1. Operator
ORVIX is a Windows application for music-led video production operated by Evgenii Semenov. Support, privacy and deletion contact: zzmajororbitzz@gmail.com.
Effective date: 2026-10-19
2. Local work
Projects, imported or referenced music, videos and images, artwork, previews, generated files, settings, release packages and production history stay on your computer. Records can include filenames, paths, titles, descriptions, target accounts, schedules and platform video IDs. Local production does not itself send these files to ORVIX or a social network. You choose available network functions. Keep backups of originals.
3. Google and YouTube
ORVIX uses YouTube API Services to connect authorized channels, inspect publications and upload selected media, thumbnails and metadata. Normal connections request youtube.upload and youtube.readonly. A separate existing-video scheduling workflow requires youtube.force-ssl, not requested for every connection. Google consent identifies the actual requested permissions.
Depending on the function, ORVIX accesses channel IDs and names, uploads-playlist and video IDs, titles, descriptions, thumbnails, statistics, duration, processing and privacy status, and schedules. It stores identifiers, scopes, connection status, expiry, credentials and publication records locally. Authorized uploads send selected media and metadata to YouTube; schedule updates send video ID and requested status or time.
Credentials are protected for the current Windows user with Windows DPAPI; non-secret metadata is separate. Refresh tokens can renew access when authorized functions run. The desktop calls Google directly; this static website receives no YouTube tokens.
Google data supports visible connection and publishing functions. It is not sold or used for advertising, credit decisions or AI training. Human support access is limited to information you supply; never supply credentials. Use is governed by the Google API Services User Data Policy, including applicable Limited Use requirements. This is not a claim of Google verification or completed compliance certification. See the Google Privacy Policy and YouTube Terms of Service.
4. Instagram and TikTok
Instagram is in developer testing. Its official browser login requests instagram_business_basic and instagram_business_content_publish. A supported professional account can return app-scoped and professional IDs, username, account type, permissions and expiry. Connection alone publishes nothing.
A separate owner-only test OAuth service receives the code, validates state and a secure browser cookie, exchanges the code with Meta and stores encrypted provider tokens. The desktop stores a separate Windows-protected service credential, identifiers, permissions and status. The Meta secret and encryption key are in Windows-protected server configuration outside the desktop distribution. Temporary HTTPS-tunnel testing is configured on the owner’s computer; availability and commercial data residency are not guaranteed. Automatic long-lived token refresh is not implemented.
TikTok registration fields exist, but working OAuth, token management and publishing are unfinished. No operational TikTok account collection or publication service is claimed. Instagram and TikTok automatic publication are not generally available.
5. Website, diagnostics and AI
This static site has no password form, token endpoint, analytics SDK, tracking pixels, third-party fonts or browser-storage identifiers in its own code. Delivery providers can process IP addresses, browser information and request times.
This website is hosted on Cloudflare Pages. Cloudflare processes delivery requests and infrastructure logs under its applicable policies and the hosting settings selected by the owner. The test OAuth service is separate. See Cloudflare’s privacy policy.
Local diagnostics and user-selected support exports can contain account or publication details. Reports are not automatically emailed. Review text and screenshots before sharing; redaction cannot remove every private detail. Optional thumbnail planning sends your prompt and permitted track-name context to local Ollama when invoked, not OAuth credentials. Separate model licences and requirements apply.
6. Connection controls
Disconnect account blocks guarded use while retaining credentials and history. Platform permission and published content remain unchanged. A separate confirmed removal action previews affected saved jobs; original targets are not reassigned.
YouTube removal attempts Google token revocation, then deletes selected local credentials and account-secret metadata. Google revocation may invalidate all grants for the same user and OAuth project. Removal is blocked when another channel may share that grant or ownership is unknown. Unconfirmed provider responses retain credentials for retry and block use. Local deletion failures remain incomplete, not successful.
The updated Instagram test broker authenticates the client and selected connection before deleting server tokens and identifiers and clearing matching completed login results. The desktop removes its selected service credential only after a confirmed server response. Revoke platform permission separately in Instagram Apps and Websites: server deletion is not Meta grant revocation.
Projects, media and publication history are preserved. API-derived information may remain in history, reports, release records or backups and needs administrative review. A credential-removal receipt does not mean all API Data has been erased. New removal paths were tested with isolated data, not by revoking the owner’s live accounts.
7. Retention and backups
Local work remains until you choose to remove it. Credentials and account records remain until explicit removal, replacement or administrative cleanup. Complete automatic enforcement of provider retention and revocation-deletion deadlines is not shipped. That enforcement and an inventory of API-derived history are prerequisites for public commercial connected services.
Instagram memory sessions expire after five minutes and are pruned on new sessions; this does not erase stored tokens. A separate deletion journal stores hashes of removed connection identifiers and credential verifiers, not usable provider tokens. To prevent deleted connections reappearing, retain the latest journal and apply it before a restored service resumes. Old independent backups are not automatically erased; restoring an old journal defeats this safeguard.
Support correspondence, diagnostic files and backup rotation have no owner-approved, automatically enforced fixed periods yet. Necessary retention, applicable legal duties and removal procedures must be agreed before commercial processing. No arbitrary universal period or completed legal assessment is claimed. Encryption and binding checks reduce risk but do not guarantee security or forensic erasure.
8. Requests and changes
Local production does not require a social account. Follow Data Deletion Instructions. For access, correction, deletion or other privacy requests email zzmajororbitzz@gmail.com with the platform, account and records concerned, never passwords, secrets, tokens or codes. Proportionate proof of account control may be requested. Applicable rights and any necessary retention exceptions are addressed under applicable law.
Material processing changes will be disclosed before a new use of connected-account data. The effective date is set on the approved first public release.