Privacy Policy
This policy explains what GunuAI collects, why, where it is kept and how you can delete it. It covers this website (gunuai.chiranjib.xyz) and the GunuAI self-hosted news box (the “box”), including its connections to YouTube, Instagram, X and Telegram. GunuAI is operated by Chiranjib, an individual developer in India (“we”, “us”).
1. What GunuAI is
GunuAI is software that reads public news feeds, writes a short script with an AI writer you choose, renders a vertical news video with a computer voice, and — only if you switch on auto-posting — uploads that video to the social accounts you connect. Today it is sold as a self-hosted box. A hosted “cloud” version is shown on this website as a preview only; it is not live and collects nothing. If it launches, this policy will be updated before it does.
2. This website
| Data | Why | Where / how long |
|---|---|---|
| Waitlist form: name and email address | To tell you when GunuAI is available. Nothing else. | Cloudflare D1 database. Kept until you ask us to delete it or we close the waitlist. |
| With a waitlist entry: a one-way hash of your IP address, your country (from Cloudflare) and the time | To stop spam (rate limit). We cannot turn the hash back into your IP address. | Same database, same period. |
| Standard request data (IP address, browser, pages requested) | Needed to deliver and protect the site. | Processed by our host, Cloudflare, under Cloudflare’s privacy policy. We do not run our own analytics. |
The website sets no cookies of its own and contains no third-party trackers, ad networks or analytics scripts. The “Open app” preview page uses demo data only; its sign-in form is disabled (not live yet) and does not collect passwords or payment details.
3. The GunuAI box
3.1 What stays on the box
- Your dashboard PIN (stored only as a scrypt hash, never in plain text) and a login cookie for the box’s own dashboard on your local network.
- The keys and tokens you add: AI writer key (DeepSeek or Groq), YouTube client ID/secret and refresh token, Instagram access token and account ID, X keys, Telegram bot token and channel, optional fal.ai key. They are encrypted on the box’s disk.
- Your brand settings (name, colours, logo, voice, language, topics, schedule), the videos the box makes, and a history of what was posted where.
We (GunuAI) cannot see any of this. The box does not send it to us. Backups you download are locked with a password you choose.
3.2 Where the box sends data, and why
| Destination | What is sent | When |
|---|---|---|
| Public news feeds (RSS) you selected | Normal web requests to read headlines | When making a video |
| Your AI writer (DeepSeek or Groq) | Public news text and writing instructions, with your own key | When writing a script |
| Microsoft Edge online voice (only if you pick an “edge” voice) | The script text | When recording the voice. The default Piper voice runs fully offline on the box. |
| fal.ai (optional, only with your own key) | A short picture description | Only if you enable AI pictures |
| YouTube, Instagram, X, Telegram (only those you connect) | The finished video, its title, description and hashtags | When you press “Post now” or auto-posting is on |
| GunuAI update server | A request for the latest version file (no account data) | Once a day, if updates are enabled |
4. YouTube and Google user data
GunuAI uses the YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google’s use of data is covered by the Google Privacy Policy.
- Permission requested:
https://www.googleapis.com/auth/youtube(“Manage your YouTube account”). The box signs in with Google’s device-code flow (you approve on google.com/device), and Google allows only this YouTube permission for that flow. - What the box does with it: (1) uploads the videos it made, with their title, description and tags, to your channel; (2) reads your channel’s name and ID when you connect or press Test, so the dashboard can show which channel is connected. It does not read, change or delete your other videos, comments, playlists, subscriptions or analytics.
- What is stored: the OAuth refresh token (encrypted, on the box only), the channel name/ID, and the IDs of videos the box uploaded. Nothing is stored by us.
- Sharing: Google user data is not sold, not shared with anyone, not used for advertising and not used to train AI models. It is sent only to Google’s own YouTube API to perform the upload you asked for.
- Limited Use: GunuAI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Revoking access: on the box, Connections → YouTube → Remove revokes the token at Google and deletes it and the stored channel details from the box immediately. You can also revoke GunuAI’s access at any time from your Google Account security settings: security.google.com/settings/security/permissions. When a token stops working the box stops posting to YouTube and asks you to connect again; you can remove the stale data with the Remove button or a factory reset.
5. Instagram (Meta) data
- Permissions:
instagram_business_basic(read your professional account’s ID and username to show which account is connected) andinstagram_business_content_publish(publish the Reels the box made to that account). - Stored on the box only: the access token (encrypted), your Instagram account ID and username, and the IDs of posts the box published.
- Not done: we do not read your followers, messages, comments, insights or other people’s data, and we do not share Instagram data with anyone.
- Deletion: see Data deletion instructions.
6. X and Telegram
For X you paste API keys from your own X developer account; for Telegram, a bot token and channel name. They are encrypted on the box and used only to post your videos. See X’s and Telegram’s own privacy policies for how they handle posted content.
7. What we never do
- We never sell or rent personal data, and never use it for advertising.
- We never ask for your Google, Instagram, X or Telegram password; you sign in on the platform’s own page.
- This website does not take payments and does not collect card details.
8. Security
Keys on the box are encrypted at rest; the dashboard is protected by your PIN and only reachable on your local network unless you expose it yourself. Updates are installed only if they carry GunuAI’s digital signature. No system is perfectly secure; please keep your PIN private and your box on a trusted network.
9. Your choices and rights
You can disconnect any platform, delete videos, download a backup or factory-reset the box at any time (Dashboard → Device). To access, correct or delete your waitlist entry, email us. We will reply within 30 days. Depending on where you live (for example under India’s Digital Personal Data Protection Act, 2023, or the GDPR) you may have further rights, including complaining to your data-protection authority.
10. Children
GunuAI is not directed at children under 18 and we do not knowingly collect their data.
11. Changes
We will post changes on this page and update the date at the top. Material changes for box owners will also be shown on the box dashboard.
12. Contact
Questions or complaints about privacy: web3youth@gmail.com. Operator: Chiranjib, India · chiranjib.xyz.