you schedule for future publishing (the media file itself, temporarily, plus its caption and timing). Generating a weekly Channel Report or firing off a scheduled post can't depend on your local device being open at that exact moment, so this data has to live somewhere that stays running.

Credential encryption. Access tokens and any platform-app secrets we store server-side are encrypted at rest using AES-GCM, with the encryption key held separately from the database itself.

Nothing is shared with third parties, and there are no advertising or analytics/tracking SDKs embedded in the app.

Data security

All traffic between the app and our servers is encrypted in transit (TLS). Server-side and local credentials are encrypted at rest as described above. Our database provider (Cloudflare) keeps hourly backups for 24 hours and offers point-in-time recovery for up to 30 days, for disaster-recovery purposes only; we don't use this to work around a deletion request, but it means data can theoretically be recoverable by us for up to 30 days after deletion, for that limited purpose. If we become aware of a data breach affecting your personal data, we'll notify the ICO where required by law and, where there's a real risk to you, notify you directly without undue delay.

Reporting a security issue. If you believe you've found a security vulnerability in Gecko or our backend, email support@horrac.com with details. Give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly, and we won't pursue legal action against good-faith, non-destructive security research reported this way.

Automated background checks (Channel Report, Content Anomaly, Cadence Insight)

For platforms where this is enabled, Gecko periodically checks your connected account's public performance data on our servers, even while the app is closed, to keep your Channel Report current and flag unusual video/post performance. This uses the same read-only data described in the table above. It never posts, comments, or changes anything on your account. You can see exactly when a report last ran, and you can delete a platform's stored report data at any time (see Data Deletion below).

AI features (Channel Report, Suggestions Chat, Pre-Publish Critique, the Prediction Model, Media Kit, Recurring Patterns)

These features send the relevant content, meaning your account's public content/performance data described above, and (for video-based features) a small, representative sample of your own videos, to Google's Gemini API or Anthropic's Claude API through our relay, using a credential we own, never one you provide. Specifically:

• YouTube and Instagram: a small sample of your videos (never your entire library) may be sent for AI analysis. YouTube videos are referenced by link; Instagram videos are downloaded from Instagram's own servers and uploaded to Google's Gemini Files API through our relay, where Google retains them for at most 48 hours before automatic deletion. Content sent to Anthropic's Claude API is retained for up to 30 days under our commercial agreement with them, and is not used to train Anthropic's models.
• TikTok and Twitch: neither platform offers a lawful way for a third-party app to download video, so only text metadata (titles, dates, view/like counts) is sent. No video or audio ever leaves your device for these two platforms.
• Clip detection (part of Pre-Publish Critique) additionally sends audio extracted from a video you're drafting to Groq, a hosted transcription provider, for speech-to-text conversion, so the app can identify strong candidate clips using your own words, not just visuals. Groq doesn't use this audio to train its own models, on any tier, and doesn't otherwise retain it beyond a short troubleshooting/abuse-prevention window.

Every call to Google's Gemini API or Anthropic's Claude API uses a paid, billing-enabled key on our side, never a free one. Both providers' paid tiers contractually exclude submitted content from being used to train their models, which a free tier would not guarantee. AI-generated output (reports, critiques, predictions, suggestions) is not reviewed by a human before being shown to you, and should be treated as a starting point, not a guarantee. See the Terms of Service for more on this.

Trend and topic search. For Instagram and TikTok, some features (Suggestions Chat, the Prediction Model) ground their answers in a search of current trends or events on the open web. This normally goes through Google's own search-grounding tool as part of a Gemini call. On the rare occasion our daily grounding budget for that is exhausted, we fall back to Parallel.ai's Search API instead, sending only a short search topic or query, never your personal account or content data.

Scheduled publishing

If you use Gecko's scheduling feature, the media file you select (and a custom thumbnail, if you set one), its caption or title, and its scheduled time are uploaded to our servers so the post can go out at the right time even if the app is closed. Once a scheduled post is published (or you cancel it), that staged media and thumbnail are deleted from our servers. Nothing is published without you first reviewing it and confirming the schedule.

Our legal basis for processing your data

Under UK GDPR Article 6, we process your data on these bases:

• Performance of a contract (Art. 6(1)(b)), for the core functionality you've asked us to provide: connecting your accounts, showing your analytics, generating reports, and publishing content you've scheduled.
• Legitimate interests (Art. 6(1)(f)), for automated background checks (Channel Report refreshes, content-anomaly detection) that run on our servers even while the app is closed. Our interest is delivering the always-current monitoring the app promises. We've weighed this against your right to control it: you can disable it or delete a platform's stored data at any time (see Data Deletion).
• We don't rely on consent as a basis for the processing described above, so there's no separate consent to "withdraw." Disconnecting an account (see Data Deletion) does the equivalent job: it stops us processing that platform's data going forward.

International data transfers

Gecko's backend runs on Cloudflare's infrastructure, and AI processing runs on Google's and Anthropic's infrastructure. All three have data-processing operations outside the UK/EEA, so using them involves an international transfer of personal data. The safeguard differs slightly by provider:

• Cloudflare is certified under the UK Extension to the EU-U.S. Data Privacy Framework, a transfer mechanism the UK government has formally recognized as providing adequate protection.
• Google and Anthropic: our data-processing agreements with both incorporate the ICO's International Data Transfer Agreement (IDTA) (or the UK Addendum to the EU's Standard Contractual Clauses, where applicable), the UK's standard contractual safeguard for transfers to a country without its own adequacy decision.

The ICO has indicated both UK transfer mechanisms may be updated during 2026. We'll keep this section current as that happens. If you have questions about a specific transfer, contact us at the address below.

Your rights

Under UK GDPR Articles 15 to 22, if you're in the UK or EEA you have the right to:

• Access the personal data we hold about you, and rectify it if it's inaccurate.
• Request erasure ("the right to be forgotten"). See Data Deletion below for the practical mechanism.
• Restrict or object to certain processing, including the legitimate-interests-based background checks described above.
• Receive a copy of your data in a portable, machine-readable format.
• Rights relating to automated decision-making. These don't apply here: every AI-generated output (a report, a critique, a prediction) is a suggestion you review and choose whether to act on. Gecko never makes a decision about you, or automatically takes an action with legal or similarly significant effect, without your own review and confirmation first.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data. We'd appreciate the chance to address it directly first, at the contact below.

These are your statutory rights under UK GDPR if you're in the UK or EEA. If you're elsewhere, we'll still honor equivalent access, correction, and deletion requests as a matter of practice. See Data Deletion below.

Data deletion

See our Data Deletion page for how to disconnect an account, delete server-side report/schedule data, or request full account erasure.

Children's privacy

Gecko's Terms of Service require you to be at least 18, or the age of majority in your jurisdiction, to use it. Gecko is not directed at children, and we do not knowingly collect data from anyone under that age.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above. Material changes will be noted in the app's release notes.

Contact

Questions about this policy: support@horrac.com