Privacy Policy

Last updated: July 18, 2026

This is a template provided for convenience, not legal advice; please have it reviewed by qualified counsel before relying on it for compliance.

1. Who we are

Outlio is a content intelligence tool for businesses and creators. It helps you research public social media accounts you choose to follow, analyze their public posts, and generate content ideas and scripts for your own business.

Outlio is operated by Steadyturtles Media ("Outlio," "we," "us," or "our"). If you have any questions about this policy or how we handle your information, contact us at sabit@steadyturtles.com.

This policy explains what information Outlio collects, how we use it, who we share it with, and the choices and rights you have. It covers the Outlio application at app.outlio.ai and our marketing site.

In plain terms: Outlio is a business tool. We collect the basics needed to run your account and the service, we do not sell your data, and we do not use advertising or tracking SDKs. The main thing Outlio works with is public social media content that you choose to research.

2. Who this policy applies to

This policy applies to:

• Account holders who sign in and use Outlio.
• Visitors to our public marketing pages.

Outlio is a business to business tool intended for professional use. It is not intended for personal or household use, and it is not directed at children (see Section 14).

3. What Outlio works with: public social content

This is important, so we say it up front.

The core data inside Outlio is publicly available social media content that you choose to research. When you add a public Instagram, TikTok, or YouTube account to your watchlist, Outlio looks up that account's public posts and public profile information, and analyzes them so you can learn from them.

Outlio does not connect to your private social accounts, your direct messages, your drafts, or any private or non public content. Outlio does not post on your behalf. The accounts and posts you research belong to third parties (the public creators), not to you, and Outlio is not affiliated with, endorsed by, or sponsored by TikTok, Instagram, YouTube, or any of the creators whose public content is shown.

4. Information we collect

a) Account and profile data

When you create an account, we collect and store:

• Your email address.
• Your first and last name (and, if your sign in provider sends a single combined name, your full name).
• A profile picture URL, if one is available from your sign in provider.
• A user ID that identifies your account.
• Basic account and session records managed by our authentication provider, such as which sign in method you linked, when your email was confirmed, when you last signed in, and when your account was created.

You can sign in with Google or with a one time code sent to your email. See Section 5 for details on Google Sign-In.

b) Business and workspace information you enter

To tailor the content Outlio generates for you, you can enter information about your own business. This may include your business name, city, address, phone number, contact email, the services you offer, a sample of your brand voice or writing style, your own social handle, a description of your audience, and any disclaimers you want applied to generated content.

Please note: much of this business information is currently stored in your own browser (see Section 4e), and a subset of it (such as business name, city, services, and voice or context notes) is saved on our servers so the service can use it to generate content for you.

c) Public social content you research

When you add public accounts to your watchlist, Outlio stores the public post data returned for those accounts, including post URLs, captions, hook text, view, like, and comment counts, engagement scores, posting dates, video length, thumbnails, media URLs, and carousel images. Outlio also transcribes the audio of public videos you analyze and stores structured breakdowns of those posts. Public profile pictures and thumbnails may be downloaded and cached.

This is third party public content that you selected for research. It is described here for transparency, but it is not your personal data.

d) Content you generate

Outlio can generate scripts, hooks, content plans, and similar material for your own business, using your business context and the public research content. This generated content is your work product and is stored so you can come back to it.

e) Cookies and local browser storage

Outlio relies heavily on your browser's local storage to keep most of your working state on your own device (your watchlist, saved items, collections, ideas, generated scripts, and business profile). We also use a small number of cookies. See Section 11 for the full list.

f) Technical and network data

Like any website, when you use Outlio your device sends technical information such as your IP address and browser type. Our hosting and infrastructure providers necessarily receive this to deliver the service and keep it secure. Outlio itself does not run advertising, analytics, or third party tracking SDKs, and does not build advertising profiles about you.

5. Sign in with Google and Google user data

If you choose "Continue with Google," Google asks for your permission and then shares the following with Outlio:

• Your name.
• Your email address.
• Your Google profile picture.
• A Google account identifier.

We use this Google information for one purpose only: to create and operate your Outlio account (to sign you in, identify your account, and show your name and picture inside the app). We do not use your Google information for advertising, we do not sell it, and we do not share it with third parties except the infrastructure providers listed in Section 7 that we use to run Outlio. We store it in our authentication and profile database, and we retain it for as long as your account exists (see Sections 9 and 10).

Outlio only requests non sensitive sign in information (your basic profile and email). It does not request access to your Gmail, Drive, Calendar, contacts, or any other Google service.

Limited Use statement: Outlio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use your information

We use the information described above to:

• Create your account, sign you in, and keep you signed in.
• Show your name and picture in the app and personalize your experience.
• Look up, analyze, and display the public social content you choose to research.
• Generate scripts, hooks, and content ideas tailored to your business.
• Operate, maintain, secure, and improve the service.
• Communicate with you about your account, including sending sign in codes.
• Comply with law and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for third party advertising or cross context behavioral advertising.

7. How we share information and our sub-processors

We do not sell your personal information. We share information only with the service providers we rely on to run Outlio, and only as needed to provide the service. These providers process data on our behalf under their own terms and security commitments.

We may also disclose information if required by law, to respond to valid legal process, to protect the rights, property, or safety of Outlio, our users, or the public, or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy.

8. AI processing

Outlio uses AI to analyze public posts and generate content. Here is how it works:

• Outlio downloads a public post, sends its audio to ElevenLabs for a transcript, then sends that transcript, the caption, and (for carousels) the slide images to OpenAI or Anthropic for analysis.
• For scripts and content plans, Outlio also sends your business context (such as your niche, services, and brand voice sample) so the output is tailored to you.
• We do not send your raw identity data (your name or email) to these AI providers. They receive your business context and the public research content, not your account identity.

AI output can be wrong. Please review anything Outlio generates before you rely on it or publish it. See our Terms of Service for more.

9. Cookies and local storage

Outlio uses a small set of cookies and relies on your browser's local storage. We do not use advertising or tracking cookies.

Cookies:

• sb-<project>-auth-token: the authentication session cookie set by our auth provider. It keeps you signed in. It is HTTP only and refreshed as you use the app. It expires when your session or refresh token expires.
• outlio_access: a legacy access cookie used during our early access rollout to gate entry. HTTP only, SameSite Lax, expires after 30 days. This is being phased out as full sign in becomes standard.
• outlio_watch: stores a list of the most recent public handles on your watchlist so the app can filter your feeds. SameSite Lax, expires after 30 days.
• outlio_saved: stores the IDs of items you saved so the app can resolve them. SameSite Lax, expires after 30 days.

Local storage: Most of your per user working state (watchlist, collections, saved ideas, generated scripts, business profile, workspace settings, and a local copy of your name and email) is stored in your browser's local storage, on your device. This data stays on your device until you clear it or use the reset option in the app.

Because Outlio uses only essential cookies and no advertising or analytics trackers, we do not display a consent banner for non essential tracking. You can clear cookies and local storage at any time through your browser settings; doing so will sign you out and clear your locally saved work.

10. Data retention

We keep your account and profile data (name, email, profile picture URL, and sign in records) for as long as your account is active. If you ask us to delete your account, we remove these records as described in Section 11.

Please be aware of the following, which we disclose plainly:

• Public research content (the scraped public posts, transcripts, and analyses) and some generated content and business profile data are currently stored in shared tables that are not tagged to an individual account. We do not have an automated, self service way to delete this content today, so we handle removal manually on request (see Section 11). We are working to improve per account data controls.
• Cached public images and thumbnails may be retained in storage.
• Data in your browser's local storage stays on your device until you clear it or reset the app; it is not retained on our servers.

We do not currently operate a fixed automatic deletion schedule. If you want your data removed, please contact us and we will act on your request.

11. Your rights and how to request deletion

Depending on where you live, you may have rights over your personal information, including the right to access it, correct it, delete it, receive a copy, or object to or restrict certain processing. If you are in the European Economic Area or the United Kingdom, these rights come from the GDPR. If you are in California, the CCPA and CPRA give you the right to know, delete, and correct your information, and the right to opt out of the sale or sharing of your personal information. Outlio does not sell or share your personal information for advertising, so there is nothing to opt out of on that front. We will not discriminate against you for exercising any of your rights.

How to exercise your rights, including deletion: Email us at sabit@steadyturtles.com and tell us what you would like. We will verify your request and respond within the time required by applicable law. Because some of your data is currently stored in shared tables and some is stored in your own browser, deletion is handled manually on our side and by clearing your browser on yours. We will delete your account identity records and, on request, locate and remove your business profile and generated content.

If you are in the EEA or UK and believe we have not handled your data properly, you have the right to complain to your local data protection authority.

12. Do Not Track and Global Privacy Control

Outlio does not track you across other websites or over time for advertising, and it does not use third party analytics. Because we do not sell or share personal information, there is no sale or sharing for a Global Privacy Control (GPC) signal to opt you out of. We honor GPC and Do Not Track signals to the extent they apply to our practices.

13. Data security

We take reasonable steps to protect your information. Data is transmitted over encrypted connections (HTTPS), your session cookie is HTTP only, and our database and storage providers encrypt data at rest and restrict access. Access to production systems is limited.

At the same time, we want to be honest: no method of transmission or storage is completely secure, and as noted in Section 10, some content is currently stored in shared tables without per account isolation. We are actively improving these controls. Please do not enter information into Outlio that you would not want stored on this basis.

14. International data transfers

Outlio and its providers are based primarily in the United States, and your information may be processed in the United States and other countries where our providers operate. These countries may have different data protection laws than your own. If you are in the EEA or the UK and your data is transferred out, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.

15. Children's privacy

Outlio is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18, and, where a lower age of digital consent applies, from anyone under that age (for example, under 16 in parts of the EEA). If you believe a child has provided us information, contact us and we will delete it.

16. Third party platforms and creators

Outlio surfaces publicly available content from Instagram, TikTok, and YouTube that you choose to research. Outlio is an independent tool and is not affiliated with, endorsed by, or sponsored by Meta, TikTok, YouTube, Google (other than as our sign in provider), or any creator whose public content appears in the app. The public content belongs to those creators and platforms and is subject to their own terms and privacy policies.

17. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top, and for material changes we will take reasonable steps to notify you, such as a notice in the app or by email. Your continued use of Outlio after an update means you accept the revised policy.

18. Contact us

Questions, requests, or concerns about privacy or your data:

Email: sabit@steadyturtles.com Operated by: Steadyturtles Media Mailing address: Available on request

---