Privacy Policy

Legend ("Legend", "we", "us", or "our") operates the website and service at legend.ad, which helps musicians sync performance videos with their songs and publish the resulting clips to their own TikTok, Instagram, and YouTube accounts. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the choices you have.

If you have any questions or requests about your data, contact us at zigg.team@gmail.com.

1. Data we collect

• Account data. When you create an account we collect your email address and password (handled by our authentication provider, Supabase), or your basic Google profile information (name, email address) if you sign in with Google.
• Content you upload. Videos of your performances, audio recordings of your songs, lyrics, and related metadata (titles, captions, edits, schedules). Media files are stored in private Google Cloud Storage buckets and are only accessible via short-lived signed URLs.
• Connected social account data. When you connect a TikTok, YouTube, or Instagram account, we store the platform user or channel ID, your username or handle, the permissions (scopes) you granted, and the OAuth access and refresh tokens needed to publish on your behalf. We never receive or store your social media passwords.
• Publishing data. Records of the posts we publish or schedule for you: captions, privacy settings, publish times, and the URLs or IDs of the resulting posts.
• Technical data. Standard log information such as IP address, browser type, and timestamps, used for security and to operate the service. We use session cookies to keep you signed in. We do not use advertising or cross-site tracking cookies.

2. How we use your data

• To provide the service: matching and syncing your takes to your songs, rendering clips, and publishing or scheduling posts you approve.
• To publish content to the social accounts you connected, only when you schedule or request it.
• To generate suggested titles and captions for your videos.
• To secure the service, prevent abuse, and communicate with you about your account.

We do not sell your personal data, and we do not use your data or content for advertising. We do not use data obtained from connected social platforms for any purpose other than providing and improving the user-facing features described above.

3. Connected social platforms

YouTube

Legend uses YouTube API Services to upload videos to your YouTube channel and to read basic information about your channel (such as its name and ID). By connecting a YouTube account, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

We store the OAuth tokens and channel information Google provides for as long as your YouTube account remains connected, solely to publish the videos you schedule. You can revoke Legend's access to your YouTube data at any time by disconnecting the account inside Legend, or via the Google security settings page. When you disconnect, we delete the stored tokens.

Legend's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok

When you connect TikTok, we access your basic profile information (display name, avatar, open ID) and the permission to publish videos to your account through TikTok's Content Posting API. Posts are published with the privacy level you choose. You can revoke access at any time by disconnecting the account inside Legend, or by removing Legend from your authorized apps in the TikTok app (Settings → Security & permissions → Apps and services). When you disconnect, we delete the stored tokens.

Instagram

When you connect Instagram, we access your professional account ID and username and the permission to publish content to your account through the Instagram API. You can revoke access at any time by disconnecting the account inside Legend, or from your Instagram settings (Accounts Center → Website permissions → Apps and websites). When you disconnect, we delete the stored tokens. You may also request deletion of all data we hold from your Instagram connection by emailing zigg.team@gmail.com.

4. How your data is stored and shared

We share data only with the service providers (processors) we need to run Legend, and only to the extent required:

• Supabase — authentication and database hosting (account data, social account tokens, publishing records).
• Google Cloud Storage — storage of your video and audio files in private buckets.
• OpenAI — processing of video titles and lyrics to generate suggested titles and captions.
• Klap — processing of your videos to generate captions/subtitles.
• Replicate — audio processing (vocal isolation) used for caption alignment.
• Hosting providers (Netlify and Google Cloud Run) — running the application.
• TikTok, Google/YouTube, and Meta/Instagram — we transmit the videos and captions you schedule to the platforms you connected, at your direction.

OAuth tokens are stored in our database and are used exclusively to publish the content you schedule. We may also disclose data if required by law or to protect the rights, safety, or property of Legend or others.

5. Data retention and deletion

• Your account data and content are retained while your account is active.
• Disconnecting a social account deletes the stored OAuth tokens for that platform.
• You can request deletion of your account and all associated data (including uploaded media, social connection data, and publishing records) at any time by emailing zigg.team@gmail.com. We will complete the deletion within 30 days.
• Content already published to your social accounts remains on those platforms under your control; deleting your Legend account does not remove posts from TikTok, YouTube, or Instagram.

6. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete, or export the personal data we hold about you, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email zigg.team@gmail.com. You may also have the right to lodge a complaint with your local data protection authority.

7. Security

We use industry-standard measures to protect your data: encrypted connections (HTTPS), private storage buckets with short-lived signed URLs, and access controls on our database. No method of transmission or storage is completely secure, but we work to protect your data against unauthorized access, alteration, or destruction.

8. Children

Legend is not directed at children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. If the changes are material, we will notify you by email or through the service.

10. Contact

Legend — zigg.team@gmail.com