1. Scope and project status
This draft describes the TruInfluence mobile application and this public website based on the repository implementation reviewed October 19, 2026. TruInfluence connects creators and businesses for collaboration opportunities. The website provides information and legal drafts; it does not offer account registration or connect social accounts.
TODO — Owner review: identify the service operator, its legal identity if applicable, a working privacy contact, applicable territories, and an effective date. This draft is not an approved or effective privacy notice.
2. Account and profile information
Mobile account creation requests an email address and password through Supabase Auth, a display name, and an account type. Creator profiles include a niche and general location region. Business profiles include a business name, industry, city, state, and optional website. Profile records may include an avatar URL and other editable profile information.
Profile and discovery information is shown within authenticated app experiences. Creator discovery uses a broad region rather than a map of creator home coordinates. Opportunities may include business or campaign coordinates, city, state, category, platform requirements, and proposed compensation. This public website does not publish mobile user profiles.
4. Imported statistics, content, and their use
With permission, the creator-facing YouTube view retrieves channel identity and avatar, subscriber count, lifetime views, video count, recent video titles, thumbnails, publication dates, views, likes, and comments. It also requests a 28-day analytics report including views, watch time, average viewing duration and percentage, likes, comments, shares, and subscriber movement. Values may be unavailable, rounded, or delayed by the provider.
These insights help creators understand their channel and assess collaboration context. The current implementation displays detailed YouTube insights in the connected creator’s own profile; it does not establish a business-facing analytics view. A sanitized provider-avatar projection can supply profile imagery to other app users. Do not assume that every imported statistic is visible to businesses.
TODO — Owner review: confirm deployed behavior, any metric caching, provider-avatar storage, third-party display permissions, and the exact user-visible sharing controls before publication.
5. TikTok — planned integration
TikTok integration is in development and is not currently available in the inspected repository. TruInfluence does not presently claim to retrieve TikTok account data through an implemented integration.
If TikTok access is introduced, users must authorize it through TikTok. TruInfluence will request only permissions approved for the integration and use those permissions to retrieve the account information authorized by the user. Exact scopes, profile fields, statistics, content access, storage, sharing, and deletion behavior must be documented before enabling the feature. Private TikTok OAuth credentials must remain separate from user-visible profile data.
TODO — Owner review before TikTok launch: specify the approved permissions and data fields, intended uses, recipients, retention, revocation and deletion procedures, and update this notice to match the deployed integration.
6. Applications, collaborations, messages, and reviews
The app stores opportunity details, applications and their statuses, collaboration participants and status history, and completion information. Application-linked conversations store message bodies, sender identifiers, and timestamps, with participant-based access. Read-state information supports unread messaging indicators. Messages are not public profile content; this draft makes no claim of end-to-end encryption.
Ratings and written reviews are associated with completed collaborations and may appear to other authenticated users. Review visibility follows the app’s anti-retaliation rules: a reviewed participant may not see a counterpart review or its contribution to their rating until submitting a reciprocal review, while other eligible users can see it. Reports and cancellation-related records may be processed where the app provides those controls.
Use this information to evaluate partners, communicate about an opportunity, manage collaboration progress, and provide reputation context. Do not include unnecessary sensitive information in messages or profile fields.
7. Service providers and external services
Supabase provides mobile authentication, PostgreSQL data storage, database access controls, and Edge Functions for server-side integration requests. Google/YouTube handles YouTube authorization and data requests. Provider-hosted images may make requests to their image services when displayed. External links are governed by the destination’s own policies.
The static website has no configured advertising, analytics SDK, account system, or Supabase connection. It stores an appearance preference in browser local storage when available. A website hosting provider may process request metadata such as IP addresses and browser information under its own policies; GitHub Pages is the prepared hosting option and has not been deployed by this change.
TODO — Owner review: verify the actual hosting provider, infrastructure regions, subprocessors, international transfers, server logging, and any future analytics or cookies.
8. Security and access
The repository uses authenticated access and PostgreSQL row-level security for app records, and server-side functions for private OAuth operations. These controls are intended to limit access according to roles and participation. They do not establish a guarantee that data can never be accessed improperly. Hosted configuration and policies must be verified separately.
This notice does not claim a security certification, custom at-rest encryption, a comprehensive audit, or end-to-end encrypted messaging. TODO — Owner review: confirm production security measures, operational access, backups, and incident-response procedures.
9. Disconnecting accounts, retention, and deletion
The inspected YouTube UI supports connection and reconnection; it does not implement an in-app disconnect or full account-deletion workflow. You can withdraw Google/YouTube access through your Google account’s third-party connection settings. Revoking provider access does not by itself establish deletion of TruInfluence profile records, connection records, messages, or previously stored data.
No comprehensive retention schedule, automated erasure process, or confirmed deletion response timeline was found. Database relationships contain some deletion rules, but these do not constitute a complete user-facing deletion service. This draft does not promise immediate removal or a particular retention period.
TODO — Required before publication: provide a monitored contact and a practical process for access, correction, export where applicable, account disconnection, token removal, and deletion requests. Define retention by data category, handling of conversation/review records, backups, provider data, and legal obligations.
10. Eligibility, choices, and privacy requests
You may edit supported profile fields and choose whether to authorize a social connection. Provider permissions can be managed with the provider. Rights and available request processes may depend on where you live; this draft does not establish an unimplemented request mechanism.
TODO — Owner review: define minimum age and any handling of children’s information, applicable privacy rights, identity checks for requests, appeal procedures if required, and a monitored privacy contact. Do not submit privacy requests through this informational website; no request form is implemented.
11. Contact and policy updates
TODO — Required: replace this paragraph with a real operator name and monitored privacy contact. No business address or email has been invented.
Material changes should be reflected here before new processing begins, with a reviewed effective date and appropriate user notification. TODO — Owner review: define how mobile users will be notified and keep a policy revision history.