Privacy Policy

Updated November 13, 2026. This policy covers Wraith Reach's website and companion apps, operated by Wraith Reach LLC. Contact mishochu@wraithreach.com with privacy questions or account-deletion requests.

Public marketing pages use Nokware’s self-hosted analytics to measure page visits, referring platforms, campaigns and email signup actions. A short-lived, opaque visit identifier is kept in browser session storage. Email addresses, account data and signed-in activity are not sent to this visitor analytics service. We honor Do Not Track and Global Privacy Control. Email subscriptions require separate confirmation.

Wraith Reach Creator Insights is a creator analytics and optional publishing service operated by Wraith Reach LLC. Public-signal audits use the information a member provides and permitted public research; they do not represent private Instagram or YouTube Analytics insights. Public YouTube audits may process channel metadata and recent public upload metadata from YouTube API Services. Wraith Reach does not request YouTube account access for this workflow.

When live Instagram access is enabled, Wraith Reach will request only the permissions needed for the selected workflow. The Creator Signal Audit connection reads the connected professional account profile, media, insights, comments on media owned by that account, and conversations that Instagram users initiate with that account. Wraith can publish through Instagram Login or a separate Facebook Page authorization, and requires the member to upload, review, and explicitly confirm each public post. The app does not run ads or access comments on arbitrary third-party creators' media.

YouTube publishing is a separate, optional channel authorization. When you connect a channel, Wraith stores its channel identifier, display name, granted permissions, and encrypted access and refresh tokens. Wraith uses those credentials to perform the uploads, metadata edits, thumbnail changes, and playlist additions you explicitly request. Tokens and private channel metadata are not sent to Hydra or AI audit workers. Google sign-in alone does not authorize publishing.

TikTok account access is a separate, optional creator authorization through TikTok Login Kit. When you authorize your own account, Wraith stores its TikTok account identifiers, display name and username, the permissions TikTok granted, encrypted access and refresh tokens, and connection timestamps. Wraith uses them to read that account's profile and your own posted videos through the official TikTok Display API, live for each request; it keeps no copy of that profile or video content. This authorization alone does not post, edit, schedule, or delete anything on TikTok, and gives Wraith no access to other creators' accounts, videos, or comment threads. TikTok tokens are not sent to Hydra or AI audit workers.

Where TikTok posting is activated, the same authorization also asks for TikTok's posting permissions. Wraith then posts only a clip of a video you uploaded, after you preview it and explicitly approve its caption, visibility, interaction and disclosure choices, which Wraith checks against your current TikTok settings. For each approved post Wraith records the source video and clip times, your choices and approval time, and the post status TikTok reports. Removing a post record or disconnecting the account deletes those records; it does not remove anything from TikTok.

Use TikTok account access to disconnect an account or delete all TikTok data in your Wraith account. Wraith deletes the stored connection and tokens, asks TikTok to revoke the grant, and tells you when it cannot confirm revocation. Expired or withdrawn consent deletes the stored tokens and stops all reads until you reconnect. You can also remove Wraith in your TikTok account settings. Disconnecting does not delete videos on TikTok. Use of TikTok information is also governed by TikTok's Privacy Policy.

Clip Finder stores the video you upload, its file name, audience questions or comments you supply, and the selected caption excerpts and timestamps in your customer workspace. These inputs are processed by Wraith's servers and authorized processing workers to prepare the clips you request. Sources and finished clips have retention limits; an export is not necessarily erased immediately after downloading. Use Activity and Clip Finder to review availability and delete content. Processing does not by itself publish a clip.

Private media, processing and retention

When private media storage is enabled, uploads and permitted platform imports are stored in private Linode/Akamai Object Storage. Processing workers may temporarily retrieve customer videos or permitted reference videos, transcripts, audience questions and clip instructions. Workers receive job-scoped access; finished downloads use time-limited links. Wraith records file checksums, provenance, ownership, permissions, job progress and cleanup receipts. Public reference content is an input signal, not proof that an identified person is a fan, and is not permission to republish another creator's footage.

Private-storage defaults are 30 days for customer sources and exports and 7 days for reference content; availability can end earlier when consent or source authority expires. Activity shows each item's expiry and supported keep/delete controls. Legacy server-local sources default to 30 days and local exports to 60 minutes. A deployment's configuration and the displayed item state determine actual availability; do not rely on Wraith as the only copy of a video.

Activity lets you inspect jobs, cancel supported work, pause processing and exclude creators from collection. Cancellation or deletion revokes future access and requests cleanup; a running transfer or worker cache may require a cleanup acknowledgement before every copy is removed. Limited job, deletion and integrity records support retries and cleanup. Operational backups rotate separately; deletion records are replayed when restoring a backup so deleted data is not returned to active use.

Companion apps and optional notifications

The Android and iPhone companions pair through a signed-in web account. We store a device name, hashed device credential, pairing/expiry and last-access times. Manage or revoke paired access at Devices. The app retrieves approved response information and, after authorization, the reviewed clip for preview, saving or sharing. Unpairing or uninstalling the app does not delete your Wraith account.

Where remote alerts are enabled, Android uses Google Firebase Cloud Messaging and Firebase Installations. These services process installation identifiers and registration tokens to route notifications. Wraith stores the encrypted push token, permission/opt-in state, platform, delivery and interaction records, and quiet-hours settings. Notifications carry generic copy and an opaque response identifier; the app authenticates again to fetch current content. The Android client includes Firebase Messaging, not the Firebase Analytics SDK. Google's processing is described in Firebase privacy information. Turning alerts off or revoking a device stops future authorized deliveries and removes Wraith's active stored token; Google's installation lifecycle is separate.

When you choose Save or Share, copies may remain in your photo library, downloads or a destination app under that app's controls. Revoking a Wraith download link or deleting server data cannot erase copies you already saved, shared or published. If you report an outcome, Wraith stores that report and any note you submit. Platform handoffs and customer-reported submission states are not independently verified delivery.

For YouTube publishing, video and thumbnail bytes pass through Wraith to YouTube without being retained as media files. Upload progress records, file names, a sampled file fingerprint used for resume checks, video IDs, and encrypted resumable-upload credentials are retained for at most 29 days. Upload credentials are erased on confirmed completion. Video metadata fetched for editing is not stored as an audit artifact. Connected-channel data is revalidated by daily maintenance; invalid authorization removes the local connection and its upload records.

Use YouTube publishing to disconnect and delete a channel's Wraith connection, tokens, and upload records. Wraith also attempts Google token revocation and reports if it cannot confirm it. You may revoke Wraith access directly inGoogle account permissions. Disconnecting does not delete videos already uploaded to YouTube; manage those in YouTube Studio.

Wraith Reach stores the minimum workflow data needed to create an audit: audit request metadata, source/provenance, connected account identifiers, encrypted access tokens, audit events, and generated audit/plan artifacts. Sign-in email addresses and optional profile details are stored for account access; passwords are stored as salted password hashes. Provider access tokens are encrypted. We do not claim that all stored account email addresses are anonymous or hashed.

Use of YouTube information is also governed by Google's Privacy Policy. Public YouTube source data is used to generate the requested audit and is not sold or used to infer sensitive personal attributes.

Users can disconnect and request deletion from the app's data controls. For deletion requests, including full account and associated-data deletion without signing in, use account and data deletion.