Skip to content
Carnero logo
◉Email Carnero

Privacy Policy

Privacy Policy

Last updated: 17 October 2026

1. Who we are

Carnero is a content engine for social networks. In this policy, “we” means Carnero. Contact: Erez Ashkenazi, Israel, ashkenazi.erez@gmail.com.

2. What this policy covers

  • This website, carnero.co.il.
  • The Carnero content engine: the system that plans, produces and publishes Carnero’s content to Carnero’s own accounts on YouTube, Instagram, Facebook and TikTok, through each platform’s official API. It is not offered as a public service, and no outside users sign in to it.

The Carnero mobile apps described on the Apps page are in development; each will get its own privacy terms before release.

3. This website

  • The website has no user accounts, no forms, no analytics and no advertising. It sets no cookies of its own and stores nothing in your browser.
  • Hosting. The site is served by Firebase Hosting (Google). Like any web host, it receives the technical details your browser sends with each request, such as your IP address, browser type and the page requested, in order to deliver the page.
  • Videos. On pages with videos, the preview pictures are loaded from YouTube’s image server (i.ytimg.com). The YouTube player itself loads only after you press play, from youtube-nocookie.com (YouTube’s privacy-enhanced mode). From then on, YouTube’s privacy policy applies to the player. Links marked “Watch on YouTube” take you to YouTube.
  • Email. If you write to us, we receive your email address and message in our mailbox (Gmail) and use them only to reply.

4. The Carnero content engine

4.1 Which accounts it connects

The engine connects only to Carnero’s own accounts:

  • Carnero’s YouTube channel;
  • Carnero’s Instagram professional account and the Facebook Page linked to it;
  • Carnero’s TikTok account. The TikTok connection is built and waits for TikTok’s app review; until then TikTok allows private posts only.

It does not connect to, or collect, other people’s accounts.

4.2 What it reads, and the permissions it asks for

YouTube (Google sign-in with OAuth). Permissions: view the YouTube account (youtube.readonly), upload videos (youtube.upload), and, when they are granted, manage playlists (youtube) and view YouTube Analytics reports (yt-analytics.readonly). It reads:

  • the channel’s id, title and status, and its playlists;
  • the processing status of each upload;
  • for each of Carnero’s videos: view, like and comment counts, and analytics totals such as watch time, average view duration, subscribers gained and lost, shares, traffic source types, the audience retention curve, and views by country (the ten countries with the most views).

Instagram and Facebook (Meta Graph API). Permissions: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, and for results instagram_manage_insights and read_insights. It reads:

  • the Page’s id and name, the Instagram account’s id and username, and the account’s publishing quota;
  • for each of Carnero’s Reels and Page videos: counts such as views, reach, plays, likes or reactions, comments, shares and saves, and watch time;
  • account totals: Instagram followers count and reach; Facebook Page follows and views.

TikTok (Login Kit and Content Posting API). Permissions: user.info.basic, video.publish, video.list. It reads the account’s open id and display name, and for each of Carnero’s videos its id, creation time, title, share link, and view, like, comment and share counts.

All of these are counts and totals about Carnero’s own videos and accounts. The engine does not request the text of comments, private messages, or lists of individual viewers or followers.

4.3 Why

To publish Carnero’s content to its accounts, and to measure how it performs so that the next content can be planned. We do not sell this data and do not use it for advertising.

4.4 Where it is stored

  • In Carnero’s own systems. The data is not shared with third parties, other than the platforms the content is published to and the AI services that create it (see section 5). This website has no database.
  • Backups. A backup is taken every night to Carnero’s own backup storage.

4.5 How access tokens and keys are protected

  • Sign-in tokens for the platforms, and the service keys saved in the engine, are stored encrypted (AES-256-GCM).
  • The encryption key is itself protected and is never stored in the database with the data it protects.
  • Google sign-in uses OAuth with PKCE.

4.6 How long it is kept

  • The engine keeps its data until it is deleted on purpose. It has no automatic deletion policy for account data or video results.
  • Video statistics are kept as a history: each measurement is a new record, and the engine’s database does not allow a measurement to be changed or removed.
  • When an account is disconnected, its tokens are marked as retired and are never used again; they stay in the database in encrypted form.
  • Database backups keep the newest seven nights; older nights are removed from the backup set. The backup copy of the engine’s files keeps every file it has copied.

4.7 Disconnecting and deletion

  • YouTube: disconnecting in the engine first revokes the engine’s access at Google, and only then marks the account as disconnected. Access can also be removed at any time from the Google Account’s list of third-party connections (myaccount.google.com/permissions).
  • Instagram and Facebook: disconnecting in the engine retires the token in the engine. To also revoke it at Meta, remove the app in Facebook’s settings under Business integrations.
  • TikTok: access can be removed in the TikTok app’s settings, in the list of apps connected to the account.
  • Requests: the engine holds data only about Carnero’s own accounts. If you believe it holds data about you, or you want data removed, write to ashkenazi.erez@gmail.com. We will tell you what is held and remove what can be removed; records kept as unchangeable history are removed manually.

5. AI services

To make videos, the engine sends prompts, scripts, texts to be spoken and pictures to be checked to AI services (MiniMax, ElevenLabs, Google Gemini and Lyria, and OpenAI). See How it works.

6. Children

This website is not directed at children and collects no personal data from its visitors.

7. Changes

When this policy changes, the date at the top changes with it.

8. Contact

Erez Ashkenazi, Israel · ashkenazi.erez@gmail.com