Nucleo OS Privacy Policy

Last updated: May 20, 2026

NúcleoOS is a social media automation and business operations platform developed by Gabriel Simone. This policy explains what data we collect, how we use it, where we store it, and your rights over it.

1. Who We Are

NúcleoOS ("the Platform", "we", "us") is developed and operated by Gabriel Simone, an individual operator based in Argentina. Contact: gabisimonenqn@gmail.com. The Platform is accessible at nucleo-os.com.

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

Email address — used for account identification and communication
Username — your unique identifier within the Platform
Password — stored exclusively as a salted PBKDF2-SHA256 hash; your plaintext password is never stored or logged
Account creation date and last login timestamp

2.2 Connected Platform Credentials

When you connect a social media account via OAuth, we store:

OAuth access tokens and refresh tokens for TikTok, Meta (Instagram/Facebook/Threads), X (Twitter), YouTube, and Google — used exclusively to publish content and read basic account info on your behalf
Platform user IDs and usernames (e.g., TikTok open_id, Instagram user ID, Threads user ID, X user ID) — used to route API calls to the correct account
Token expiry dates — used to refresh credentials proactively before they expire
Basic profile information (display name, avatar URL) — used only during the OAuth confirmation flow and stored for display purposes in the Platform UI

2.3 Content and Scheduling Data

Post metadata: title, description, scheduled time, platform targets, post IDs returned by platforms after publishing — stored in Google Sheets controlled by the Platform operator
Video files: temporarily staged in Cloudflare R2 during the publishing process; automatically deleted after the publishing job completes
AI-generated content: scripts, captions, and story prompts generated by Claude (Anthropic) and Gemini (Google) at your request — stored in Google Sheets for your reference

2.4 Business Operations Data

CRM data: client contact information, lead status, and communication history — entered by you and stored in Google Sheets
Contract data: contract content and signature records processed via Documenso
Payment records: transaction IDs and amounts from MercadoPago or Stripe; we do not store full card numbers or sensitive payment data (handled directly by the payment processor)
Appointment data: scheduling information from connected calendar providers

3. How We Use Your Data

To authenticate you and maintain your session securely
To publish content to connected social media accounts on your behalf, as explicitly scheduled by you
To generate AI-assisted content (scripts, captions, images) at your request
To display analytics and insights from your connected accounts
To process payments and manage contracts for your business
To send transactional communications (appointment confirmations, contract notifications)

We do not use your data for advertising, do not sell it to third parties, and do not use platform data accessed via OAuth for any purpose beyond delivering the features you explicitly use.

4. Data Storage

Data type	Storage location	Retention
Account credentials (email, username, password hash)	PostgreSQL database (Fly.io, encrypted at rest)	Until account deletion
OAuth tokens (TikTok, Meta including Threads, X, YouTube, Google)	Encrypted secrets in server infrastructure (Fly.io)	Until revoked or account deletion
Scheduling and post metadata	Google Sheets (operator-controlled)	Indefinite (your historical record)
Video files (staging)	Cloudflare R2 (temporary)	Deleted automatically after publishing
AI-generated scripts and captions	Google Sheets (operator-controlled)	Indefinite (your reference)
CRM, contract, and payment data	Google Sheets / Documenso / payment processors	As required by applicable law
Session cookies	Your browser (HMAC-signed, HttpOnly, Secure)	2 years or until logout

5. Third-Party Services

NúcleoOS integrates with the following third-party services, each governed by their own privacy policies:

Service	Purpose	Data shared
TikTok API	Video publishing	Access tokens, video files, post metadata
Meta Graph API (Instagram, Facebook)	Video/post publishing	Access tokens, video files, post metadata
YouTube Data API (Google)	Video publishing	Access tokens, video files, post metadata
Google Drive API	Source file retrieval	File IDs and content of your own Drive files
Google Sheets API	Data storage and scheduling	All structured data listed in section 2
Cloudflare R2	Temporary video staging	Video file content (deleted post-publish)
Anthropic Claude API	AI content generation (scripts, captions)	Prompts and content descriptions you provide
Google Gemini API	AI image generation (Stories)	Image prompts you provide
OpenAI API	Transcription (Whisper) and image generation	Audio/video content for transcription; image prompts
Apify	Competitor content research	Public social media URLs you submit for analysis
MercadoPago	Payment processing (LATAM)	Transaction metadata; payment details handled by MercadoPago directly
Stripe	Payment processing (international)	Transaction metadata; payment details handled by Stripe directly
Documenso	Digital contracts	Contract content and signatory information
ManyChat	WhatsApp automation and lead scoring	Lead tags and message counts from your ManyChat account
Discord	Internal notifications	System event notifications (no personal user data)
Fly.io	Application hosting	Server infrastructure; all data in transit is encrypted
Cloudflare	DNS, CDN, and Workers (routing)	IP addresses and request metadata per Cloudflare's privacy policy

6. Cookies and Sessions

NúcleoOS uses a single session cookie named session after you log in. It is:

Cryptographically signed (HMAC-SHA256) — it cannot be forged or tampered with
HttpOnly — not accessible to JavaScript
Secure — transmitted only over HTTPS
Valid for 2 years, or until you log out

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

7. Data Sharing

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes. Data is shared with third-party services solely to the extent necessary to deliver the features described in this policy (see section 5).

8. Security

Passwords are hashed using PBKDF2-SHA256 with a unique random salt per user (100,000 iterations)
Session tokens are HMAC-signed and validated on every request
OAuth tokens are stored as encrypted secrets in server infrastructure (Fly.io) and are never written to external spreadsheets or logs
All communications use HTTPS/TLS encryption in transit
No sensitive credentials are written to logs or exposed in error messages

9. Your Rights

Access: You may request a copy of the data we hold about you
Correction: You may update your username and password from Account Settings; contact us for other corrections
Deletion: You may request deletion of your account and all associated data at any time
Revocation: You may revoke the Platform's access to any connected social media account at any time from that platform's app permissions settings
Portability: Contact us to receive an export of your data

To exercise any of these rights, contact gabisimonenqn@gmail.com.

Data Deletion Instructions

You can remove the Platform's access to your connected social media accounts (Facebook, Instagram, Threads, X, YouTube, TikTok) and delete the associated stored credentials yourself, at any time, without contacting us:

Log in to NúcleoOS and go to nucleo-os.com/webhook/credenciales.
Click "Desconectar" next to the platform you want to remove.
This immediately deletes the stored access tokens and account identifiers for that platform from our database.

You can also revoke access directly from the source platform at any time: on Facebook/Instagram, go to Settings & Privacy → Apps and Websites and remove NúcleoOS; on Google/YouTube, go to myaccount.google.com/permissions and remove access.

To request full deletion of your account and all associated data (not only social media credentials), email gabisimonenqn@gmail.com from the email address associated with your account. We will confirm deletion within a reasonable timeframe.

10. Data Retention

Account data is retained until you request deletion. OAuth tokens are deleted upon account deletion or when you revoke access. Temporary files (video staging in R2) are deleted automatically after each publishing job. We retain scheduling history and CRM data for as long as your account is active, as this represents your operational records.

11. Children's Privacy

NúcleoOS is not directed at individuals under 18 years of age. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this policy as the Platform adds new features or as legal requirements evolve. The current version is always available at this URL. Significant changes will be communicated to active users.

Threads and X (Twitter)

When you connect a Threads or X account, we request only the permissions needed to publish the posts you write yourself:

Threads (Meta): threads_basic to identify the connected profile, and threads_content_publish to publish the text and images you schedule. We store your Threads user ID, username and access token. Threads access tokens are valid for 60 days and are refreshed automatically while the connection is active.
X (Twitter): tweet.write to publish, media.write to attach the images you upload, users.read to show which account is connected, and offline.access to keep the connection working without asking you to log in again. We store your X user ID, username, access token and refresh token. X access tokens expire every 2 hours and are refreshed automatically.

We do not read your timeline, your followers, your direct messages, or any content posted by other people. We do not collect, store or analyse data about other users of those platforms. The only content we publish is content you write and schedule yourself.

You can disconnect either account at any time from the Credentials page: this deletes the stored tokens and identifiers immediately. Revoking access from Threads or X directly also works — Meta notifies us and we delete the stored data automatically.

13. Contact

For any privacy-related questions or requests:
Gabriel Simone
Email: gabisimonenqn@gmail.com
Platform: nucleo-os.com