Privacy Policy
Effective 31 July 2026
Riff turns your website into short-form social posts. This policy explains what we collect to do that, who else touches it, and how to get it back or get it deleted. It is written to be read, not to be survived.
Riff is operated from San Francisco, California. Questions about anything here go to hello@snatched.ai.
What we collect
- Your account. Email address and name, handled by our authentication provider when you sign up.
- The website you paste. We fetch that public page and derive a brand profile from it — your positioning, tone, and the words you use. We store the profile and the source URL.
- What you make. Generated posts, your edits, and which ones you kept or rejected.
- Connected social accounts. See the TikTok section below.
- Billing. Plan, subscription status, and usage counts. Card details go straight to our payment processor — we never see or store them.
- Basic technical data. Logs and error reports produced by running the service.
How we use it
To generate posts in your voice, to show you your library, to enforce your plan's limits, to send content to a social account you connected, and to fix things when they break. That is the entire list. We do not build advertising profiles and we do not sell your personal information.
Your TikTok account
Connecting TikTok is optional and everything about it is opt-in.
- You authorize through TikTok's own OAuth screen. We never see or store your TikTok password.
- We request three scopes: user.info.basic (so we can show you which account will receive your content), video.upload, and video.publish.
- We store the access and refresh tokens TikTok issues, your display name, and your avatar. Tokens are encrypted with AES-256-GCM before they are written to our database, so a database dump yields ciphertext rather than usable accounts.
- Content is delivered to your TikTok inbox for you to review and publish from the TikTok app. Nothing is posted without a post you approved in Riff first.
- You can revoke Riff's access at any time from TikTok's own app settings, or email hello@snatched.ai and we will delete the connection and its tokens. Revoking stops all scheduled delivery.
Who processes your data
We use these providers to run Riff. They only ever see what they need for their part of the job.
- Clerk — accounts, sign-in, and subscription billing.
- Supabase — the database and file storage holding your brand profile and posts.
- Vercel — hosting and request logs.
- Anthropic and fal.ai — the AI models that write and render your posts.
- Unsplash and Pexels — stock footage and imagery used inside generated posts.
- TikTok — only if you connect an account.
We do not use your content to train our own models, and we do not sell or rent your data to anyone.
How long we keep it
Your brand profile and posts stay until you delete them or close your account. Posts you reject are deleted. Logs roll off within 30 days. When you ask us to delete your account, we remove your data — including any stored social tokens — within 30 days, except where we are legally required to keep billing records.
Your choices
Email hello@snatched.ai to get a copy of your data, correct it, disconnect a social account, or delete your account entirely. We answer within 30 days. If you are in California, the EU, or the UK, you have these rights under your local law and we honour them for everyone regardless of where you live. You will never be charged or degraded for exercising them.
Cookies
Riff sets the session cookies required to keep you signed in. We do not run third-party advertising or cross-site tracking cookies.
Children
Riff is for people 18 and over. We do not knowingly collect data from children. If you believe a minor has an account, tell us and we will remove it.
Changes
If we change this policy in a way that matters, we will update the effective date above and email account holders before it takes effect.
Contact
hello@snatched.ai. This policy is governed by the laws of the State of California.