Effective date: October 26, 2026 · This English version is provided for convenience; if it conflicts with the Korean version, the Korean version prevails.
주식회사 윗유 (witU) ("we", "us") operates Drop Post (the "Service"), a tool that helps creators publish their videos to the YouTube, Instagram, and TikTok accounts they connect. We comply with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what personal information we process, why, and the rights you have.
| Category | Information |
|---|---|
| Email sign-up | Email address, password (stored with one-way encryption), name, creator/channel name and main social account (optional), time you agreed to the terms, marketing consent status |
| Social sign-in | Google: email address, Google account identifier, profile photo URL Kakao: Kakao member number, email address (if you agree to share it) Entered after sign-up: name, creator/channel name and main social account (optional) |
| Account approval and verification | Email verification status, account approval status (for approval, the name, creator name, social account and email above are sent to our administrator by email) |
| Platform connections | Access and refresh tokens for YouTube, Instagram, TikTok (and a Facebook Page, for the paid partnership label), stored encrypted; channel/account names; account identifiers |
| Uploads | Video file, thumbnail image, title, description, hashtags, posting options (privacy setting, ad/AI-content disclosures, etc.), edit settings (trim range, aspect ratio, on-video text), original file name, size, length, resolution, a preview image for your library, scheduled time |
| Posting results | Success or failure per platform and the reason, post identifiers and links, processing time |
| Performance data | View, like, and comment counts for posts published through the Service, read from the connected platforms' APIs at set times up to 30 days after upload |
| Collected automatically | IP address, browser and device information, access times (server logs for security and troubleshooting), a sign-in cookie |
To improve the Service, we may analyze upload times, video length and format, hashtags, posting options, edit settings, and performance data. We use this data only as aggregated statistics across many users, with information that could identify you removed — such as email addresses, account identifiers, channel/account names, and post identifiers or links.
| Information | Retention |
|---|---|
| Account information, upload history, performance data | Until you delete your account (deleted immediately) |
| Platform tokens and performance data obtained from that platform | Deleted immediately when you click "Disconnect". If you revoke YouTube access in Google security settings, deleted as soon as the Service detects it (checked once a day) |
| Video files and thumbnail images | Deleted as soon as posting finishes. Scheduled videos are deleted after they're posted at the scheduled time, or immediately if you cancel the schedule or delete your account |
| Password reset links | 30 minutes after issue (cleaned up after expiry) |
| Database backups | Created daily for disaster recovery and deleted automatically after 7 days (deleted information may remain in backups for up to 7 days) |
We don't sell your personal information or share it with third parties for advertising or marketing. When you connect a platform and ask us to post, we send that platform only what's needed to publish. After that, the platform's own privacy policy applies.
| Recipient | Purpose | Information |
|---|---|---|
| Google LLC (YouTube) Privacy policy | Publishing the videos you request and reading post performance | Video file, thumbnail, title, description, hashtags, posting options |
| Meta Platforms, Inc. (Instagram, Facebook) Privacy policy | ||
| TikTok Privacy policy |
Retention follows each platform's policy, and you can delete your posts directly on each platform.
| Provider | Service |
|---|---|
| Amazon Web Services, Inc. | Server hosting and data storage (Seoul region). Processing TikTok uploads for users whose country is set to United States (US Oregon region) |
| Cloudflare, Inc. | Domain (DNS) management, web traffic delivery and security (e.g., DDoS protection) |
| Resend (resend.com) | Sending service emails such as password reset messages |
To provide the Service, personal information may be transferred outside Korea as follows.
| Recipient (country) | Information | When and how | Purpose and retention |
|---|---|---|---|
| Amazon Web Services, Inc. (US Oregon region) | Video file, title, hashtags, posting options, TikTok access and refresh tokens — only for TikTok uploads by users whose country is set to United States | Sent over an encrypted connection when you ask us to post to TikTok | Uploading to TikTok from our US server / deleted right after the upload (tokens are not stored) |
| Cloudflare, Inc. (United States and countries where Cloudflare data centers are located) | IP address, data exchanged while using the Service | Transmitted over the network when you access the Service | Traffic delivery and security / until delivered (per Cloudflare's policy) |
| Resend (United States) | Email address, email content | Transmitted over the network when a service email is sent | Sending email / delivery records per Resend's policy |
| Google LLC, Meta Platforms, Inc., TikTok (countries where their data centers are located) | Information in Section 5 | Sent through each platform's API when you ask us to post | Publishing videos / per each platform's policy |
You can refuse these transfers by deleting your account or disconnecting a platform. Transfers through Cloudflare are required to access the Service, so refusing them means you can't use the Service; refusing transfers through Resend means you won't receive password reset emails.
When the retention period ends or the purpose is fulfilled, we delete personal information without delay. Electronic files are deleted so they can't be recovered, and database backups are deleted automatically on a 7-day cycle.
You can ask to access, correct, or delete your personal information, ask us to stop processing it, or withdraw consent at any time.
You may also exercise these rights through a legal representative or an authorized agent; we may ask for proof of authorization.
If you delete your account in Settings, your sign-in information, platform tokens, upload history, performance data, and any video files still on our server are deleted immediately. If you can't delete your account in the Service, or you're requesting deletion through a platform such as Meta (Instagram, Facebook) or TikTok, email us and we'll delete your data within 7 business days.
Email: [email protected]
We use a cookie to keep you signed in. You can block cookies in your browser, but features that require sign-in won't work. Display preferences such as language and library sort/view are stored only in your browser and aren't sent to our servers. We don't use advertising cookies or third-party tracking tools.
The Service doesn't allow children under 14 to sign up. If we learn that we've collected personal information from a child under 14, we'll delete it immediately.
| Role | Details |
|---|---|
| Privacy officer | 정윤중 (Yun Joong Jeong) / Senior Manager |
| Contact | [email protected] |
For advice or dispute resolution about a privacy issue, you can contact the following Korean agencies.
We'll announce changes in the Service at least 7 days before they take effect, or at least 30 days before for changes that materially affect your rights. Previous privacy policies: effective October 14, 2026, effective October 13, 2026, effective August 21, 2026 (Korean)