Skip to content
VIRAL SWIPE FILE

Privacy Policy

Last Updated: 23 October 2026

This policy explains what personal data Viral Swipe File collects, why, who we share it with, how long we keep it and the choices you have. It covers viralswipefile.com, our API, our MCP server for AI assistants and the Viral Swipe File plugins.

1. Who we are

Viral Swipe File ("we", "us") runs viralswipefile.com and is the controller of the personal data described here.

Viral Swipe File 30 N Gould Street, Sheridan, WY 82801, United States [email protected]

2. What we collect

2.1 Your account

  • Sign-in details: your email address and, if you sign in with Google, your name, profile photo and Google account id. Sign-in links and codes are sent by email; there is no password.
  • Profile and onboarding answers: what describes you best (for example app marketer or creator), your niche, whether you use AI agents and how you heard about us, if you answer.
  • Team and saved videos: your team's name, its members, its invite link and the videos your team saves to its boards.
  • Billing records: your plan, its status and dates, and the customer and subscription ids our payment provider gives us. We never see or store your card number.

2.2 How you use the site

We use PostHog for product analytics. When you browse the site it records the pages you view and actions such as searches (including the words you search for), filters, sign-up steps and checkout, along with your browser, device, approximate location from your IP address, the page that sent you, campaign (UTM) parameters and, if you arrived from an AI assistant, which one. Once you sign in, these events are linked to your account, with your email, name, team, plan and onboarding answers. Sign-in links, codes, invite links and other tokens are removed from the page addresses we record.

PostHog may also record some visits as session replays: the pages as you saw them, your clicks and scrolling. Everything you type is masked, and the sign-in, consent and team invite pages are never recorded.

2.3 AI assistants and the API

When you connect an AI assistant (such as Claude, ChatGPT or Cursor) to Viral Swipe File, it signs you in with OAuth. We store the assistant's registration (its name and where it returns after sign-in), the access you granted it and its tokens.

Each search, video lookup or API request is counted against your team's allowance; listing niches and formats is free. Every tool call is recorded in PostHog with the tool or endpoint, its arguments (such as a niche, a format or a search term), its timing, any error, your account and the assistant's name. We receive only what the assistant sends in those arguments, not the rest of your conversation.

2.4 Email

  • Account email: our email provider holds your address and account id to send sign-in links, codes and messages about your account.
  • Onboarding emails: after you sign up, our email provider sends you a short series of tips and offers about our plans, over about 12 days. It stops when you start a trial or pay, and every email has an unsubscribe link. For this it holds your plan and its status, your trial end date, your onboarding answers, which AI assistant you connected and whether you joined a team.
  • Newsletter: only if you subscribe, on the newsletter page or during onboarding. Every issue has an unsubscribe link.
  • Support: if you email us, we keep the conversation and anything you send in it.

2.5 Cookies and similar storage

We use these cookies and browser storage, and no advertising cookies:

  • Sign-in session (Better Auth): keeps you signed in. Necessary.
  • vsf_first_touch, vsf_signup_surface, vsf_signup_mode: remember where your first visit came from and which sign-up step you used, so we can count where accounts come from.
  • vsf_visit (a cookie and session storage, gone when you close the browser): the kind of link that brought you this visit (search, social, an AI assistant…), so we can count where sign-ins come from.
  • PostHog (a cookie and local storage named after our project key): an anonymous id that ties your page views together, and your account id once you sign in.
  • Theme: your light or dark mode choice, in local storage.

You can delete or block cookies in your browser. Blocking the session cookie signs you out.

3. Creators in our library

The library is made of public TikTok and Instagram posts. For each post we hold the creator's public account name and profile link, the post's link, caption and opening line (hook), its view and engagement counts, its cover image, its language and posting date, the niche and formats we file it under and an estimated creator gender used as a filter. We collect this from what is publicly visible on those platforms. We do not hold creators' private data or contact details.

We process it under our legitimate interest in running a curated research library for marketers, and link every video to its original post. If you are a creator and want a post or your account removed, or object to this processing, email [email protected] with the links concerned. We remove them within 30 days.

  • Create and run your account and team, sign you in, connect AI assistants and the API, and enforce plan allowances: performance of our contract with you.
  • Process subscriptions and keep billing records: our contract with you, and legal obligations (tax and accounting).
  • Send sign-in emails and messages about your account: our contract with you.
  • Send onboarding tips and offers about our plans: our legitimate interests in helping you get value from the product. You can opt out at any time with the link in each email.
  • Understand how the product is used and improve it: our legitimate interests.
  • Prevent abuse, fraud and attacks, and keep the service secure: our legitimate interests.
  • Send the newsletter: your consent, which you can withdraw at any time.
  • Answer support requests: our contract with you and our legitimate interests.

We do not sell your personal data, share it for cross-context behavioural advertising or use it to train AI models.

5. Who we share it with

We share personal data only with the service providers below, so they can run parts of the service for us, and when the law requires it.

Our servers and database are hosted by Hetzner in Nuremberg, Germany.

  • Hetzner: hosts our servers and database.
  • Cloudflare: delivers and protects the website.
  • Amazon Web Services: stores video cover images.
  • PostHog: product analytics, in the United States.
  • Creem: our merchant of record, for checkout, payments, invoices and sales tax. Creem handles your card and billing address under its own privacy policy.
  • Send & Retain: sign-in, account and onboarding emails, and the contact details in section 2.4.
  • Beehiiv: the newsletter, if you subscribe.
  • Google: sign-in, if you choose Google.

AI assistants you connect receive the results of the tools they call. What they do with them is governed by their own terms and privacy policies, not this one.

6. International transfers

Some providers process data outside your country, including in the United States. Where data protection law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

7. How long we keep it

  • Account, team and saved videos: until you delete your account (see section 8).
  • Analytics events: for as long as PostHog keeps them under our plan, and deleted with your PostHog record when you delete your account.
  • Billing records: Creem keeps them for as long as tax and accounting law requires.
  • Support emails: up to 6 months after your account is deleted.
  • Newsletter: until you unsubscribe.
  • Onboarding emails and contact details: until you unsubscribe or delete your account.
  • Backups: copies in database backups are overwritten on their normal cycle.

8. Deleting your account

You can delete your account on the Team page. It deletes at once your account, your sign-in methods and sessions, every AI assistant connection, the team you own, its saved videos and its usage counts. If your team has other members you need to remove them first, and if it has a paid plan you need to cancel it and let it end first, so you are not billed for a team that no longer exists. If you belong to someone else's team, you leave it.

Within 30 days we also remove your record from PostHog and our email provider. Creem keeps the billing records the law requires.

9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format and withdraw consent you gave. California residents may also ask what we collect and how we use it; we do not sell or share personal data as California law defines it.

To use any of these rights, email [email protected] from the address on your account. We answer within 30 days. You can also complain to your local data protection authority.

10. Children

Viral Swipe File is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

11. Security

We use encrypted connections, access controls and providers with strong security practices. No system is perfectly secure, so we cannot guarantee that data will never be accessed without permission. If a breach affects your data, we will tell you and the authorities as the law requires.

12. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we tell signed-in users by email or on the site before it takes effect.

13. Contact

Questions or requests about your data: [email protected], or Viral Swipe File, 30 N Gould Street, Sheridan, WY 82801, United States.