Privacy Policy
Last updated November 9, 2026Who we are
ViralAri (viralari.com) is operated by Novek Labs ("we", "us"). ViralAri lets short-form video creators upload a draft video and get a Viral Score, suggested fixes, new hooks and captioned exports.
This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it and the choices you have. If you have a question, email [email protected].
What we collect
Account information: when you sign up or log in, we receive your email address, your name and, if you sign in with Google, your profile picture. We also store your account settings, your plan and how many checks you have used.
Onboarding answers you choose to give: what kind of content you make, your niches, where you post, how often you post and how you heard about us. We use them to tailor your scores, hooks and tips, and to understand how people find ViralAri. Every question can be skipped and you can change your answers on the Account page.
Whether you want our monthly tips email. It is off unless you turn it on, and you can turn it off anytime.
Videos and results: the videos you upload, the audio transcript we create from them, and the scores, fixes, hooks and captions we generate.
Payment information: if you subscribe, our payment provider Polar collects your payment details. We receive your subscription status and billing period, never your full card number.
Usage and device data: pages visited and features used, collected through our analytics (PostHog). If you accept analytics cookies, this includes recordings of clicks, scrolling and page activity; what you type and your account details are always hidden. We remove private links and tokens from page addresses before they are sent, and technical data such as IP address, browser type and device type in our server logs.
Sign-in sessions: for each signed-in session we store the IP address and browser (user agent) it started from, to keep your account secure and to spot sign-ins that are not yours. They are deleted when you sign out or the session expires. If you turn on two-step verification, we store your authenticator key and backup codes encrypted.
Emails you send us: if you contact support, we keep the conversation so we can help you.
Hook pack and tips list (no account needed): if you ask for free hook templates or tick "Also send occasional tips" in a free tool, we keep your email address, the niche you picked, where you signed up, the exact consent wording you agreed to and when, when you confirmed, a one-way hash of your IP address (never the raw address) and, if the address matches a ViralAri account, a link to that account.
Free tool results you ask us to email: we use your email address only to send that one email. The result is formatted and sent straight away and is not stored, and asking for it does not add you to any list.
Affiliate program: if you apply, we keep your application (links to your channels, audience size, how you plan to promote ViralAri and your country), your payout method and payout email, your review status and your commissions and payouts. When someone clicks an affiliate link, we record the time, the page they landed on, any campaign tags in the link, the referring website and a salted, one-way hash of their IP address and browser. We never store the raw IP address. If that visitor creates an account, we record which affiliate referred them. Affiliates only ever see anonymized numbers (for example "Customer #4"), never names or emails.
Google user data
If you choose "Continue with Google", we use Google Sign-In directly, through our own sign-in system. We request only the basic sign-in permissions (openid, email and profile). We do not request access to your Gmail, Google Drive, YouTube, contacts or any other Google data.
What we receive from Google: your name, your email address, your profile picture and a unique Google account identifier.
How we use it: only to create and sign in to your ViralAri account, to show your name or initials in the app, and to send you emails about your account and your checks. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
Who we share it with: no one, except the service providers listed below that help us run ViralAri (for example our email provider to deliver account emails), and only as needed to provide the service. We never transfer Google user data to data brokers or advertising platforms.
How we store and protect it: Google user data is stored only in our database on servers we operate, protected by encryption in transit (HTTPS), access controls and restricted administrative access.
How long we keep it and how to delete it: we keep it while your account is open. When you delete your account from the Account page, we delete your Google user data from our database. You can also remove ViralAri's access at any time from your Google Account under Security, Third-party apps and services.
ViralAri's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use your data
To provide the service: create your account, analyze your videos, show your results and library, render exports and keep track of your plan and checks.
To communicate with you: send you an email when a check is ready, before a paid plan renews and when your free check resets, and reply when you contact us. You can turn off non-essential emails on your Account page.
Hook pack and tips emails (only with your consent): we first send one email asking you to confirm. Nothing else is sent until you do. After you confirm, we send the hook templates you asked for and, from time to time, tips about short-form video. Every one of these emails has a one-click unsubscribe link (and an unsubscribe option in mail apps that support it). If you have an account, the same choice appears as "monthly tips" on your Account page, and turning it off there unsubscribes you too.
To improve and protect ViralAri: understand which features are used, fix bugs, prevent abuse and keep the service secure.
To meet legal obligations, such as tax and accounting records for payments.
Your videos are used only to create your results. We never post them, sell them or show them to other users, and we do not use your videos or transcripts to train AI models.
People at ViralAri do not routinely watch your videos. An authorized team member may open one of your uploads only to fix a failed check or export, to help with a problem you reported, or to investigate abuse. Every such access is logged.
Legal bases (EU and UK)
We process your data to perform our contract with you (providing ViralAri), based on our legitimate interests (improving and securing the service, product analytics, crediting affiliate partners for the customers they refer and preventing affiliate fraud), to comply with legal obligations, and with your consent where required (for example optional emails). You can withdraw consent at any time.
Service providers we share data with
We do not sell your personal data. We share it only with service providers that process it on our behalf, each limited to what it needs:
Our own servers: our database (PostgreSQL) and video processing run on a server we operate, rented from a hosting provider that only provides the machine and does not use your data.
Cloudflare: our content delivery network and DDoS protection (all traffic to viralari.com passes through Cloudflare, which sees technical data such as your IP address) and routing of email sent to our addresses.
Sign-in: we run sign-in on our own servers. If you use a password, we store only a salted hash of it, never the password itself. Google Sign-In connects directly to Google.
Cloudflare R2: temporary storage for uploaded videos and exports.
Groq: transcribes the audio of your video and generates the score, fixes and hooks. Groq processes this data to return results to us. It also transcribes openings you re-record in the editor.
GetAnyAPI (only when you import a TikTok or Instagram link): receives the link you paste and returns the video file so we can check it. For Instagram it stores a temporary copy of that video for us.
OpenRouter (only if we turn it on as a backup): if our main AI provider is unavailable, the transcript may be sent through OpenRouter to another AI model to generate the score, fixes and hooks.
Replicate (Hook Swap, when you use it): runs the AI models that say your new opening line in your voice (from your voice reference recording) and match your lips to it (from the first seconds of your video). Inputs are sent as short-lived links and the results come back to us.
ElevenLabs and Sync Labs (Hook Swap, only if we switch to them as backup providers): ElevenLabs may create a voice from your reference recording to say your line; Sync Labs may match your lips to it. If ElevenLabs creates a voice, we delete it there when you remove the person or delete your account.
Polar: payments, taxes and invoices as our merchant of record.
PostHog: product analytics. Without your consent it runs without cookies. If you accept analytics cookies, it sets one first-party cookie and records how pages are used (clicks, scrolling and session replays) so we can fix confusing parts of the product. Everything you type is hidden in these recordings, and so are your transcripts, captions and account details. Recordings are kept for a limited time at PostHog. When you delete your account, we also delete your analytics profile and its events at PostHog.
Sentry: error reports, so we can find and fix bugs. A report contains technical details about the error and the page or request it happened on. We have asked Sentry not to store IP addresses.
Google Fonts: if you use the brand kit (Studio), the font you pick is loaded from Google Fonts, so your browser connects to Google and shares your IP address with it.
Email delivery: our own mail server sends account and product emails. Resend may deliver them as a backup.
We may also disclose data if required by law, to protect our rights or users, or as part of a merger or acquisition, in which case we will tell you before your data becomes subject to a different policy.
Hook Swap: your voice and face
Hook Swap is an optional feature that replaces the opening line of your own uploaded video with a new line in your voice, with your lips matched by AI. It works only on videos you upload yourself, never on links to other people's content.
Before anyone's voice or face is used, that person ticks a consent box in their own name ("This is my face and my voice, and I want to create AI-edited openings of myself") and passes a live read-aloud check: they read a random passage out loud and we check the words with speech recognition. We record the time, the name they typed, their IP address and the exact consent wording as proof of consent, and keep every consent given as a separate record that is never changed.
Invited people: an account owner can invite another person (for example a co-host) with a one-time link that expires after 7 days and stops working once they consent. That person consents and does the read-aloud on their own device, in the same browser. The account owner can never upload someone else's voice. Invited people can ask the account owner or us ([email protected]) to remove them at any time.
What we process: the read-aloud recording (it becomes the voice reference), the new line's text, the first seconds of the video (for lip-sync) and the generated audio and video. Voice and face data can be sensitive; we use it only to make the openings you ask for and to prevent abuse, never to identify anyone or for advertising.
Labels: exported files with a Hook Swap opening carry the tag "AI-edited opening (ViralAri Hook Swap)", and we remind you to use each platform's AI label when you post.
Retention: a person's voice reference recording is kept until they are removed or the account is deleted, then deleted (and any provider voice with it). New openings are deleted with your other files (after 30 days at most). A log of each swap (account, person, line, provider job ids, usage and cost, status and time) is kept for 365 days to investigate abuse, then deleted.
International transfers
Some of our providers process data in the United States and other countries. Where data leaves the EU or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep your data
Uploaded videos and exported files are deleted automatically after 7 days on Free and Starter, 30 on Creator and 90 on Studio, counted from when each file is created. The period is set by your plan at that moment and does not change if you switch plans later. We email you the day before files are deleted.
Scores, transcripts, hooks and captions stay in your library until you delete them or your account.
Account data is kept while your account is open and deleted when you delete your account. Payment and invoice records are kept as long as tax law requires.
Backups: we keep encrypted database backups so we can recover from a failure. Deleted data can remain in these backups for up to 14 days after deletion, until the backups that hold it are replaced. We never restore deleted accounts from them.
Server logs (requests, errors, and technical data such as IP address and browser) are rotated automatically: older entries are overwritten as new ones are written, usually within a few weeks.
Sign-up attempts that are never confirmed are deleted after 48 hours.
Re-recorded openings (the camera clip you record in the editor) are used only for that video and deleted after 30 days at most.
Hook Swap data is covered in the Hook Swap section above.
Hook pack and tips list: kept until you unsubscribe. After that we keep only the record that you unsubscribed (so we never email you by mistake), unless you ask us to delete it. Deleting your account deletes your list entry too. To be removed completely, email [email protected].
Affiliate click records are kept while the affiliate program needs them to credit and pay partners and to check for fraud. Affiliate commission and payout records are kept as long as tax and accounting law requires.
Security
We use HTTPS for all traffic, store files with access-controlled cloud storage, limit administrative access to our servers and delete uploaded videos automatically (after 7 days on Free and Starter, 30 on Creator and 90 on Studio). No method of transmission or storage is completely secure, but we work to protect your data and will notify you if a breach affects you as required by law.
Your rights and choices
You can delete any video, or your whole account, at any time from your Account page.
Depending on where you live (including the EU, UK and California), you have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. To exercise these rights, email [email protected]. We will reply within 30 days. You can also complain to your local data protection authority.
We do not sell or share your personal information for cross-context behavioral advertising.
Children
ViralAri is not intended for children under 13, or under 16 in the EU and UK. We do not knowingly collect their data. If you believe a child has given us personal data, email [email protected] and we will delete it.
Changes to this policy
If we make material changes, we will update the date at the top of this page and let you know by email or in the app before the changes take effect.
Contact
Novek Labs, operator of ViralAri. Email [email protected] with any question about this policy or your data.