Privacy Policy
Last updated: 7 May 2026Lucky Team (luckyteam.space)
1. Overview
This Privacy Policy explains how Lucky Team ("we", "us") collects, uses, and protects information when you use the platform at luckyteam.space. Lucky Team is a private workflow platform for content creators producing short-form video content for connected social media accounts.
2. Information We Collect
Account information: name, login, password (hashed), Telegram chat ID for bot notifications, role, registration date.
Activity data: tasks taken, videos uploaded, status changes, in-platform messages with curators, payout history.
Connected platform tokens: OAuth access and refresh tokens for connected services (YouTube, TikTok, Instagram). Stored encrypted at rest. Used only to publish approved content on your behalf.
Analytics from connected platforms: view counts, engagement metrics, and revenue data fetched via official APIs (YouTube Analytics, TikTok Insights). Used for internal performance tracking.
Technical data: IP address, user agent, request timestamps for security audit logs.
Activity data: tasks taken, videos uploaded, status changes, in-platform messages with curators, payout history.
Connected platform tokens: OAuth access and refresh tokens for connected services (YouTube, TikTok, Instagram). Stored encrypted at rest. Used only to publish approved content on your behalf.
Analytics from connected platforms: view counts, engagement metrics, and revenue data fetched via official APIs (YouTube Analytics, TikTok Insights). Used for internal performance tracking.
Technical data: IP address, user agent, request timestamps for security audit logs.
3. How We Use Information
- Operate the workflow platform (assign tasks, review submissions, process payouts)
- Publish approved content to connected social media accounts via official APIs
- Send notifications about tasks, status changes, payouts via Telegram bot
- Calculate performance metrics and team-wide statistics
- Detect and prevent abuse, unauthorized access, or platform misuse
- Comply with legal obligations
4. Information Sharing
We do not sell or rent your personal data. We share data only:
- With connected social media platforms (YouTube, TikTok, Instagram, Telegram) as required to deliver the service
- With our infrastructure providers (Neon Postgres, Vercel, Supabase, VPS hosting) under data processing agreements
- When required by law, court order, or to protect rights/safety
Internal team data (curator assignments, channel performance) is visible only to team members based on role. We do not disclose member identities to other members beyond what is publicly visible on platform profiles.
5. Data Retention
Account and activity data is retained for the duration of your active membership plus a reasonable period for tax, legal, and dispute-resolution purposes (typically 3 years). OAuth tokens are deleted immediately upon account termination or platform disconnection. Backups are retained up to 14 days.
6. Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your account and associated data
- Disconnect any connected social media platform at any time via /admin/channels or by contacting an administrator
- Withdraw consent for data processing
- Lodge a complaint with a data protection authority
To exercise any of these rights, contact us at the addresses below.
6a. How to Request Data Deletion
To request deletion of all personal data Lucky Team holds about you, choose any of the following methods:
- Email request: Send a deletion request to [email protected]with subject line "Data Deletion Request". Include the email or login associated with your account. We confirm receipt within 7 days and complete deletion within 30 days.
- Disconnect Instagram / Facebook: If you connected via Facebook Login, you can revoke our app access at any time through your Facebook settings → Apps and Websites → Lucky Team / TubeForge → Remove. This triggers our automated deauthorize callback (
/api/instagram/deauthorize) which immediately removes your OAuth tokens. To also delete account data, follow the email request method above. - Automated Meta endpoint: Meta Platforms operates an automated data deletion request flow that calls our endpoint
/api/instagram/data-deletion. Once initiated through Facebook settings, you receive a confirmation URL where you can track deletion status.
Note: Some data is retained per Section 5 (Data Retention) for tax, legal, and dispute-resolution purposes. OAuth tokens and connected social platform credentials are deleted immediately upon request. Anonymized aggregate statistics may be retained indefinitely.
7. Security
We use industry-standard practices: HTTPS for all traffic, password hashing (bcrypt), encrypted database connections, OAuth token encryption at rest, access control via authentication cookies, audit logging of sensitive operations. No system is perfectly secure; in case of a breach affecting your data, we will notify affected users without undue delay.
9. Third-Party Platforms
When you connect external accounts (YouTube, TikTok, Instagram), those platforms also collect data per their own privacy policies. We are responsible only for what we collect within Lucky Team. Review the privacy policies of:
10. Children
The platform is intended for users 18 years and older. We do not knowingly collect data from minors. If you believe we have collected data from a child, contact us immediately and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy occasionally. Material changes will be communicated via platform notifications or email. The "Last updated" date at the top reflects the current version.
12. Contact
For privacy questions or to exercise your rights:
- Email:[email protected]
- Telegram:@luckyteamyoutube_bot