Privacy Policy

Account information. Your email address and password (stored as a secure hash) when you create an account.

Business profile. What you tell us about your business: your name, business name, industry, how you want to sound, topics you care about, and rules you set for your content.

Content you provide. Example posts and images you upload as inspiration, edits you make to drafts, and feedback you give (approving, rejecting, or tweaking posts).

Connected social accounts. If you connect a social account (such as Facebook, Instagram, LinkedIn, or Pinterest), we access the information you authorize — such as your public profile, your posts, and permission to publish on your behalf — solely to provide the service. We never post without an action you took in the app, and we never access private messages.

Usage information. Basic technical logs (such as requests to our servers) used to operate and secure the service, and analytics about how our website is used — see “Cookies, analytics, and advertising” below.

Connected advertising accounts. If you connect an advertising account (such as Google Ads, Meta, LinkedIn, TikTok, Microsoft Advertising, or Pinterest), we access what you authorize — your ad accounts, campaigns, and their performance figures — to create and manage campaigns you approve. We do not have access to the payment method you hold with those platforms.

Connected websites and code. If you connect a WordPress site, we store its address, the username you give us, and an application password, encrypted. If you connect GitHub, we store only the identifier of the installation you created — never a lasting key to your code. In both cases we use this solely to draft changes you approve.

We use your information for one purpose: running the marketing you asked us to run. That includes researching topics relevant to your industry, writing and designing draft posts in your voice, creating and managing advertising campaigns within the budgets you set, drafting changes to a website you connect, learning from your edits and approvals, and — when you connect an account and choose to publish — publishing what you approved.

We use trusted service providers to do this, and we would rather name them: Supabase (database, sign-in and file storage) and Vercel (hosting) run the service; Anthropic and OpenAI generate text from your profile and instructions; fal.ai renders images and video; Stripe takes payment; Resend delivers email; SerpAPI fetches public search results and articles. Each processes your information only to provide its service to us. Under the terms we use them on, the AI providers do not train their models on what we send them.

When you connect Google Ads or a Google Business Profile, Republic AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to show you your own accounts, campaigns, listings and results, and to make the changes you approve. We do not sell it, use it for advertising, or let a person read it except with your consent, for security, or as the law requires. Disconnecting Google in Settings removes the stored token at once, and you can also revoke access at myaccount.google.com/permissions.

Cookies we need. We use cookies to keep you signed in and to keep the service secure. The service does not work without these.

Analytics. We use Google Analytics and the Meta pixel on our public website to understand how people find and use it — which pages they visit, and whether a visit led to signing up. Google Analytics sets cookies and receives your IP address and device information. You can opt out for every site you visit with Google's browser opt-out add-on.

Advertising measurement. We advertise Republic AI, and we measure whether those advertisements led to a subscription. When a subscription completes, we report that a sale happened, along with its value and an order identifier — to Google, and to Meta both from your browser and from our own server, so the count stays right when a browser blocks the tag.

We send Meta a hashed copy of your email address when you subscribe, so it can tell that the advertisement it showed you led to a sale. It is hashed before it leaves us and the plain address is never sent — but a hash is not anonymous, and we would rather say so: Meta can match it against an account it already holds. Nothing else about you is sent, and never anything about your business, your content, or your own customers. You can control the advertising Google shows you in Google's Ad Settings.

This is about our own marketing, not yours. Analytics and advertising measurement apply to our public website. We never use the content, customer data, or advertising performance inside your account to target advertising, and we never share it with advertising platforms for their own purposes.

Most browsers let you block or delete cookies. Blocking the ones we need will sign you out; blocking analytics cookies does not affect the service at all.

You can see and change your business profile, your rules, and your content at any time in the app. Settings has a Download button that gives you everything a workspace holds as one file, and a Delete account button that removes everything at once. If you would rather we do either, email us and we will.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Depending on where you live, you may have additional rights to access, correct, delete, or port your information, and to object to certain uses. Exercising them will never cost you anything or degrade the service.

We do not sell your personal information — to anyone, ever.

We do not use anything inside your account — your content, your customers, your campaign results — to advertise to you or to anyone else, and we never hand it to an advertising platform for its own purposes. The only advertising we measure is our own, and the only personal detail that reaches one is the hashed email described above, sent once when you subscribe.

We do not post to your social accounts without your authorization, and we do not read private messages on any connected account.

When you connect a social or advertising account, we receive data through that platform's official tools (for example, Meta's Platform and LinkedIn's APIs) under the permissions you grant. We use it only to learn your voice, show you your own content and results, and publish or change what you approved.

When you disconnect. Disconnecting an account in Settings deletes the stored token at once, so we can no longer reach that platform. The record of what was published and the daily performance figures we already collected stay in your account, because your results and history would otherwise read as blank; they are deleted when you delete the brand or the account. You can also revoke our access from the platform's own security settings. If you remove Republic AI from your Facebook settings, or ask Meta to delete your data from us, Meta tells us and we delete the connection and the figures that came through it straight away.

A brand. "Start over" in Settings deletes the brand: its profile, posts, images, chats, automations, connections and results.

Your account. "Delete account" in Settings deletes every brand you own, cancels your subscription, and removes your login, in one step, with no waiting period. Invoices stay with Stripe as a financial record, as the law requires. If you sign in with Facebook and ask Meta to delete your data from us instead, we remove the Meta connection at once and a person completes the account deletion within 30 days; Meta gives you a code to check on it.

If you cannot sign in, email support@republicai.net from your account email and we will complete the deletion within 30 days and confirm when it's done.

We keep your information while your account is active and delete it when you delete your account. A few things live on a clock of their own: database backups are overwritten within seven days, so deleted data leaves them by then; server logs, which hold request details but never your content, are kept for a few days; notification records (which emails we sent you) go with the account. Chat history is part of your account and stays until you delete a conversation, the brand, or the account.

Data is encrypted in transit. Tokens for connected accounts are encrypted at rest with a key the database does not hold. Everything is stored with access controls and reachable only by the systems that need it to serve you.

Republic AI is a business tool and is not directed to anyone under 16. We do not knowingly collect information from children.

If we make material changes, we will update this page and the date above, and for significant changes we will tell you in the app or by email.

Questions about privacy? Email support@republicai.net.