Last updated: August 25, 2026
Dally ("we," "our," or "us") is operated by Dally Platforms, Inc. Dally is a content intelligence platform for creators. This Privacy Policy explains what information we collect, how we use it, who we share it with, and how we protect it when you use dally.ai and its related services.
You sign in to Dally through our authentication provider, WorkOS (AuthKit) — either with a one-time code sent to your email address or with your Google account. Either way, we receive your email address and display name. We use this information solely to create and manage your Dally account, authenticate your sessions, and send you account-related communications. If you sign in with Google, we do not request access to your Google contacts, calendar, Drive files, or any other Google service data.
You may connect one or more of the following platforms to Dally: Instagram, TikTok, YouTube, Threads, X (Twitter), LinkedIn, and Substack. For each platform you connect, we collect:
Each platform connection requires a separate, explicit OAuth authorization (or, in the case of Substack, an RSS URL you provide). We request only the permissions necessary to provide our service. For Instagram, when you grant the messaging permission, we access your Instagram direct messages and comments to power the features you turn on, such as understanding what your audience is asking for and running the reply automations you set up. We do not access direct messages on any platform where you have not granted a messaging permission, and your messages stay private to you.
We collect publicly available content data (captions, thumbnails, public engagement counts) from public creator profiles to power our discovery feed. This data is available to anyone who visits the public profile and does not require authentication.
We use PostHog to collect usage analytics and session recordings when you interact with Dally. This includes pages visited, clicks, feature usage, browser type, and device information. We use this data to improve the product. PostHog sets cookies on your device to distinguish users and track sessions.
When you (or an app you connect, such as an AI assistant) call Dally's API or MCP endpoints, we keep the full request and response of each call the assistant makes on your behalf — the operation, its arguments, and what Dally answered — together with the pseudonymous identifiers the assistant's host sends and, when the assistant supplies it, the assistant's own short description of what you were trying to learn or do. That description is written by the assistant, never your message: your conversation stays with the assistant's host and never reaches Dally. We use these records to operate, secure, debug, improve and measure the service. They are kept for the life of your account and deleted with it, or earlier on request (see Section 11). We also note on your account when your AI client first connected and first received an answer; those notes are deleted with your account.
We use your account email and display name for authentication, account creation, and account-related communications only. We do not use sign-in data (including Google user data, when you sign in with Google) for advertising, market research, or any purpose unrelated to providing Dally's authentication and account management functionality.
Our roles. For your account, your own content and performance data, security, billing, and improving and developing Dally and the models and systems that serve you, we act as an independent data controller. For the direct messages and comments of your audience that we process when you enable audience features, you (the creator) are the controller and Dally acts as your processor, handling that data on your instructions to deliver the features you turn on (see Section 15).
Legal basis. Where the GDPR or UK GDPR applies, we rely on: legitimate interest — to analyze your connected content and audience signals, to operate and secure Dally, and to improve and develop our products, features, and the systems that serve you (we retain and use your data for these purposes; we do not train general-purpose AI models on it, see Section 13) — assessed against your rights and freedoms in a documented legitimate-interest assessment; consent — for optional features you switch on, such as the comment/DM keyword automations and marketing emails; and contractual necessity — to create and operate your account. You can object to legitimate-interest processing or withdraw consent at any time (Section 12).
We access your data through each platform's official API using permissions you explicitly grant during the OAuth connection process. We request only the scopes necessary to read your profile, content, comments, messages, and metrics.
For each connected platform, you can revoke access at any time from your Dally settings page or from the platform's own app permissions settings. For YouTube and other Google services, you can also revoke Dally's access at any time via the Google security settings page.
For YouTube, we request permissions to read your channel and video metadata, analytics, revenue data, captions, and comments.
For Instagram, when you grant the messaging permission, we access your direct messages and comments to power the audience and monetization features you enable (for example, demand detection and the comment-or-DM keyword automation you configure). We do not access direct messages on platforms where you have not granted a messaging permission, and we do not access follower lists or contact information except as needed for a feature you turn on. We do not take actions on your behalf unless you explicitly initiate them or enable an automation you control.
By connecting a platform account, your content and performance metrics (including saves, shares, and reach) become part of the Dally creator network. Other connected creators may see your content and metrics through platform features such as the discovery feed. This shared pool of private metrics is core to how Dally works and what makes the platform valuable for everyone.
You can stop new data from syncing at any time by disconnecting your account from Dally settings; disconnecting keeps your already-synced data so you can reconnect later. To have Dally delete your stored data, submit a data deletion request. Your personal analytics (visible only to you) work regardless of network participation.
We do not sell, rent, or trade your personal data or any platform-specific user data to third parties. We do not share your data with data brokers, information resellers, or advertisers.
We share your data only in the following circumstances:
Dally uses YouTube API Services to connect your channel and display your videos and analytics to you. By using these features, you also agree to the YouTube Terms of Service. Information about how Google handles your data is available in the Google Privacy Policy.
Dally's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The following commitments apply to all data received from Google APIs, including Google Sign-In data (email, display name — received when you choose to sign in with Google) and YouTube API data (video metadata, analytics, revenue, captions, comments):
We use the following third-party services to operate Dally. Each service processes data under its own privacy policy and data processing agreements:
None of these providers use your data for advertising, and none sell your data to third parties. The AI providers (RunPod, Voyage AI, Anthropic) process your content only to return a result to Dally.
Dally uses cookies and similar technologies for the following purposes:
We do not use advertising cookies or retargeting technologies, and we do not share cookie or measurement data with advertisers. Our measurement is first-party only: it stays inside Dally and is never sold or used for advertising.
Your data is stored in a PostgreSQL database hosted on Supabase with encryption at rest and encryption in transit (TLS). Video files and processing artifacts are stored in Cloudflare R2; thumbnails and profile images are stored in Supabase Storage — all in access-controlled buckets. Our web application is hosted on Vercel with HTTPS enforced on all connections.
OAuth access tokens are stored in our database with encryption at rest (AES-256, provided by our database host) and encryption in transit (TLS). They are used only to sync your content data and execute actions you explicitly initiate. Tokens are refreshed automatically and revoked when you disconnect a platform.
We follow security practices including: encryption at rest for stored data, scoped database access controls, server-side authentication checks on all API routes, and regular rotation of application secrets. If we become aware of a data breach affecting your personal information, we will notify you and applicable authorities as required by law.
We keep your data for as long as your account is active. Disconnecting a platform is a pause, not a deletion: we stop syncing and clear the stored access tokens, but your already-synced data — content, performance metrics, messages, conversations, and audience — stays so you can reconnect later and pick up where you left off. (One exception: for YouTube, Google's API Terms require us to refresh or delete stored YouTube data within 30 days, and to delete YouTube-authorized data within 7 days of disconnecting.)
If you request deletion (via the data deletion page or by emailing support@dally.ai), we will delete or anonymize your personal data within 30 days. This includes your profile information, content data, performance metrics, messages, and AI-generated analysis.
If you delete your Dally account, we treat this as a deletion request for all associated data.
You have the right to:
To exercise any of these rights, email support@dally.ai. We will respond within 30 days.
To be explicit about what Dally does not do with your data:
Dally is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at support@dally.ai and we will delete that information.
When you enable audience features, some of the personal data we process — the content of direct messages and comments, along with the sender's platform identifiers (their username and the platform-assigned user ID that accompanies a message or comment) — is about people other than you (your audience). We receive this data indirectly, through your authorized platform connection, and not from those individuals directly. We use it only to power the audience features you turn on, and never to build advertising profiles or to sell it.
Where we process this data as the creator's processor, the creator is the controller: the lawful basis and any notice or consent their use requires are theirs to determine and provide. For the limited processing we carry out as a controller, individually notifying every person who has messaged or commented would involve disproportionate effort, so — as GDPR Article 14(5)(b) permits — we make this Privacy Policy publicly available in place of individual notice. Any individual whose message or comment we hold may contact us at support@dally.ai to access or delete their data, or may ask you to remove it, and we will act on verified requests.
Dally is a U.S. company, and your data is primarily stored and processed in the United States; some of our providers operate global edge networks. Where we process the personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland, we rely on an approved transfer mechanism: the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions) where the provider participates, and/or the European Commission's Standard Contractual Clauses. U.S. hosting alone is not a transfer safeguard, so we rely on these mechanisms with the providers listed in Section 8.
If you are a California resident, the CCPA (as amended by the CPRA) gives you rights over your personal information. In the past twelve months we have collected the categories described in Section 2 — identifiers, internet and platform activity, commercial information, audio and visual content, and inferences — and used them to provide, secure, and improve Dally as described in Section 3.
We do not "sell" or "share" your personal information as those terms are defined by the CCPA/CPRA, and we do not use sensitive personal information for purposes that would trigger a right to limit. California residents may exercise the rights to know, access, correct, and delete their personal information, and to be free from discrimination for exercising them, by emailing support@dally.ai.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last updated" date, and (for material changes affecting how we use your data) sending a notification to the email address associated with your account.
If you have questions about this Privacy Policy, want to exercise your data rights, or have a complaint about how we handle your data, contact us at:
Email: support@dally.ai
Business: Dally Platforms, Inc.
© 2026 Dally Platforms, Inc. All rights reserved.