Privacy Policy

Who we are

MyCreatorPulse records daily analytics snapshots for content creators across the platforms they publish on. This policy explains what we store and what we do with it.

MyCreatorPulse is run by Pang Jun Han in Malaysia.

What we store

Your account: the name, email address and password on your account. Passwords are stored hashed and are never readable by us.

Your invite request: when you ask for an invite, the name, email, WhatsApp number (if you give one), handles, platforms and note you send us, so we can set up your account and reply. If you came through a friend’s link, we also note which friend, so we can thank them.

“See your own numbers” on the homepage: the username you type and that account’s public numbers (followers and its latest posts’ views, likes and comments), kept for up to two days so the same look isn’t read twice, then deleted. It isn’t linked to you or saved to any account. To stop anyone using it too much, we keep a short scrambled code made from your internet address (not the address itself) for up to two days.

A launch reminder: if you ask us to tell you when sign-ups open, your email address, kept only until that one email is sent. It isn’t used for anything else.

Your connected platforms: for each platform you connect, the handle, display name, profile picture URL and the platform’s own account identifier.

Your published posts: titles, captions, publish dates, thumbnails and links for your most recent posts.

What you write in: the rates you add to your brand kit, and any feedback you send us. Your rates are shown only to you (and to an agency whose roster you have joined) and on the PDFs you download. If you ask about an agency plan, we keep your name, agency, email and WhatsApp number so we can reply.

A DuitNow receipt: if you pay by DuitNow, the receipt image you attach, stored privately (only we can open it) and emailed to us so we can check the payment. Receipts are kept as a record of your payment, including after you delete your account, because payment records have to be kept.

WhatsApp from Jun: if you say yes to “Can Jun WhatsApp you?”, we keep your WhatsApp number so our founder can message you from his own phone to say hi and ask how it’s going. Nothing else uses it. Switch it off in Settings and the number is removed.

Your sign-ins: each time you sign in, we keep the internet (IP) address and the device and browser you signed in from. We use them to show “Signed in elsewhere” in Settings and to spot sign-ins that aren’t you. They’re removed when you sign out, when that sign-in runs out (after 30 days), or when you delete your account.

Keeping our forms usable: when you send the sign-up, invite or reminder form, we keep a short scrambled code made from your internet address (for this, not the address itself) for up to two days, so one connection can’t flood the forms for everyone else.

Problem reports: if you use “Report a problem”, we keep what you wrote, the page you were on and your browser’s name and version (its “user agent”), and email them to us so we can fix it and reply.

Beta check-ins: if you answer a check-in in your dashboard, we keep your answers (your 0–10 rating, what we could do better, whether you’d stay) and email them to us. If you send a quote about MyCreatorPulse, we keep it and whether you said we can use it. A quote only goes on the site with your OK. Ask us any time and we’ll delete your reports, answers and quotes, and they’re deleted with your account if you delete it.

Daily statistics: a snapshot of each post’s views, likes, comments and shares, and your follower count (on Douyin and Xiaohongshu also your profile’s total likes), taken once per day. This archive is the point of the product — platforms only show you today’s number, so historical comparison is only possible from snapshots we keep.

Platform by platform

YouTube. We read public channel data (subscriber count, total views, and the title, publish date, thumbnail, views, likes and comments of your recent videos) through the YouTube Data API. No login or token is involved. MyCreatorPulse uses YouTube API Services; by connecting a channel you also agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.

Twitch (not switched on yet). When it is, we will read public channel and video data — follower count, video titles, dates and view counts — through Twitch’s official API. No login is involved.

Instagram, TikTok, Facebook Pages, Douyin and Xiaohongshu. For these platforms you give us a username or profile link, and we read what any logged-out visitor to that public profile can already see: the display name, profile picture, follower count (and on Douyin and Xiaohongshu the profile’s total likes), and the caption, date, link, cover image, views, likes, comments and shares of up to 30 of your public posts per platform (the most recent, with pinned posts counted in on Instagram and TikTok). No login, token or password is involved, and we never see anything private — if a profile is private, nothing can be read and we tell you so.

These public-profile reads are carried out for us by two data processors acting on our instructions: ScrapeCreators for Instagram and TikTok, and Apify (Apify Technologies s.r.o., Prague, Czech Republic) for the other platforms and as a backup for Instagram and TikTok. They receive the handle we ask them to read and return the public figures; they do not receive your MyCreatorPulse account details. Reading public profile pages automatically may not be permitted by every platform’s own terms, and platforms change how public data is presented; figures from these platforms are therefore best-effort and may be delayed or missing on a given day (see the Terms).

Signing in on a platform (optional, currently switched off). MyCreatorPulse can also connect Instagram, TikTok and Facebook through their official sign-in, which reads richer analytics with your explicit permission. This option is not offered at the moment. If we switch it on, it will be your choice per platform, the consent screen will list the exact permissions, and the “Access tokens” section below applies.

Access tokens

This section applies only if you choose the platform sign-in option described above, which is currently switched off. When you connect Instagram, TikTok or Facebook that way, the platform gives us an access token on your behalf. We store it encrypted (AES-256-GCM) and use it only to read your own analytics once a day and when you press Sync. We never receive your password. We cannot post, edit, delete, message or follow anyone from your account, and we do not request permission to do so. We never share tokens with anyone.

What we do with it

We use your data to show you your own analytics, and to email you about your account (payments, reminders, and anything that needs your attention). When we send a daily email with your numbers, you can switch it off in Settings or from the link at the bottom of any of those emails. We do not sell your data. We do not share it with advertisers. We do not use it to train machine learning models. Other users of MyCreatorPulse cannot see your numbers — every query is scoped to the account that owns the data — unless you accept an agency’s invitation, as below.

Agencies. A talent agency or manager on an agency plan can ask to add you to their roster. Nothing is shared until you press Accept. While you’re on their roster they can see your numbers, posts, rate card and monthly report; they cannot see your email settings or billing, and cannot change your platforms, settings or password. You can leave their roster at any time in Settings, and their access ends straight away. Reports or rate cards they downloaded before then stay with them.

We measure how the website is used with Vercel Analytics, which counts page views without cookies and without identifying individual visitors.

We also count visitors ourselves, without cookies: once a day per browser, we keep a short scrambled code made from your internet address and browser (not the address itself), which page you opened, which site sent you (just its name) and which of our links you tapped, if any, and delete it after 30 days. To count each browser once a day, your browser keeps the date it was last counted, and the story link you came through, if any, in its own storage (localStorage, not a cookie).

When you request an invite, the form also tells us which page of our site you first opened and which website sent you there (just the site’s name, like google.com), so we know which pages help creators find us. That is remembered in your own browser only, is sent only with the form, and is never shared. We also count how many times the demo is opened each day, without knowing who opened it.

How long we keep it

Snapshots are kept for as long as your account is open, because the value of the archive is its length. Data fetched from a platform API is refreshed daily; we do not keep stale copies of your profile beyond the latest fetch, only the numeric daily statistics. Disconnect a platform and we delete that platform’s posts, snapshots and access token immediately. Delete your account and we remove everything, including the archive (payment records such as DuitNow receipts aside, as above; problem reports and check-in answers go when you ask us). Neither is recoverable — no platform lets anyone backfill past view counts, so a deleted archive is gone for good.

Your choices

You can disconnect any platform, or delete your entire account, from your dashboard at any time — no email needed. Because we read only public profiles and hold no app permission on your platforms, removing an app in a platform’s own settings doesn’t stop our reads: disconnect the platform here, or delete your account. Step-by-step instructions are on the data deletion page. To request a copy of your data, email the address below.

Where data is held

Data is stored in a hosted PostgreSQL database (Neon, Singapore region) and served from hosting infrastructure (Vercel) that may process it outside your country of residence. Public-profile reads are performed by ScrapeCreators (Instagram, TikTok) and Apify (Czech Republic). A private backup of the database — account details, invite requests, billing records and daily statistics, never passwords or tokens — is written nightly to Vercel’s storage and kept for 14 days, so a deleted account can remain in a backup for up to 14 days before it ages out. DuitNow receipts are kept in the same private storage. Emails are sent through Resend. If you choose to subscribe through PayPal, the payment itself is handled by PayPal under its own privacy policy; we receive the subscription’s status and payment dates, never your card or bank details. Our hosting also keeps server logs, which can include internet addresses; these are deleted within 30 days. Access to production data is limited to the operator. We use reputable providers who maintain their own security practices, and access is restricted to what is needed to operate the service.

Changes

If we change what we collect or how we use it, we will update this page and the date at the top. Material changes will be notified by email.