Privacy Policy
Last updated: 13 October 2026
Draft: to be reviewed by a qualified professional. Not legal advice.
This policy explains what autosub collects, why, who processes it for us, how long we keep it and what your rights are. It covers this website and the autosub service.
1. Who we are
autosub is operated by Klip, based in Kenya (“we”, “us”). We decide how and why your personal data is used, which makes us its data controller. For anything about your data, write to privacy@autosub.im.
autosub was called klipn until October 2026. If you joined the waitlist or signed in under that name, it is the same service, run by the same operator, and this policy covers the data you gave it.
autosub is in development and not open to the public yet. This policy describes how autosub handles data once each feature is in use. If that changes, we'll update this page first.
2. In short
- autosub reads your posts. It never posts, edits or deletes anything on your accounts.
- We collect what autosub needs to find your new posts, submit them to your Content Rewards campaigns and alert you.
- We don't sell your data, don't show ads and don't use analytics or advertising trackers.
- Access tokens and keys are encrypted, and our database is not reachable from the internet.
- You can delete your data at any time: see Data Deletion.
3. What we collect and why
| Data | Why we use it |
|---|---|
| Waitlist: your email address, which form you used, that you consented, and when you signed up and confirmed | To confirm your address and tell you when autosub opens |
| Your account: your name, email address, Whop user ID and profile picture link from Whop sign-in, or your email address if you sign in with an email link | To sign you in and run your account |
| Whop access: the access and refresh tokens Whop gives autosub when you sign in with Whop (stored encrypted) | To call Whop on your behalf where autosub needs to, such as checking your submissions |
| Your Whop session for submitting: a signed-in Whop session (its cookies), kept in a private browser profile on our server | So autosub can submit your post links to Content Rewards for you. It never leaves our server and is never included in backups |
| Connected social accounts: for TikTok and Instagram, your account ID, username, display name and access tokens (stored encrypted) with their expiry dates; for YouTube, your channel ID only | To find your new posts |
| Posts and submissions: the links, IDs and times of your posts (posted, found, submitted, confirmed), the campaign each went to, the result, error messages, and a screenshot of each confirmation page | To submit your posts, prove it, and show you the history. We don't download your videos |
| Your settings: Content Rewards campaign links, which accounts are approved for each, your posting times and time zone, and your alert preferences | To submit the right post to the right campaign at the right time |
| Alert channels: your WhatsApp number and when you opted in (only if you connect WhatsApp), your Pushover user key (stored encrypted, only if you connect Pushover), and the alerts we sent you with their delivery status | To send you receipts, warnings, reports and wake-up alarms |
| Technical data: the IP address and browser details stored with your sign-in sessions, IP-based rate-limit counters, server logs (pages requested, errors, IP addresses) and error reports | To keep autosub secure, stop abuse and fix problems |
| Messages you send us: your email address and what you write | To answer you |
Legal bases. We use your waitlist email because you consented, and you can withdraw that consent at any time. We use account, connection, post and alert data because you asked us to provide the autosub service (our contract with you). We use technical data because we have a legitimate interest in keeping autosub secure and working. If you don't give us the data a feature needs, that feature can't work, but nothing else is affected.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. autosub's automatic submissions follow the settings you choose, and you can turn them off.
4. AI in the submission step
To submit a post, autosub drives a browser on Content Rewards' submit page. When it needs to find a step on that page for the first time, or the page has changed, it sends the page's content to Anthropic's Claude model to work out what to click. That content can include your Whop or Content Rewards account name, campaign details and your post's link. autosub never sends your passwords or tokens. Under Anthropic's terms, data sent through its commercial API is not used to train its models by default.
5. Cookies
- The public pages of this website set no cookies and store nothing in your browser.
- When you sign in, autosub sets cookies that keep you signed in and protect the sign-in process. They are strictly necessary for the service you asked for, so they don't need your consent, and we don't show a cookie banner.
- We use no analytics, advertising or tracking cookies, and load no third-party scripts.
6. Who processes your data for us
These companies process data on our behalf, only for the purposes below. We choose providers with strong security and use them under their data processing terms.
Scroll the table sideways to see every column.
| Company | What they do for autosub | Data they receive | Where |
|---|---|---|---|
| OVHcloud | Hosts autosub's server and database | All the data above | Canada |
| Cloudflare, Inc. | Runs autosub's domain name (DNS), stores database backups, forwards email sent to our addresses, and checks from outside that the website is up | Backups of the database (encrypted at rest; the access and refresh tokens inside are also encrypted by autosub) and the emails you send us. The website check involves no personal data | United States and Cloudflare's global network |
| Zoho Corporation (ZeptoMail) | Sends autosub's emails: sign-in links, waitlist confirmations, account notices | Your email address and the email's content | United States |
| Google LLC (Gmail) | Our inbox for the emails you send to our addresses | Your email address and what you write | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, when it is switched on | Technical details of errors. It is set up not to collect your name, email, cookies or what you type | United States |
| Anthropic, PBC | AI model for the submission step (section 4) | The content of Content Rewards pages during a submission | United States |
| Web Scraping Guy LLC (ScrapeCreators) | Backup source for finding your new posts when an official API is slow | Your public account handles and your public posts | United States |
| Pushover (Superblock, LLC) | Delivers wake-up alarms to your phone | Your Pushover user key and the alarm's text (post link, deadline) | United States |
| Meta Platforms (WhatsApp Business Platform) | Delivers WhatsApp receipts, warnings and reports | Your WhatsApp number, the messages and screenshots we send you, and the messages you send to autosub's number | United States and other countries where Meta operates |
| Healthchecks.io (SIA Monkey See Monkey Do) | Confirms that autosub's background worker and website are running | No personal data about you | European Union (Latvia) |
Services you connect. Whop, TikTok, Instagram and YouTube are not our processors: they share data with autosub because you allow it, and their own privacy policies apply. Content Rewards receives the post links autosub submits for you, just as it would if you submitted them yourself.
YouTube. autosub uses YouTube API Services. By adding a YouTube channel to autosub, you agree to the YouTube Terms of Service. Google's use of data is described in the Google Privacy Policy. autosub reads only public information about your channel's videos, with its own API key; it never asks for access to your Google account.
We don't sell or rent your data, and we share it with no one else unless the law requires us to.
7. Where your data goes
We are based in Kenya. autosub's server is in Canada, and the companies above may process data in the United States, the European Union and other countries. We only transfer data abroad as Kenya's Data Protection Act 2019 allows, with appropriate safeguards for its security, and where it is needed to provide the service you asked for.
8. How long we keep it
| Data | Kept |
|---|---|
| Unconfirmed waitlist sign-ups | 30 days after the last confirmation email we sent, then deleted automatically |
| Confirmed waitlist sign-ups | Until 12 months after autosub opens, or until you leave the list |
| Your account and settings, connected accounts, tokens and your Whop session | Until you delete them or your account; deleted within 30 days of your request |
| Your campaigns, approvals and posting times, and the log of the changes you make to them | Until you delete them or your account |
| The record that an account's data was deleted (its date and how many rows were removed; nothing that identifies you) | Kept |
| Screenshots of confirmations | 30 days |
| Post, submission and alert history | While your account is active |
| Sign-in sessions and sign-in links | Until you sign out or they expire (sessions after 7 days without use, sign-in links after 10 minutes); expired ones are deleted within two days |
| Rate-limit counters (they include IP addresses) | Up to two days |
| Server logs | Kept until the log files reach a set size; the oldest file is then removed. With little traffic that can take months |
| Error reports (Sentry) | Up to 90 days |
| Database backups | Normally 14 days, so deleted data can remain in a backup that long. The three newest backups are always kept, so if backups stop for a while, a copy can stay longer |
| Emails you send us | Until your request is dealt with, and no longer than 12 months |
9. How we protect it
- Every page and API is served over HTTPS only.
- Access tokens and keys are encrypted at rest (AES-256-GCM or XChaCha20-Poly1305), and autosub never writes them to its logs.
- The database is reachable only on autosub's private network, and the server accepts key-based logins only.
- Sign-in links expire after 10 minutes and work once; waitlist confirmation links are stored only as a hash.
- Rate limits protect the sign-in and waitlist forms, and bot checks the waitlist form.
- Your Whop browser session never leaves our server and is never backed up.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the Office of the Data Protection Commissioner as the law requires.
10. Your rights
Under Kenya's Data Protection Act 2019, you have the right to:
- be informed of how your data is used (this policy);
- access the personal data we hold about you;
- object to our processing of all or part of it;
- have false, misleading, outdated or incomplete data corrected;
- have data deleted that we are no longer allowed to keep, or that is irrelevant or excessive;
- receive your data in a structured, machine-readable format, and have it sent to someone else;
- not be subject to a decision based solely on automated processing that significantly affects you;
- withdraw your consent at any time, for example by leaving the waitlist.
If you are in the European Union or the United Kingdom, the GDPR gives you similar rights, including the right to restrict processing and to complain to your local data protection authority.
To use any of these rights, write to privacy@autosub.im or follow the steps on Data Deletion. We may ask you to confirm that the request comes from you. We answer within 30 days. If you are unhappy with our answer, you can complain to Kenya's Office of the Data Protection Commissioner.
11. Children
autosub is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us personal data, write to us and we will delete it.
12. Changes to this policy
When this policy changes, we update this page and its date. If a change significantly affects people who have an account, we email them before it applies.
13. Contact
Klip, Kenya. Email: privacy@autosub.im. General questions: hello@autosub.im.