Privacy Policy

Legend ("Legend", "we", "us", or "our") operates the website and service at legend.ad, which helps musicians sync performance videos with their songs and publish the resulting clips to their own TikTok, Instagram, and YouTube accounts. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the choices you have. Legend is operated by ZIGG SAS (France), which is responsible for your personal data. Our service providers (listed in section 5) process data in the United States and other countries.

If you have any questions or requests about your data, contact us at zigg.team@gmail.com.

1. Data we collect

• Account data.If you sign up with an email address and password, our authentication provider, Supabase, stores your email address and a hashed version of your password. If you sign in with Google, Supabase stores the basic profile information Google shares with us: your name, email address, whether that email address is verified, your profile picture URL, your Google account ID and, for Google Workspace accounts, your organization's domain. See "Google user data" below.
• Content you upload.Videos of your performances, audio recordings of your songs, lyrics, and related metadata (titles, captions, edits, schedules). Media files are stored in private Google Cloud Storage buckets, and temporary previews created while matching are kept on our servers for about an hour. Your browser reaches them through short-lived signed links or through Legend's servers.
• Connected social account data. When you connect a TikTok, YouTube, or Instagram account, we store the platform user or channel ID, your username or handle, the permissions (scopes) you granted, and the OAuth access and refresh tokens needed to publish on your behalf. We never receive or store your social media passwords.
• Publishing data. Records of the posts we publish or schedule for you: captions, privacy settings, publish times, and the URLs or IDs of the resulting posts.
• Technical data.Standard log information such as IP address, browser type, and timestamps, used for security and to operate the service. We use first-party cookies to keep you signed in (they last up to 400 days after your last visit unless you sign out), and a 10-minute cookie that protects the authorization step when you connect a social account. Your browser's local and session storage remember app state such as your playback queue and the clips you picked to schedule; that data stays on your device. Your unconfirmed scheduling draft (clip order, captions, YouTube titles, and post settings) is saved to your Legend account so you can pick up where you left off, and is deleted when you confirm or clear it. The video editor loads fonts from Google Fonts, which receives your IP address and browser information. We do not use advertising or cross-site tracking cookies.

2. How we use your data

• To provide the service: matching and syncing your takes to your songs, rendering clips, and publishing or scheduling posts you approve.
• To publish content to the social accounts you connected, only when you schedule or request it.
• To generate suggested titles and captions for your videos from your song titles, lyrics, audio, and videos (never from your Google account or YouTube data).
• To secure the service, prevent abuse, and communicate with you about your account.

We do not sell your personal data, and we do not use your data or content for advertising. We do not use data obtained from connected social platforms for any purpose other than providing and improving the user-facing features described above.

3. Connected social platforms

YouTube

Legend uses YouTube API Services to upload videos to your YouTube channel and to read basic information about your channel (its name and ID). By connecting a YouTube account, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Each YouTube post uploads with the title, description (your caption), visibility, and made-for-kids setting you choose in Legend before scheduling it. You can keep editing the title and description until the post goes out, or unschedule it.

We store the OAuth tokens Google provides for as long as your YouTube account remains connected, solely to publish the videos you schedule and to confirm, once a day, that the connection still works and your channel details are current. We also store your channel's name and ID, which we re-read from YouTube at least once a day while you're connected, and the ID and link of each video we upload for you, which we delete 28 days after upload.

You can revoke Legend's access to your YouTube data at any time by disconnecting the account inside Legend, or via the Google security settings page at https://security.google.com/settings/security/permissions. When you disconnect inside Legend, we ask Google to revoke Legend's access and immediately delete the stored tokens, channel information, and video IDs. If you revoke access from Google's settings instead, or our access stops working, we detect it (usually within a day) and delete that stored YouTube data within 30 days.

See "Google user data" below for how we handle everything we receive from Google, including our Limited Use commitment.

TikTok

When you connect TikTok, we access your basic profile information (display name, avatar, open ID) and the permission to publish videos to your account through TikTok's Content Posting API. Posts are published with the privacy level you choose. You can revoke access at any time by disconnecting the account inside Legend, or by removing Legend from your authorized apps in the TikTok app (Settings → Security & permissions → Apps and services). When you disconnect, we delete the stored tokens.

Instagram

When you connect Instagram, we access your professional account ID and username and the permission to publish content to your account through the Instagram API. You can revoke access at any time by disconnecting the account inside Legend, or from your Instagram settings (Accounts Center → Website permissions → Apps and websites). When you disconnect, we delete the stored tokens. You may also request deletion of all data we hold from your Instagram connection by emailing zigg.team@gmail.com.

4. Google user data

This section explains how Legend handles information it receives from Google: through Sign in with Google and, if you connect a channel, through YouTube API Services. It applies in addition to the rest of this policy.

What we access

• Sign in with Google(openid, email, profile): your name, email address, whether that email address is verified, your profile picture URL, your Google account ID and, for Google Workspace accounts, your organization's domain. During sign-in, Google also gives our authentication provider a one-hour access token (and no refresh token). Legend never uses it to call Google APIs, and it stops working after one hour.
• YouTube(youtube.upload, youtube.readonly), only if you connect a channel: your channel's ID and name (the only channel fields Legend requests from YouTube), the OAuth access and refresh tokens Google issues to Legend, the permissions you granted, and the ID and link of each video Legend uploads for you. Legend does not read your existing videos, playlists, subscriptions, comments, or analytics.

When Legend uploads a video, YouTube's response describes the new video; Legend keeps only its ID and link. Legend accesses only the raw data listed above. It does not create, use, or share aggregated or anonymized data derived from Google user data.

How we use it

Your email address identifies your Legend account, lets you sign in, is shown in Legend's account menu, and lets us contact you about your account. Your Google account ID links your Google sign-in to your Legend account. Legend does not currently display or otherwise use your name, profile picture, or organization domain; our authentication provider stores them because Google returns them at sign-in.

We use YouTube data only to upload the videos you choose to publish or schedule, with the title, description, visibility, and made-for-kids setting you chose; to show you which channel is connected; and to check once a day that the connection still works and the stored channel details are current.

Who we share it with

We share Google user data only with: (1) service providers that run Legend for us: Supabase (authentication and database), which stores it, and our application servers on Netlify and Google Cloud Run, which process it to handle your requests; (2) YouTube, when you publish, at your direction; and (3) authorities, when required by applicable law. If Legend is involved in a merger, acquisition, or sale of assets, we will ask for your explicit consent before any Google user data is transferred. We never send Google user data to AI services, including the AI providers behind Legend's features (OpenAI, Klap, Replicate), which receive only your song titles, lyrics, audio, and videos, and we never share it with advertisers, ad networks, data brokers, or information resellers.

How we protect it

Google user data is protected by the measures described in "Security" below. In particular, YouTube OAuth tokens are kept in a database table that browsers and our public API cannot read; only Legend's servers can read them, and they are never sent to your browser.

How long we keep it and how to delete it

• Sign-in data is kept while your Legend account exists. Email zigg.team@gmail.com and we will delete your account and all associated data within 7 days. Removing Legend on the Google security settings page at https://security.google.com/settings/security/permissions revokes the access you granted to Legend but does not delete your Legend account.
• YouTube tokens and your channel's ID and name are kept only while your channel is connected: they are deleted immediately when you disconnect in Legend, and within 30 days after Legend's access stops working (for example, if you revoke it in your Google Account).
• The ID and link of each video Legend uploads are deleted 28 days after upload, or immediately when you disconnect.
• Deleting your Legend account deletes all of this data. Videos you already published stay on your YouTube channel under your control.

Limited Use

Legend's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide the user-facing features described above (signing in, managing your account and answering your support requests, and publishing to your YouTube channel); we transfer it only as described in "Who we share it with"; we never use or transfer it to serve advertising, including personalized, retargeted, or interest-based ads; we never sell it or transfer it to data brokers or information resellers; we never use it to determine creditworthiness or for lending; and no person at Legend reads it unless you explicitly agree that we may view specific data (for example, when you ask us to look into a particular post), it is necessary for security purposes such as investigating a bug or abuse, or it is required to comply with applicable law.

No AI or machine-learning training

We do not use Google user data to develop, improve, or train any AI or machine-learning models, whether generalized, non-personalized, or personalized, and we do not allow anyone else to do so. Legend's AI features (suggested titles and captions, subtitles, vocal isolation) use only your songs, lyrics, audio, and videos.

5. How your data is stored and shared

We share data only with the service providers (processors) we need to run Legend, and only to the extent required:

• Supabase — authentication and database hosting (account data, social account tokens, publishing records).
• Google Cloud Storage — storage of your video and audio files in private buckets.
• OpenAI — processing of video titles and lyrics to generate suggested titles and captions.
• Klap — processing of your videos to generate captions/subtitles.
• Replicate — audio processing (vocal isolation) used for caption alignment.
• Hosting providers (Netlify and Google Cloud Run) — running the application.
• TikTok, Google/YouTube, and Meta/Instagram — we transmit the videos and captions you schedule to the platforms you connected, at your direction.

Access and refresh tokens for the TikTok, YouTube, and Instagram accounts you connect are stored only in our database, are never sent to your browser, and are used only to publish the content you schedule (and, for YouTube, to confirm the connection once a day). We may disclose other data if required by law or to protect the rights, safety, or property of Legend or others; Google user data is covered only by the narrower rules in "Google user data" above. We do not sell personal data.

6. Data retention and deletion

• Your account data and content are retained while your account is active.
• Disconnecting a social account deletes the stored OAuth tokens for that platform. For YouTube it also revokes Legend's access with Google and deletes the stored channel information and video IDs (see "Google user data" above for how long those are kept).
• You can request deletion of your account and all associated data (including uploaded media, social connection data, and publishing records) at any time by emailing zigg.team@gmail.com. We will complete the deletion within 7 days.
• Content already published to your social accounts remains on those platforms under your control; deleting your Legend account does not remove posts from TikTok, YouTube, or Instagram.
• Deleted data can remain in our database provider's daily backups for up to 10 days before those backups expire.
• Our hosting providers keep operational logs, which can include your IP address or email address, for up to 30 days.
• Our authentication provider keeps the IP address and browser type of each signed-in session until you sign out of that session or delete your account.

7. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete, or export the personal data we hold about you, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email zigg.team@gmail.com. You may also have the right to lodge a complaint with your local data protection authority. Wherever you live, you can ask us for a copy or an export of the personal data we hold about you, including Google user data, by emailing the same address.

8. Security

We protect your data, including Google user data, as follows. Connections between your browser, our servers, our database, and Google use HTTPS (TLS). Our database (Supabase) and file storage (Google Cloud Storage) encrypt data at rest. Media files are kept in private storage buckets and reached through short-lived signed links or through Legend's servers. Access and refresh tokens for the TikTok, YouTube, and Instagram accounts you connect are kept in a database table that cannot be read from browsers or through our public API; only Legend's servers can read them, and they are never sent to your browser. The one-hour Google sign-in token is handled as described in "Google user data" (section 4). Access to our production systems is limited to the Legend team. No method of transmission or storage is completely secure, but we work to protect your data against unauthorized access, alteration, or destruction.

9. Children

Legend is not directed at children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. If the changes are material, we will notify you by email or through the service.

11. Contact

Legend — zigg.team@gmail.com