This Privacy Policy describes how Social Growth Tool (the “Service”), operated by Crescendo Lab Inc. (“Crescendo Lab”, “we”), collects, uses, and protects your personal data. This is an app-specific supplement to the general Crescendo Lab Privacy Policy; both apply.
本隱私政策說明 Social Growth Tool（以下簡稱「本服務」）如何蒐集、使用、保護你的個人資料。 本頁為本 app 專屬補充版本，連同 Crescendo Lab 通用隱私政策 共同適用。
Account profile (from Google sign-in):
- Your Google email address
- Your display name (as provided by Google)
- A Firebase user ID we generate for you
Threads account credentials (when you OAuth a Threads account):
- Threads access token (long-lived, ~60-day TTL), encrypted at rest
- Your Threads user ID and username
- Display name as provided by Threads
- The granted OAuth scopes (e.g., publish, read replies, insights)
Notion integration credentials (only if you connect a Notion brand library — optional):
- Your Notion API integration token (you paste it in the setup wizard, stored encrypted)
- The database ID + the filter property + filter value you chose
- Workspace name (display only)
Content you create or save in the Service:
- Drafts you generate, edit, and save (“saved cards”)
- Scheduled drafts and their delivery status
- Items in your “idea inbox”
- In-app notifications addressed to you
Threads engagement data (read on demand, not stored permanently):
- Insights on your own posts — views, likes, replies, reposts, quotes, performance score (Posted page)
- Replies on your own posts — text, username, timestamp of each reply you receive (Replies page)
- Public posts via keyword search — when you use the Radar (海巡) feature, results from the Threads keyword search API are shown to you in real time; we do not store the results beyond the current session
AI processing input (sent to Google Gemini, not persistently stored on our side):
- Prompts and drafts you submit for AI generation
- Viral posts you submit to the Decode (拆解爆文) feature
- Reply targets you submit for AI reply drafting
- Audio files you upload for transcription
Operational data:
- Per-user rate-limit counters (hourly/daily, used to prevent abuse)
- Server access logs (IP, request path, status code) for ~30 days
We do not collect passwords (sign-in goes through Google), payment information, or precise geolocation.
- Authentication: Google sign-in via Firebase Auth.
- Publishing (Draft + Schedule): when you click “publish”, we use your stored Threads token to post on your behalf via the official Threads Graph API. Scheduled posts are stored in our database and published at the scheduled time by an internal cron job.
- Reading your Threads insights (Posted page): we call the Threads API to fetch views / likes / replies / reposts on your own posts so you can analyze performance.
- Reading replies on your own posts (Replies page): we call the Threads API to list replies on your own posts so you can read them and compose AI-assisted reply drafts.
- Keyword Search (Radar / 海巡): when you enter a keyword in the Radar feature, we query the Threads Graph API (keyword_search endpoint) to find public Threads posts matching your query. Results are shown only to you and are not stored permanently; only the search query and the post IDs you choose to act on may be temporarily cached.
- AI suggestions (Draft / Decode / Lego suggest / Reply drafts): text you enter (your prompts, drafts you ask AI to edit, viral posts you ask AI to decode, replies you ask AI to draft) is sent to Google Gemini for processing. Gemini returns drafts which we display to you. We do not use your input to train any model — Gemini API calls are single-purpose inference.
- Audio transcription: if you upload an audio file in the Draft page, it is sent to Google Gemini multimodal for transcription and then discarded after transcription completes. We do not retain the audio file.
- Notion integration (optional): if you connect a Notion workspace via Settings, you choose onedatabase and a filter (e.g., a multi-select tag value). We then read each matching page’s title and body content to provide AI with your brand assets as reference material. We store your Notion integration token encrypted in Firestore and use it only on your behalf. We do not write to your Notion workspace, and you can disconnect at any time.
- Rate-limit enforcement: to keep the Service available for everyone, we track per-user request counts.
We share data with the following processors strictly to operate the Service:
- Google Cloud / Firebase (Authentication, Firestore, Cloud Run, Cloud Storage, Secret Manager) — hosts the app and stores your data. Firebase privacy.
- Google Gemini API — processes your text input for AI suggestions. See Gemini API terms.
- Meta / Threads Graph API — we call it on your behalf when you publish, read insights, or fetch replies.
We do not sell your data, share it with advertisers, or use it for behavioral profiling beyond what is required to operate the Service.
- Account data + saved content: retained as long as your account is active.
- OAuth tokens: kept while your Threads account is connected. Auto-refreshed before expiry. Deleted when you disconnect.
- Rate-limit counters: rolling 24-hour window; expire automatically.
- On account deletion request: all data is permanently deleted within 30 days. See /data-deletion.
Under applicable law (including Taiwan PDPA and GDPR for EU/EEA residents), you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your data (see /data-deletion)
- Restrict or object to certain processing
- Withdraw consent at any time (sign out + disconnect Threads)
- Data portability: request an export of your saved drafts
To exercise any of these, email globalmarketing@cresclab.com. We respond within 5 business days.
- All traffic is encrypted in transit (HTTPS / TLS 1.2+).
- OAuth access tokens are stored in Firestore with security rules that deny client-side reads; only our backend service account can read them.
- Per-user rate limiting and global budget caps protect against abuse.
- We follow the principle of least privilege for all internal access.
Despite our efforts, no system is 100% secure. If you suspect a breach affecting your data, email us immediately.
Our infrastructure is hosted in Taiwan (asia-east1). Some Google services (Gemini, Firebase Auth) may process data in other Google Cloud regions. By using the Service you consent to such transfers, which are protected by Google’s standard contractual clauses.
The Service is intended for users 18 years and older. We do not knowingly collect data from minors. If you believe a minor has provided data, contact us and we will delete it.
We may update this policy. Material changes will be announced in the app and / or via email. The “last updated” date below indicates when it last changed.
Privacy questions or requests: globalmarketing@cresclab.com
Mailing address: Crescendo Lab Inc., 5F, No. 156, Jiankang Rd., Songshan Dist., Taipei City 10586, Taiwan