Privacy at Recast
Photos you choose
Recast uses only the photos you select. Drafts are stored on your device. Photos saved to your influencer library and videos you upload are also stored privately on the Recast server so you can reuse them. When you tap Create and allow AI processing, selected photos, the source video and your editing instructions pass through the Recast server to the AI provider named in the consent screen. The currently configured provider is Higgsfield. Other supported providers are fal.ai and Magic Hour; a change requires your permission before the next generation.
Account and purchases
For email accounts we store your email address, a one-way password hash, email-verification status and hashed verification/reset tokens. Our email-delivery service, Resend, receives your email address and the verification or reset message when you request one. We never store plaintext passwords. We also store a random account identifier, a hashed session credential, credit balance, purchase transaction identifiers and render history to deliver the service and prevent duplicate charges. Apple processes iOS payments and Stripe processes web payments. We store Stripe customer, checkout and subscription identifiers and verified payment events to manage billing and credit balances. Stripe receives the contact and payment details you enter in its hosted checkout; Recast does not receive full payment card details. Recovery keys are stored only as hashes. The browser uses a necessary secure session cookie and local storage for your drafts and preferences.
YouTube Shorts publishing
Recast uses YouTube API Services. When you connect your channel, we request permission to upload videos and read your YouTube channel and video status. We store the channel identifier, display name and encrypted access and refresh tokens privately on our server. We use this access only to identify the channel, refresh your connection, upload a finished video with the title, description, visibility, audience and disclosures you explicitly approve, and check processing status. We store approval time, posting status and the resulting video link. Scheduled uploads start at the time you approve; YouTube processing follows. Disconnecting in Publish removes the stored connection, cancels uploads that have not started and attempts to revoke Google access. It does not delete videos already uploaded; manage these in YouTube Studio. Account deletion removes stored connection and posting records. You can revoke access at any time through Google Account connections. Recast’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. See Google’s Privacy Policy and YouTube’s Terms of Service. We do not sell Google user data, use it for advertising or use it to train AI models.
TikTok publishing
When enabled for your account, connecting TikTok allows Recast to store your TikTok account identifier, username and encrypted access and refresh tokens privately on the server. We use this access to retrieve the creator settings needed for the posting screen, refresh the connection, send only finished videos and captions you explicitly approve at your selected time, and check publication status. Each approved post records its audience, interactions, commercial disclosure, AI label and consent time. TikTok receives the approved video through a signed, temporary Recast media-delivery link. Disconnecting cancels posts that have not been sent, deletes stored connection tokens and attempts to revoke access at TikTok. Videos already sent or published must be managed on TikTok; disconnecting does not promise their removal. Account deletion removes the stored connection and posting records.
X publishing
Connecting X lets Recast store your account identifier, username and encrypted access and refresh tokens on its server. We request profile access, posting and media-upload permissions, and permission to keep the connection active. We use them only to identify your connected account, refresh access and publish finished videos and captions you explicitly approve, at your chosen time. X receives the approved video and caption and an AI-generated-content disclosure. Recast retains approval time, account, posting status and the resulting post link. Disconnecting deletes stored tokens, cancels waiting posts and attempts to revoke access at X. Already published posts remain on X and can be managed there. Account deletion removes your stored X connection and posting records. You may also revoke Recast in X’s connected-app settings.
Storage
Recast stores your saved influencer references, uploaded source videos, generated portraits, finished videos and job records. The processing provider receives the inputs you authorize for each creation. These remain until account deletion or a support deletion request; there is no automatic expiry promise in this release. Provider copies follow that provider’s policies. Revoking AI permission stops future sharing, not copies already processed.
Sharing and tracking
When Instagram and Facebook publishing is activated for your account, you may connect an Instagram professional account or a Facebook Page. Recast stores its account identifier, username, granted publishing access and encrypted access token on the server. We use that access to send only videos and captions you explicitly approve, immediately or at your scheduled time, and to retrieve publication status and links. Instagram tokens are refreshed while connected; reconnecting may be required if access expires or is revoked. Disconnect Instagram and Facebook in Publish to delete the stored connection and cancel waiting posts. This does not remove Reels already published on Instagram and Facebook. Account deletion removes stored connections and posting records. You can also revoke Recast access through Instagram and Facebook settings. During platform review, connections are limited to designated testers. You can still choose to export a video manually. We do not use advertising trackers or sell your photos. Our hosting provider processes network addresses to operate and protect the service. Application access logs are disabled so signed video links are not recorded there.
Your controls
Use your verified email and password to sign in on the web; reset your password through the sign-in page. Older accounts and iPhone accounts can retain private recovery codes. Settings → Account & recovery on iPhone supports account deletion; web users can request deletion at will@delprincipe.org. Deletion removes the account, credits, saved influencer references, uploaded videos and server results. Clear local browser storage to remove device-only drafts. Deletion waits for active renders to finish. Purchase identifiers and cost reservations are retained without the account link to prevent transaction replay and duplicate charges. Restore codes do not transfer photo drafts. Never send a recovery code to support.
Contact
Recast AI is operated by William Del Principe. Contact will@delprincipe.org for questions, corrections or data requests. Include your account identifier if relevant, but never passwords, API keys or recovery codes. Effective October 7, 2026.
Recast AI · October 7, 2026 · will@delprincipe.org
Referrals and creator earnings
Recast records referral attribution, verified payment references, commission adjustments, creator submission permissions, payout requests and owner review actions. Financial records may be retained for accounting and dispute resolution after account closure. Stripe collects bank and identity details directly; Recast stores your connected account identifier and payout status, not your bank login or full bank details. Referral attribution uses local browser storage for up to 30 days. Contact will@delprincipe.org about these records.