Your information

Privacy Policy

Effective October 12, 2026 · Last updated October 28, 2026

Splice, operated by SailSync LLC (“we,” “us”), helps creators and teams plan social content, organize media, compare creative directions and prepare publishing workflows at splice.ink. This policy explains our handling of information when you visit the website, use a workspace, or connect an Instagram, Facebook or TikTok account.

Contact SailSync LLC at jeff@sailsync.ai for support, privacy questions, or data requests. Please do not send passwords, access tokens, or sensitive identity documents in your initial message.

1. Information we process

Splice account and workspace information: your name, email address, password hash, studio memberships, account roles, preferences, and sign-in activity. We do not store your Splice password as plaintext.
Content you provide: uploaded photos and other media, embedded file metadata where present (which may include camera, date, or location information), captions, drafts, crops, story plans, reference screenshots, notes, schedules, approvals, and publishing records.
Authorized Instagram and Facebook data: account and app-scoped identifiers, handles, names, profile pictures, profile metadata and counts returned by the API; media identifiers, images or covers, captions, timestamps, media types, permalinks, and available public engagement counts. A Facebook connection may also provide the Pages you manage, Page identifiers, linked professional Instagram accounts, Page tasks, and permission information.
Authorized TikTok data: app-scoped account identifiers, display name, username and avatar URL when returned by TikTok; granted permissions and token expiry; and current creator settings, including available visibility choices, interaction restrictions and video duration limits. We store TikTok draft settings, source references, review and consent records, upload tracking IDs, status results and returned post identifiers for the actions you request. The current TikTok integration does not read your messages, inbox conversations, followers list or browsing history.
Connection information: access and refresh tokens, granted permissions, expiry dates, connection status, and sync or publication results. Tokens are encrypted in our application database. Authorization happens with Meta or TikTok; Splice does not collect your Instagram, Facebook or TikTok password.
Technical and support information: necessary session cookies, IP addresses and request/browser information in operational logs, errors, and messages you send us. The current site does not include advertising pixels or third-party behavioral analytics.

We only receive Meta data that the relevant API, account eligibility, and granted permissions make available. This is not access to every Instagram account or its private content. The current integration does not read direct messages, contact lists, or private inbox conversations.

For connected Instagram accounts, we periodically save follower totals and available performance metrics, such as daily views and reach and post views, likes, comments, saves and shares. Timestamped observations let your workspace compare performance over time and across its own accounts. Detailed Insights require the additional permission granted through Meta. Missing or unavailable metrics are not treated as zero. These observations are included in our Meta data deletion process.

2. How and why we use information

We use this information to authenticate users; enforce workspace permissions; store and organize content; render visual previews; import a connected account’s profile picture and recent published feed covers; compare reference snapshots; manage schedules and publishing handoffs; carry out explicitly approved, supported publishing actions when enabled; and provide support, security, troubleshooting, and deletion handling.

When an authorized Facebook connection supports it, we can retrieve eligible public professional-account information for reference comparisons and supported collaboration media. These captures are stored as workspace reference material, not a public directory. API data is not used to build unrelated profiles of people.

Connecting or syncing an account does not approve publication. Publishing requires the relevant permissions and a separate approved workflow. We do not use Instagram or Facebook API data to train general-purpose AI models, sell it, or use it for advertising targeting.

For TikTok, we use authorized profile and creator information to identify the exact destination, show the available settings and validate a reviewed video. We transmit the selected video only after an authorized owner confirms the action. Inbox delivery sends the video for you to finish in TikTok; it does not transfer the saved caption or cover. Enabled Direct Post sends the reviewed caption, cover time, visibility, interactions and disclosure choices with the video. Public Direct Post and TikTok scheduling are not currently enabled. We do not use TikTok API data to train general-purpose AI models, sell it or use it for advertising targeting.

Where applicable data-protection law requires a legal basis, we process information to provide the service you request, for legitimate interests such as security and reliability, to meet legal obligations, or with your consent where required. You can withdraw a connection’s authorization without changing the lawfulness of earlier processing.

Authorized workspace members: content and connected-account information are available according to the workspace’s access controls. Consider who belongs to your studio before adding content.
Infrastructure providers: we use Amazon Web Services for hosting, databases, private media storage, and secrets management. Providers process information as needed to operate the service.
Meta: connecting, reading account data, or publishing sends the requests and information needed for that action to Instagram/Facebook. Approved publishing may make selected content public under your Instagram settings. Meta’s own terms and privacy policies govern its services.
TikTok: connecting and checking creator settings sends the requests needed for those features to TikTok. When you authorize delivery, TikTok receives the selected video and, for Direct Post, the reviewed caption and posting settings. TikTok downloads the exact video through a temporary, scoped media link. TikTok’s own terms and privacy policy govern content and information it receives. An inbox notification is a handoff, not proof of publication.
Legal and security recipients: information may be disclosed when required by law or reasonably necessary to protect rights, investigate abuse, or secure the service, subject to applicable law. Any disclosure of Meta Platform Data is additionally limited to circumstances permitted by Meta’s Platform Terms.

We do not sell or rent personal information or share it for cross-context behavioral advertising. We do not give other customers access to your private workspace merely because they use Splice.

4. Storage, retention, and security

Our current infrastructure is hosted in the United States. Using the service may involve processing outside your location. We use HTTPS, access controls, private storage, and encryption for stored authorization tokens. No service can guarantee absolute security.

We retain account information and workspace content while needed to provide the requested service, unless you request deletion or a shorter period applies. Meta connection tokens are removed on disconnect or deauthorization. Disconnecting a TikTok destination in Splice removes its saved tokens. Permission revoked in TikTok can prevent future access; Splice may learn of that revocation during a later API request. Disconnecting alone does not delete previously imported media or workspace content; use the deletion process below for that.

TikTok media-delivery links expire after 75 minutes and are limited to one approved source. Account disconnects, changed ownership bindings and completed delivery can prevent new downloads; a transfer already in progress may finish. Expiry of a delivery link does not delete the original video, saved drafts or publishing records. Those remain subject to the workspace retention and deletion process.

Deletion from active application storage and removal from backup or versioned storage are separate steps. Restricted backup copies and prior storage versions can remain after active copies are deleted; removal of these copies requires backup expiry or administrative cleanup. We do not use those retained copies for ordinary product features. Limited records may be retained where legally required or necessary for security and resolving disputes. Contact us for the scope and status of a particular deletion request.

We retain only the information reasonably needed for these purposes and reassess retention when information is no longer needed. Temporary publishing packages normally expire after seven days; this does not automatically delete original uploads or saved imports.

5. Your choices, rights, and data deletion

You can disconnect a managed account in Splice’s Compare workspace or revoke the app’s access through your Instagram/Facebook settings. To request deletion of imported Meta data, your Splice account, or other workspace information, follow our data deletion instructions. Requests can be made without signing in and without a fee.

For TikTok, use the TikTok connections page in Splice to disconnect, or revoke Splice’s authorization in TikTok’s account settings. Request deletion of saved TikTok connection information, drafts, consent or delivery records through the same deletion contact. Deleting a local draft or disconnecting Splice cannot recall a video already transferred to TikTok or delete a TikTok post; manage those copies in TikTok.

Meta can also send a signed data-deletion request to our configured callback. It starts removal of the associated connection and API-derived imports/reference snapshots from active storage and returns a confirmation code and status URL. A completed callback status refers to that application cleanup; contact us about backup/versioned copies or broader account deletion.

Depending on your location and applicable law, you may request access, correction, deletion, a copy of your information, restriction of processing, or object to certain processing. You may also have a right to complain to your local data-protection authority. We may need proportionate information to verify authority over the account and protect other workspace members. We respond without undue delay and within applicable legal deadlines, and explain any lawful limitation on a request.

6. Cookies and children

Splice uses necessary first-party cookies for secure sessions and sign-in protection. Blocking them may prevent workspace login. The public information pages can be read without an account. Splice is intended for adults managing professional content, not for children under 18. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.

7. Updates and contact

We may update this policy as the service or our practices change. We will change the date above and provide additional notice for material changes where required. New uses of connected-platform data must be consistent with your authorization and applicable platform requirements.