Privacy Policy

Last updated 18 October 2026

Abondy runs two sites: abondy.com for brands and abondy.app for posters. This page covers both.

This policy explains what Abondy collects when you use abondy.com or abondy.app (the “Service”), why, who sees it, how long we keep it, and what you can do about it. It covers everyone who uses the Service: Posters, Brands and Editors. By using the Service you agree to this policy and to our Terms of Service.

1. What we collect

Account details. Your name and email address, and a hashed password if you sign up with email. If you sign in with Google or Discord, your account id, name, email address and profile picture from that service.
About you. Your age and country, asked once when you join, so we can match you with the right videos and keep the Service to people aged 13 and over.
Connected accounts. The usernames of the social media accounts you connect and their public profile figures: follower count, number of posts and account age. If you connect an account by signing in with that platform, we also keep the platform’s id for it. We never see your social media passwords.
Posts. The links you submit, when you submitted them, and the public performance of each post (views, likes, comments, shares), checked over time, including whether the post is still public.
Rewards and strikes. The rewards you earn and claim, the Roblox username you give us to receive them, and any breaches of the posting rules recorded against your account.
Messages. Notices in your in-app mailbox, and anything you write in the community chat, which other users can see.
Brands and Editors. Company name, website, contact email, logo, campaign settings, payment records and uploaded videos; for Editors, a Discord username and the details given at sign-up.
Credits and payments (Brands). Your credit history (every credit added, spent, returned or expired), your orders, your plan and when it renews, your auto top-up settings, and the videos you upload with how each one performs. Card details are entered on Stripe’s pages and processed by Stripe: we never see or store your card number. We keep only what Stripe tells us back, such as the card’s brand and last four digits, and its ids for your payments and receipts.
Technical. Standard server logs (IP address, browser, pages requested, times), kept for security and debugging.

2. YouTube and Google

Abondy uses YouTube API Services. This section explains exactly what we do with them. Google’s own handling of your data is described in the Google Privacy Policy.

Public data. When you connect a YouTube channel or submit a YouTube link, we use the YouTube Data API to read public information: that the channel exists, its handle, subscriber and video counts, and for each video you posted, its publish date and its view, like and comment counts. We use this only to confirm your posts, show you and the Brand how they are doing, enforce the posting rules and work out your rewards.
Signing in with Google to connect YouTube. If you choose this, we ask for read-only access to your YouTube account and use it for one thing: reading your channel’s id, name and handle to confirm the channel is yours. We don’t read your videos, subscribers, comments, playlists or watch history through it, and we don’t keep the access token afterwards.
Auto-posting (optional). If you turn it on, we also ask for permission to upload to your channel and keep the token Google gives us, encrypted, while auto-posting is on. We use it only to upload the video we handed you, with the caption shown to you, when you tap “post”. We never upload anything you didn’t tap, and never change or delete anything on your channel. Turning auto-posting off or disconnecting the channel deletes the token immediately.
Who sees it. The Brand whose campaign a post belongs to sees that post’s link, channel handle and performance. Nothing else from YouTube or Google is shown or given to anyone, and we never sell it or use it for advertising.
How long we keep it. We refresh YouTube figures while a post or channel is being tracked. Any YouTube figure we haven’t refreshed within 30 days is deleted, so our view history for a YouTube post never reaches back more than 30 days.
Revoking and deleting. You can disconnect YouTube from your Accounts page at any time, and you can revoke Abondy’s access to your Google account at any time on Google’s security settings page. When you revoke access, delete your account, or ask us by email, we delete the YouTube data we hold about you within 7 days. Deleting data from Abondy does not delete anything on YouTube itself; to delete videos or other data from YouTube, use YouTube.
Google API Services User Data Policy. Abondy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Why we use it

To run the Service: hand out videos, check posts, issue rewards, and enforce the posting rules.
To confirm a connected account is yours, and to set posting limits that fit its history.
To show Brands how their campaigns are doing, keep their credit balance, and charge them for plans, credits and auto top-up they choose.
To keep the Service secure, stop fraud and abuse, and comply with the law.
To email you about your account, such as sign-in links and password resets.
To improve the Service, using aggregated or de-identified data where we can.

We don’t sell your personal data and we don’t use it for third-party advertising.

4. Who we share it with

Brands see the link, platform, handle and performance of posts made for their campaigns.
Stashly, our reward partner, receives a reference for each reward and the Roblox username you give us, so the prize can be delivered. It handles that data under its own privacy policy.
Providers that run the Service for us, only as far as their job needs and only on our instructions: Vercel and Railway (hosting, alongside servers we run ourselves), Supabase (database), Cloudflare (video storage), Resend (email), Stripe (payments), and Google and Discord when you sign in with them.
Discord. If you sign in with Discord and break the posting rules, strikes may show as roles in our Discord server.
Social platforms. To check a post, we read public information from the platform it is on. We don’t send them your personal data.
The law. When the law requires it, or to protect the Service, its users or others.

5. Cookies

We use one essential cookie to keep you signed in, plus short-lived cookies during a sign-in with Google, Discord or a social platform, and your browser’s local storage for small preferences. We use no advertising or tracking cookies, so there is no banner to accept.

6. How long we keep it

For as long as you have an account, except YouTube data, which follows the 30-day rule in section 2. Server logs are kept for a short period by our hosting providers. When you delete your account (Accounts → Delete my account), your account, connected accounts, posts, rewards, strikes, mailbox and any Google tokens are deleted immediately. Records we must keep by law, such as payment records, are kept for as long as the law requires. When a Brand deletes its account, its login, logo and settings go; if posters have posted for it or it has paid us, we keep the company name, its campaigns, posts, orders, credit history and payment records (posters were rewarded on those posts, and payment records must be kept), and the account is closed so no one can sign in to it.

If an account had strikes, we keep its strike count with one-way fingerprints (irreversible hashes) of its email, Roblox, Discord and Google accounts, so that deleting an account can’t be used to get around a ban. The fingerprints can’t be turned back into those details; they can only tell us that a new account matches a struck one.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to complain to a data protection authority. You can see and change most of your data in the Service and delete all of it from your Accounts page. For anything else, email support@abondy.com. We reply within 30 days, and carry out deletion requests within 7 days.

8. Children

The Service is for people aged 13 and over. If someone tells us they are under 13 when joining, we delete the account and everything in it straight away. If you believe a child under 13 has an account, email support@abondy.com and we will delete it.

9. Where data is stored

Your data is stored in the United States. If you use the Service from elsewhere, your data is transferred there and protected by our providers’ contractual safeguards.

10. Security

Passwords are hashed, stored tokens are encrypted, connections are encrypted, and access to the database and storage is restricted. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

11. Changes and contact

We may update this policy. The date at the top shows the latest version, and we announce material changes in the Service before they apply. If we start using YouTube or Google data in a new way, we’ll ask you to agree again first. Questions, requests or complaints about how we handle your data: support@abondy.com.