Privacy Policy

Last updated: October 27, 2026

Social Studio is a social media management tool operated by White Oak Media (“we”, “us”). We help churches and organizations schedule and publish content to their own connected social media accounts. This policy explains what we collect and how we use it.

What we access

When you connect a Facebook Page, Instagram, YouTube, or TikTok account, you grant Social Studio permission to publish content you create, read the engagement (comments and messages) on that content, and read basic account and post metrics. We only access the accounts you explicitly connect, and only for the features you use.

What we store

• Access tokens for the accounts you connect, encrypted at rest.
• The posts, captions, and media you create in the tool.
• Comments and messages retrieved from your connected accounts, to show them in your inbox.
• Aggregate post metrics (reach, likes, comments, views) for reporting.

YouTube API Services

Social Studio uses YouTube API Services. Where you connect a YouTube channel, we use those services to list your own recent uploads so you can pick the week’s sermon, to upload short clips back to your own channel, and to read and reply to comments on your channel’s videos. Clips are cut from a sermon video file you upload to Social Studio; we never download video from YouTube.

By using this part of Social Studio you are also agreeing to the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

What we store from YouTube. The channel’s id and name; the id, title, duration and thumbnail of videos on the channel, so we can find the sermon to cut; the ids and links of clips we upload on your behalf; comments on those clips, so they appear in your inbox; and view and engagement counts for reporting. We store an encrypted access token for as long as the channel stays connected.

How long we keep it. Stored YouTube data is refreshed from the API rather than left to go stale — comments at least every thirty minutes, and view and engagement counts daily for thirty days after a video is published. Once a video passes that window we stop refreshing its counts, so we delete them rather than keep a number that is no longer true. What remains is our own record that we published the video, and its id.

Revoking our access. You can disconnect the channel inside Social Studio at any time. That revokes our access at Google, deletes the stored token, and deletes the YouTube data we hold for the channel — its comments and messages, daily channel statistics, our copies of its video details, and view counts. We keep only the channel’s name and id, so you can see it is disconnected, and our own record of which videos we published for you; removing the channel from your account list deletes the name and id too. You can also revoke our access directly from your Google account at security.google.com/settings/security/permissions, which works whether or not you still have a Social Studio login. When you do, we delete the same data within seven days.

Who processes it for us

We use a small number of service providers to run Social Studio. Each receives only what its job needs, only to provide Social Studio’s features to you, and none may use it for its own purposes.

• Google Cloud and Firebase — where your account, connected-account tokens, posts, media, comments and metrics are stored and processed.
• Vercel — hosts the Social Studio web app you sign in to.
• Anthropic (the Claude AI model) — receives the text of comments and messages that arrive in your inbox, including YouTube comments, so it can sort them and draft a suggested reply for you to review; and the transcript of a sermon you choose to clip, so it can pick moments and draft captions. A suggested reply is only a draft: it is sent when a person sends it, or never. (Keyword reply rules you write yourself are separate, and use your own wording.) Anthropic does not train its models on data sent through its API.
• AssemblyAI — receives the audio of a sermon video you choose to clip, to produce the transcript.
• Resend — sends the notification emails you receive from us.
• Meta, Google (YouTube) and TikTok — the platforms themselves, which receive what you publish and your replies.

Cookies and information stored on your device

Social Studio stores a small amount of information in your web browser so the app works. The Social Studio web app does not set cookies of its own, does not use advertising or analytics cookies, and does not load any third-party tracking or advertising scripts. This is what it does store on your device:

• Keeping you signed in. When you sign in, Firebase Authentication (the Google service we use for sign-in) saves your sign-in session in your browser’s IndexedDB storage, or in its local storage if IndexedDB is not available. It holds your account id, your email address and the security tokens that show you are signed in. It is used only to sign you in to Social Studio, and stays until you sign out.
• Remembering your preferences. Your browser’s local storage holds a few settings: which church you were last working in, whether sound is on in the post preview, and whether you hid the setup checklist.
• Not losing your work. Your browser’s session storage, which it clears when you close the tab, holds a copy of a post while you edit it so a reload does not lose it, content you send from another page into the post composer, and a short-lived copy of your Sundays list so the page loads quickly.
• Notifications, only if you turn them on. If you choose “Notify me on this device”, your browser installs a small service worker from Social Studio and creates a push subscription with your browser’s push service (for example Google for Chrome, Apple for Safari, or Mozilla for Firefox). We keep that subscription’s address on our servers so we can send notifications to that device. The service worker only shows the notifications we send and opens the right page when you tap one; it does not cache or collect anything. Nothing is installed unless you turn notifications on.

Third parties. Firebase Authentication (Google) is the only third party that stores or reads information on your device through Social Studio, and only to keep you signed in as described above. Profile pictures and video thumbnails from your connected accounts are loaded straight from the platforms’ own image servers (such as YouTube’s, Meta’s and TikTok’s), so your browser contacts those servers to fetch each image and they receive what a browser sends with any request, such as your IP address and browser type. When you connect an account, you sign in on that platform’s own site, which uses its own cookies. Those companies’ own privacy policies cover what they receive, including the Google Privacy Policy.

Clearing or blocking it. Signing out removes your sign-in session from the browser. Turning off “Notify me on this device” in Settings removes the push subscription from the browser and deletes it from our servers; you can also block notifications for this site in your browser’s site settings. You can clear everything Social Studio has stored by clearing this site’s data (cookies and site data) in your browser’s settings, which also removes the service worker, and you can block site storage for this site there too. If you do: blocking storage means Social Studio cannot keep you signed in, so you may be signed out each time you reload or be unable to sign in at all; clearing it resets your preferences and loses any post edits you had not saved; and without notifications you will not be alerted on that device to new comments and messages. Your posts, accounts and other data saved on our servers are not affected.

How we protect it

All traffic to and from Social Studio is encrypted in transit (HTTPS/TLS), and stored data is encrypted at rest. Access tokens for your connected accounts are additionally encrypted with a key held only by our servers, and are never sent to your browser. Your church’s data is visible only to your own signed-in users and to White Oak Media staff working on your account, with access limited by role.

What we don’t do

We do not sell your data, use it for advertising, or give it to data brokers or advertisers. We share it only with the service providers above, only to provide Social Studio’s features. We do not use YouTube data to build advertising profiles, and we do not use Google user data to develop or train AI models.

Social Studio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your data

You can disconnect any account at any time, which deletes its stored tokens. To request full deletion of your data, see our data deletion instructions or email hello@whiteoakmedia.io.