Privacy Policy

This Privacy Policy explains how Universality ("Universality", "we", "us") collects, uses and shares personal information when you use our website and services (the "Service"). By using the Service you accept this policy. Our privacy contact is our privacy contact: [email protected]. You can also use Get help in your dashboard.

1. Personal information we collect

Information you give us

• Sign-in and profile. With Discord: your user ID, username, display name, picture and verified email address (and, if our Discord server must be joined first, whether you are a member; we read the list of servers only for that check). With Google: your account ID, name, email address, picture and whether the email is verified. Your display name, @username, picture, cover and bio, who follows you and whom you follow. They start as your Discord or Google name and picture. A display name and a username can each be changed once every 14 days; we keep the earlier ones, and our team can see them.
• Linked accounts. For TikTok or Instagram: the account ID, username and the access token that lets us read statistics (tokens are stored encrypted). We never post, edit or delete anything on your accounts and never read your private messages.
• Clips. The link, the title you give it, the platform's statistics for it (updated at least every 2 days for 14 days, then locked, with a daily history), the review decision, and the audience screenshot or short screen recording you upload (it can show the age, gender and country of your audience; we make it smaller and take the sound out of a recording before we keep it).
• Payment details. The payout method you add (for example a PayPal email or a wallet address), stored encrypted, and your cash-out history. If we send cash-outs through Stripe, you give your bank or identity details to Stripe on its own form, not to us.
• Messages. What you write in support chats with our team, in chats with other clippers and in the general chat, with the time sent and whether read. You can edit or delete your own messages in chats with other clippers (a deleted message disappears for everyone in the chat). Support chats cannot be edited or deleted by clippers, so the record of what was asked and answered stays. A reported message is copied into the report for our team. We also keep the people you block and the messages you report. Chat is live: your browser keeps one open connection to our server so messages arrive as they are sent; we use it for nothing else.
• Slideshows. If you use the slideshow generator, the slideshows you make (which pictures and texts were chosen, the caption and the sound), a short list of what you already had so the same slide is not given again soon, and when you made them. At most 100 are kept for each generator. You can remove one, or clear all of them, in the generator's History, and they are deleted with your account.
• Brands. If you ask for a call, the company name and email you give and when you asked; if you sign in as a brand, the company name you choose (also the name of your brand account). A short note with the company name and email may be posted in a private channel on our team's Discord; the booking page is on Cal.com, under its own policy.
• Records of what you accepted: the documents, their version, the date and time, and the age you confirmed.

Information collected automatically

• A sign-in cookie, your IP address in server logs and for abuse prevention, and for each device you sign in on its browser and system, network address and last use (so you can see where you are signed in and end a session; it goes when the session ends). For team members, sign-ins are also written to a security history.
• When you sign in, and from time to time while signed in, the IP address (for IPv6, its first half), a random device cookie that identifies your browser, and the date. We keep this for 180 days. Our team can see which accounts share an IP address, a device or a verified email, to find one person using several accounts, for example to be paid more than once. It is not shown to other members, and a shared address on its own leads to no action.
• Error logs: a short log of the error message and the page it happened on (anything that looks like a password or token is blanked out). No content.
• Choices kept on your device, not on our server: your theme and layout, the list of accounts on the device (names and pictures only), a copy of the slideshow you have open, and copies of a few answers so pages still work offline. See the Cookie Policy.

Information from others. From Discord, Google, TikTok, Instagram and Stripe, what they send us under your permission (above). From brands, campaign briefs.

2. Why we use it

• To sign you in, run your account and the Service, and let you switch between accounts on one device.
• To confirm videos, count views, work out earnings and pay you; to review clips for quality, rules and fraud (for example bought views) and to spot one person using several accounts.
• To answer you, send service messages (account, campaigns, clip decisions, payments, legal notices), and keep the Service secure and working.
• To meet legal duties (tax and payment records, sanctions, law enforcement requests) and to enforce our terms.
• To improve the Service from aggregated or anonymised information.
• To send marketing only with your consent where the law requires it (see section 9). We do not sell personal information and do not use it for advertising.

3. Who sees it

• Our team. What each team member sees depends on their role. A moderator who only reviews clips does not see payment details or balances.
• Brands you work for. For the campaign you joined only: your display name, the names of the TikTok and Instagram accounts you posted from, your clips in that campaign, their statistics and review status. Not your payment details, wallet, audience screenshots, messages or other campaigns.
• Other members. Your profile (display name, @username, picture, cover, bio, followers, who you follow, and the campaigns you joined unless you hide them), never the public. Views, earnings and clips are not part of it. You can block or report anyone, and you can be blocked or reported: a report keeps the profile as it was when reported, for our team.
• Everyone, through the public leaderboard. Your display name, picture and the views on your approved clips. Never money amounts. You can hide yourself in Settings at once.
• The general chat. A line (up to 200 characters) with your username (and, for team members, their role) is seen live by every signed-in member except those who blocked you. We keep the latest 1,500 lines. A reported line is kept with the report. Lines are checked against a list of blocked words; we keep a record of refused lines for up to 120 days so repeated ones can lead to a suspension.
• Private chats. If you allow messages, people you follow and who follow you back can chat with you; the two of you read it. Our team does not read it unless one of you reports a message.
• Service providers who help us run Universality on our instructions: our hosting provider (Railway); Cloudflare (in front of the site, so it sees the address and requests of every visitor; its R2 storage keeps audience screenshots and recordings in a private bucket for at most 15 days, and our encrypted database backups); Stripe for automatic cash-outs; Cal.com for booking calls; and the services we call for you: Discord, Google, TikTok and Meta. Fonts are served from our own site. Each has its own policy.
• Authorities and others, where the law requires, to protect people or prevent fraud or abuse, or in a sale of the business (the buyer must keep to this policy).

4. Cookies and similar technologies

We use only what the Service needs to work (a sign-in cookie, a device cookie, and settings stored on your device), and no advertising or analytics tools. Details and your choices are in the Cookie Policy. We do not respond to "Do Not Track" signals because we do not track you across sites.

5. Security

Linked-account logins and payout details are encrypted in our database; the site is served over HTTPS; access to team tools is limited to named people and logged. No system is perfectly secure, so please use a strong password and two-step sign-in on your Discord and Google accounts. If a breach creates a real risk of significant harm to you, we will tell you and the authorities as the law requires, and keep a record.

6. Data from TikTok, Instagram and other platforms

We use it only for the purposes above. You can unlink an account at any time in Linked Accounts: that deletes the stored login, stops syncing, and deletes clips you sent from it that were not approved yet (with their statistics and audience files). Clips already approved stay, because they count toward pay, and stop getting new view counts. You can delete a clip that is not approved yet in your submissions; to have an approved clip removed, or all your data deleted, contact us. You can also remove our access in TikTok's or Instagram's own settings. If you delete a video from a platform, we notice after a few hourly checks, stop updating it, mark it deleted, and keep its record (title, last statistics, decision) because it may already count toward payments.

7. Children

The Service is for people who are at least 13 years old; under 18 only with a parent's or guardian's permission (see the Terms of Service). We do not knowingly collect information from anyone younger than 13. If you think a younger child has an account, tell us and we will delete it. A parent or guardian can ask us to review or delete their child's information.

8. How long we keep it

• While your account is active, then only as long as we need it for the purposes above or the law requires (for example payment and accounting records, usually several years).
• A clip's views are read at least every 2 days for 14 days after you submit it; on day 14 they are locked and we stop.
• The audience screenshot or recording is deleted from our server and storage 14 days after you submit it. Our team keeps a private copy of it, and of each campaign's approved clips, views and earnings, on its own computers.
• Chat pictures and videos: 30 days. IP and device records: 180 days. Refused general-chat lines: 120 days.
• Our database is backed up automatically. An encrypted copy is kept with our storage provider: one for each of the last 30 days and one for each of the last 12 months, then deleted. If you ask us to delete your data, we remove it from the live database and the copies our team holds within 30 days, and we keep a record that you were erased so it is removed again if a backup is restored. Copies at our storage provider are gone within 12 months. We may keep limited records we must keep by law or need to prevent fraud.

9. Your choices and rights

You can ask us to show you the personal information we hold about you, correct it, delete it, restrict or stop some uses, give it to you in a portable form, or take back a consent. Most of it is visible in your dashboard. To delete your data: Settings, "Ask us to delete my data". For anything else, write to our privacy contact at [email protected], or use Get help in your dashboard. We may need to check who you are first. We answer within 30 days (45 where the law gives us longer) and do not charge for a normal request. If we cannot do something, we tell you why. You can stop marketing messages at any time with the link in the message or by telling us; service messages that we must send (about your account or money) will still arrive. We send marketing email or text only with the consent the law requires (in Canada, CASL: clear consent, who we are, and a working unsubscribe that we honour within 10 business days). We do not buy lists.

10. Where your information is kept

Our providers may store and process information outside your country, including in Canada and the United States. Where required, we use safeguards such as standard contractual clauses (the EU's and the UK's addendum) or adequacy decisions. The laws of the country where it is kept apply to it there.

11. Notices for your region

Canada. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Quebec private sector privacy law (Law 25), including: named responsibility for personal information (our privacy contact at [email protected], or use Get help in your dashboard), consent for the purposes above, safeguards, openness, access, correction and challenge, and notice of breaches that create a real risk of significant harm. Your information may be processed outside Quebec and Canada (section 10). You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.

European Economic Area, United Kingdom and Switzerland. We are the controller of your information. We rely on: contract (to run your account and pay you), legitimate interests (fraud prevention, security, improving the Service, enforcing our terms, which we balance against your rights), legal obligation (tax, sanctions, legal requests) and consent (marketing, and sensitive choices you make, which you can withdraw). You have the rights of access, rectification, erasure, restriction, objection, portability and not to be subject to a decision based only on automated processing with legal effects (we make none), and the right to complain to your supervisory authority (in the UK, the ICO). Transfers outside the EEA, the UK or Switzerland use the safeguards in section 10. If the law requires a representative in your region, we will name one here. Where your country sets a higher age for consent by children, that age applies.

United States. Residents of California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws may ask us to confirm, access, correct, delete or obtain a copy of their personal information, and to opt out of sale, "sharing" for cross-context behavioural advertising, and targeted advertising. In the last 12 months we collected the categories in section 1 (identifiers, account and profile information, commercial information such as earnings, internet and device activity, an approximate location from your IP address, content you submit, and sensitive information only in the form of account log-in and payment details) for the purposes in section 2, and disclosed them to the recipients in section 3. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing the information of anyone under 16. We will not treat you worse for using your rights. To use a right, or to appeal a decision, write to us (section 9); we may verify your identity. You may use an authorised agent. We do not knowingly collect information from children under 13 (COPPA). Nevada residents: we do not sell covered information.

Asia-Pacific, Latin America, Africa, the Middle East and elsewhere. Where a law of your country gives you rights over your personal information (for example Australia's Privacy Act, Japan's APPI, Singapore's PDPA, South Korea's PIPA, India's DPDP Act, Brazil's LGPD), we handle your request under that law: write to us (section 9). Where your country requires a parent's consent for a child below a certain age (for example under 14 in South Korea and China, under 18 in India), that age applies to you and you must not use the Service without it. Where a law requires consent for sending your information abroad, we ask for it when you sign in or when the transfer happens.

12. Changes

We may update this policy. For important changes we tell you in the dashboard before they apply. The date at the top shows when it was last changed, and earlier versions are kept.

13. Contact

Our privacy contact is our privacy contact: [email protected]. You can also use Get help in your dashboard.