Privacy Policy
Effective November 3, 2026
In short
- Content Engine is a private tool operated by Tusk Shells LLC. Only our own team uses it, to publish our brands' content to social media accounts we own and to see how that content performs.
- It reads only what each platform lets the connected account share with it, and only for that account.
- We never sell data, never use it for advertising, and never use it to train AI models.
- Disconnecting an account deletes its stored access tokens. You can ask us to delete everything else at any time.
Who we are
Content Engine ("the app", "we") is operated by Tusk Shells LLC, a Colorado limited liability company. It publishes content for our brands: our founder's personal fitness brand, Strength and Wellness Coaching (SWC) (swcaurora.com) and Tusk Shells (tuskshells.com). The app is not offered to the public: no one else can sign up or connect accounts. Questions about this policy: hello@tuskshells.com.
What data we access
When we connect a social media account, the platform asks the account owner to approve specific permissions. We access only what those permissions allow, only for accounts we own or manage:
| Platform | What we access |
|---|---|
| YouTube (Google) | Channel ID, name and handle; upload access for videos we publish; statistics for our own videos and channel (views, likes, comments, watch time, subscribers). |
| TikTok | Open ID, username, display name and avatar; permission to post videos to the account; counts for our own videos and profile (views, likes, comments, shares, followers). |
| Member ID, name and profile URL; the company pages the member administers; permission to post as the member and those pages; statistics for our own posts and pages (impressions, reactions, comments, shares, followers). | |
| Account ID and username; our boards; permission to create Pins; analytics for our own Pins and account (impressions, saves, clicks, followers). | |
| Tumblr | Blog names and IDs; permission to create posts; note and follower counts for our own blogs and posts. |
| Facebook, Instagram, Threads (Meta) | Page, Instagram and Threads account IDs and names; permission to publish; insights for our own posts and accounts. |
| X | User ID and handle; permission to post and upload media; public and owner-only metrics for our own posts. |
| Bluesky | Handle and DID; an app password the account owner creates for this tool; engagement counts for our own posts. |
For every platform we also store the access and refresh tokens it issues, so the app can act for the account until access is revoked.
We do not read private messages, contacts or friend lists, and we do not collect information about other people. Where a platform reports how our posts performed, we receive totals (for example "120 likes"), not who liked them.
The app also stores what we upload or write: videos, images, captions, titles and schedules. On the dashboard itself we keep our sign-in email and a session cookie.
How we use it
Only to:
- publish our content to our accounts at the times we choose;
- show us, on a private dashboard, how each post and account is doing;
- keep connections working, for example by renewing tokens before they expire.
We do not use platform data for advertising, profiling, selling, or training AI or machine-learning models, and we do not combine it with data from other sources about any person.
Google and YouTube data
Content Engine uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
Content Engine's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide the features described above; we do not transfer it to others except as needed to run the app (our hosting providers, below), to comply with law, or as part of a merger or sale of the app with notice; no person reads it except with the account owner's consent, for security, or where the law requires; and we never use it for advertising or to train AI models.
You can revoke the app's access to your Google account at any time at myaccount.google.com/permissions. After that the stored token no longer works and the dashboard shows the channel as needing to be reconnected. We then delete the channel's stored YouTube data automatically about 30 days after the dashboard first shows it as needing to be reconnected (see below), or sooner on request.
Storage and security
- Data is kept in our own database (Supabase, Postgres) and media storage (Cloudflare R2), hosted in the United States. The dashboard and background worker run on cloud hosting (Vercel, Railway).
- Access and refresh tokens are encrypted at rest with AES-256-GCM, and they are never shown on screen or written to logs.
- The dashboard requires sign-in and only our team is allowed in. Database tables are not reachable through public APIs.
- All connections use HTTPS.
Sharing
We do not sell, rent or share platform data. The only companies that process it are the providers that host the app (database, file storage and hosting), under their standard data-processing terms, and the platforms themselves when we publish to or read from them. We disclose data if the law requires it.
How long we keep it, and deleting it
- Disconnect: when we disconnect an account on the dashboard, its stored tokens are erased immediately. The "Delete data" option also erases the metrics and profile details collected for it. Records of our own posts (caption, time, link) stay unless deletion is requested. When one login connected several accounts (for example several Tumblr blogs or LinkedIn pages), each is disconnected separately.
- Revoke: you can revoke access from the platform at any time:
- YouTube (Google): Google Account → Security → Third-party connections
- TikTok: TikTok app → Settings and privacy → Security → Manage app permissions
- LinkedIn: LinkedIn → Settings → Data privacy → Permitted services
- Pinterest: Pinterest → Settings → Security and logins → Apps
- Tumblr: Tumblr → Settings → Apps
- Facebook, Instagram, Threads (Meta): Facebook → Settings & privacy → Settings → Business integrations (and Threads → Settings → Account → Website permissions)
- X: X → Settings → Security and account access → Apps and sessions
- Bluesky: Bluesky → Settings → Privacy and security → App passwords → delete
- On request: email hello@tuskshells.com with the platform and account handle, and we delete the stored data for that account within 30 days and confirm by email.
- Automatically: once an account has been disconnected, or shown as needing to be reconnected (for example because access was revoked), for 30 days, we delete its stored tokens and the metrics and profile details collected for it within the following day. Accounts that a sign-in returned but we never turned on are never used; their tokens are deleted when we disconnect them.
- Otherwise, metrics are kept while an account stays connected so we can compare performance over time.
Cookies
The dashboard sets only the cookies needed to keep our team signed in and to protect sign-in flows. There are no analytics, advertising or tracking cookies, and these public pages set none.
Children
The app is not directed at children and is not used by anyone under 18.
Your rights
Depending on where you live, you may have the right to ask what data we hold about you, to correct it, or to have it deleted. Because the app holds data only about accounts its operator owns, such requests are rare, but we answer every one: contact us below.
Changes
If this policy changes, we update this page and its effective date. Material changes take effect only after they are posted here.
Contact
- Privacy and data requests (all brands): hello@tuskshells.com
See also the Terms of Service.