Privacy policy

Last updated: October 10, 2026

Silma ("we", "us", "our") is operated by SILMA LLC, a Washington limited liability company, 522 W Riverside Ave Ste N, Spokane, WA 99201-0581, United States. SILMA LLC is the controller of the personal data described here. This policy explains what we collect, why, who we share it with, and the choices you have when you use silma.app, app.silma.app and related services (together, the "Service"). It applies to everyone, wherever they live, and is written to meet the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws.

1. Information we collect

From you, when you use the Service

Account information: email address, name, and profile image when you sign up with Google or with email and password.

Signup quiz answers: before you create an account, our short signup quiz asks about your role, goals, platforms, industry, the content you make, your experience, your website, and how you heard about us. Your answers are kept in your browser until you create an account, then saved to it so Silma can tailor your first results. If you never create an account, the answers stay in your browser and are never sent to our database.

Content you submit: links to Instagram, TikTok, YouTube and Facebook videos you paste or share with Silma, video frames and audio extracted from videos you upload for Pre-Check, AI-generated analysis results, and content suggestions. Pre-Check normally extracts frames and a short audio track in your browser and uploads only those. If your browser cannot decode a video's format (for example HEVC/H.265 from some phones), we upload the full video so our servers can extract the frames, then delete that video immediately after processing.

Brand profile: niche, target audience, content pillars, tone, differentiator, and any brand document (PDF or text) you upload.

Your website (optional): if you give us your website address, we store it in your brand profile. Before you subscribe, we read only your homepage's title, description and icon to show you a preview, and we do not store the page. After you subscribe, we read up to ten public pages of that website and use AI to summarise what you sell, who it is for, the questions your customers ask, and your proof and tone. We store that summary so Silma can suggest content from it; you can review, edit or remove it. We only read the address you give us.

Chat messages: your conversations with Silma, our AI assistant, are stored so it can keep context across sessions.

Tracked accounts: public account handles you ask Silma to track, and the public posts and analysis we collect for them.

Instagram reels of the account you name (optional, paid plans): if you give us an Instagram username and have not connected an Instagram account, we read the public reels of the Instagram account you name. For each reel we store its link, post date, caption and cover image, and its public view, like and comment counts. We read the last 30 reels when you start a scan or change the username, and we keep the counts from each check, so we can show how each reel is doing over time (a history of those counts). On paid plans, after that first read, we check again at most once a night and read only the reels from the last 9 days. We use this to compare those reels with each other and to show you the result. We do not check who runs that account, we read public data only, and we never receive an Instagram password.

Connected Instagram account (optional): if you connect your Instagram professional account, we access, through Meta's Instagram Graph API, your profile, your list of posts, and per-post insights (reach, views, saves, shares, watch time, and total interactions). We store these insights to compute which of your content techniques perform best ("what works for you"). We never receive your Instagram password; access is granted by an Instagram authorization token that you can revoke at any time by disconnecting in the app.

Connected YouTube channel (optional): if you connect your YouTube channel, we access, through Google's YouTube Data and YouTube Analytics APIs, your channel and video list and per-video metrics: views, estimated minutes watched, average view duration, completion rate, likes, comments, shares, saves (adds to playlists), and subscribers gained and lost, along with each video's title, thumbnail URL, publish date, and duration. We store these to compute which of your content techniques perform best. We never receive your Google password; access is granted by an authorization token that you can revoke at any time by disconnecting in the app, or from your Google account's security settings.

Connected TikTok account (optional): if you connect your TikTok account, we access, through the TikTok Display API, your video list and per-video data: video ID, title, description, cover image, share URL, duration, view count, like count, comment count, and share count, along with each video's post time and your account-level follower count. We store these to compute which of your content techniques perform best. We never receive your TikTok password; access is granted by an authorization token that you can revoke at any time by disconnecting in the app, or from your TikTok account's security settings.

Content history: ideas you save, mark as posted, and outcome ratings you log.

Payment information: handled by Stripe. We receive your plan and billing status; we never see or store your card number.

Messages to us: anything you send through the Help dialog or by email.

Collected automatically

Device and usage data: pages viewed, features used, errors, browser and device type, and timestamps, used to keep the Service working and to improve it.

IP address and approximate location: our hosting and security providers see your IP address on every request and use it to deliver the Service, rate-limit abuse, and block bots. If you accept analytics, PostHog also stores your IP address and derives an approximate location (country, region and city) from it. Our cookieless analytics derive your country from your IP address without storing the address.

Where you came from: the first time you visit app.silma.app we note the website that referred you and any campaign tags in the link (for example utm_source) and save them to your account when you sign up, so we know which channels bring customers.

Session replay, heatmaps and surveys: only if you accept analytics cookies, PostHog records how you move through our pages (clicks, scrolling, and what is shown on screen), builds heatmaps of where people click, and may show you short in-app surveys. We use replays only to find and fix problems. If you decline, none of this runs.

From other sources

Newsletter subscribers: if you subscribe to our newsletter without having an account, we keep your email address, where on our site you signed up, and the date. Every newsletter has a one-click unsubscribe link.

Public creator content: Silma collects publicly available posts from Instagram, TikTok, YouTube and Facebook (video, thumbnail, caption, handle, and public counts such as views and likes) when a user submits a link, tracks a public account, reads the Instagram account they name, or when we build our library of high-performing public videos (Discover). This can include personal data about the creators of those posts. We never collect creators' private posts, direct messages, or anything behind a login. Creators can ask us to remove their content at any time; see Copyright and removal requests.

2. How we use your information

To provide, secure and improve the Service
To analyse content you submit with AI and return results to you
To generate personalised content suggestions from your brand profile and your own results
To power Silma, our AI assistant, and keep conversation context
To process payments and manage your subscription
To send service emails and lifecycle emails about getting started and your usage. You can unsubscribe from lifecycle emails at any time from the link in any email.
With your consent, to measure product usage with analytics cookies and session replay, so we can see which features are used and where people get stuck
To review the quality of Silma's answers, including automated checks for answers that are inaccurate or ignore data we have
To enforce plan limits, prevent fraud and abuse, and comply with the law

We do not use your data to train AI models, and our AI providers do not train on it under their API terms. Your content is sent to them only to produce results for you.

Silma is an AI. When you chat with Silma you are talking to an AI system built on Anthropic's Claude models, not a human. Its analysis and suggestions are generated automatically and can be wrong; check anything important before you rely on it. We do not use automated decision-making that produces legal or similarly significant effects on you.

3. Legal basis for processing (GDPR)

Performance of a contract: creating your account, delivering analysis, powering Silma, processing your brand profile and connected accounts, and managing your subscription.
Consent: analytics cookies and similar device storage, session replay, heatmaps and surveys, and the newsletter if you are not a customer. You can withdraw consent at any time (see Section 10); withdrawing does not affect processing that already happened.
Legitimate interests: keeping the Service secure and preventing abuse, cookieless aggregate page counts, lifecycle emails to our customers about the Service they use, recording which channel brought you to us, and processing public creator content so users can study what works on social media. We have balanced these interests against your rights, and you can object at any time.
Legal obligation: keeping records the law requires, such as billing and tax records.

4. Who we share data with

We share personal data only with the service providers below, only as needed to run the Service, and under contracts that require them to protect it and use it only on our instructions. We do not sell your personal data and we do not share it for cross-context behavioural advertising.

Provider	What they do for us	Data involved
Clerk	Sign-in, sign-up and sessions	Name, email, profile image, sign-in method, session cookies, IP address
Stripe	Payments and subscriptions	Email, billing details, payment card (held by Stripe only), plan and invoices
Anthropic	AI analysis, Silma's chat replies, website and brand summaries	Video frames, transcripts, chat messages, brand profile, website summaries
Cloud hosting, database and storage providers (US)	Run the website, API and background processing, and store your account data and files	Everything stored in your account, including videos, thumbnails and frames, and request data such as IP address
Speech-to-text provider (US)	Turns the audio of videos we analyse into a transcript	The audio track of videos we analyse
Web data collection provider	Retrieves public posts, profiles and videos from social platforms, and reads your website when you ask	Links you submit, public account handles, your website address
Email delivery provider (US)	Sends our emails	Email address, name, email content
PostHog (US)	Product analytics, error tracking, session replay, heatmaps, surveys, and quality checks on Silma's answers	Usage events, account ID and email once you sign in, IP address and approximate location, replays, your chats with Silma and the context used to answer them. Analytics cookies, replay, heatmaps and surveys only after you accept.
Google Analytics 4	Page-view analytics on silma.app, only after you accept cookies	Pages viewed, device and approximate location, an analytics cookie identifier. Advertising signals are always off.

Your video files and uploaded frames are never sent to our analytics providers. You can ask us at support@silma.app for the current list of the providers named here by category.

Platforms you connect: if you connect Instagram, YouTube or TikTok, we call Meta's Instagram Graph API, Google's YouTube Data and YouTube Analytics APIs, or the TikTok Display API on your behalf. Each platform processes those requests under its own policies: Instagram Privacy Policy, YouTube Terms of Service and Google Privacy Policy, TikTok for Developers Terms and TikTok Privacy Policy.

Embedded players: when you open a post to watch it, Silma may show the platform's own player (Instagram embed, YouTube embed, or the TikTok player) inside the page. That player is loaded from the platform, which can see your IP address and set its own cookies under its own privacy policy. Players load only when you open a post, never in the background.

Other disclosures: we may disclose data if the law requires it, to protect the rights and safety of users or the public, or to a successor if SILMA LLC is involved in a merger or sale, in which case this policy continues to apply to your data.

5. International data transfers

We are based in the United States and our providers process data in the United States and other countries. If you are in the EU, EEA, UK or Switzerland, your personal data is transferred to the United States. Where required, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or a provider's certification under the EU-US Data Privacy Framework.

6. How long we keep data

Pre-Check frames: deleted automatically within 48 hours of upload. When a full video is uploaded for server-side processing (because your browser could not decode its format), that file is deleted immediately after frames are extracted.
Analysis results, chat history, brand profile, signup quiz answers: kept while your account exists.
Videos and thumbnails you save: kept while your account exists. You can remove individual videos at any time from Silma.
Instagram reels read by username: kept while that username is saved on your brand. Changing or removing the username deletes them, along with their count history and stored cover images, and deleting a brand deletes them too (the cover images are removed by a cleanup job that runs just after).
Instagram insights and access token: kept while your Instagram account stays connected. Disconnecting it in the app stops syncing and deletes the stored access token, but keeps your already-synced post insights. Use "Delete my Instagram data" in the app to remove that data along with the connection. You can also request deletion through Meta, which we honour via Meta's data deletion callback; see Delete your data. If someone removes Silma from their Instagram connected apps, we delete the connection and the access token on Meta's deauthorization notice.
YouTube analytics and access token: kept while your YouTube channel stays connected. Disconnecting it in the app immediately deletes the stored metrics and the access token. As the YouTube API Services Terms require, if a connection stays in an error state for more than 30 days without a successful re-sync, we automatically delete both the stored analytics and the connection.
TikTok data and access token: kept while your TikTok account stays connected. Disconnecting it in the app stops syncing and deletes the stored access token, but keeps your already-synced video insights and follower history. Use "Delete my TikTok data" in the app to remove that data along with the connection. If a video disappears from your TikTok account (deleted or made private), we remove it from your Silma content view on the next sync. If a connection stays in an error state for more than 30 days without a successful re-sync, we automatically delete the connection with its stored insights and follower history.
Newsletter subscribers: until you unsubscribe.
Analytics data: kept by PostHog under our retention settings; session replays are kept for a limited period and then deleted automatically.
Billing records: up to 7 years to meet tax and accounting rules.
Account deletion: when you ask us to delete your account, we delete your personal data within 30 days, except what the law requires us to keep. Copies in encrypted database backups expire on the normal backup cycle.

7. Your rights

Depending on where you live (including the EU, EEA, UK and US states such as California), you have the right to:

Access the personal data we hold about you and get a copy
Correct inaccurate or incomplete data
Delete your account and personal data
Port your data in a structured, machine-readable format
Restrict processing in certain circumstances
Object to processing based on legitimate interests, including direct marketing
Withdraw consent at any time, for example to analytics cookies or the newsletter
Opt out of any sale or sharing of personal data for targeted advertising. We do neither, so there is nothing to opt out of, but you can still ask.

To use any of these rights, email support@silma.app. We will confirm your identity using the email on your account and reply within 30 days (45 days where US state law allows). We will not treat you differently for using your rights. You can also complain to your data protection authority; EU and EEA residents can find theirs at edpb.europa.eu, and UK residents can contact the ICO.

8. Security

We use encrypted connections, access controls on every request, and encryption at rest through our infrastructure providers. Access to personal data is limited to the systems and people that need it to run the Service. No system is perfectly secure, so please use a strong, unique password.

9. Data breaches

If a personal data breach puts your rights at risk, we will notify the relevant supervisory authority within 72 hours as GDPR Article 33 requires, and tell affected users without undue delay where Article 34 or US state law requires it.

10. Cookies and similar technologies

We use a small number of cookies and browser storage entries. Strictly necessary ones are always on because the Service cannot work without them. Analytics ones are off until you choose Accept in our cookie banner. If you choose Decline, we set no analytics cookies and record no session replays; we may still count page views without cookies. You can change your choice at any time from the cookie settings link on our sites, or by clearing this site's data in your browser. We do not use advertising cookies or ad pixels.

Name	Purpose	Provider	Duration	Category
Sign-in cookies	Keep you signed in and protect your session	Clerk (first party)	Session to 1 year	Strictly necessary
Your consent choice	Remembers whether you accepted or declined analytics	Silma (first party, browser storage)	Until you change it or clear site data	Strictly necessary
PostHog analytics cookie and storage	An anonymous ID so we can tell visits apart and, once you sign in, link them to your account; session replay state	PostHog (first party)	1 year	Analytics, only after Accept
Google Analytics cookies	Counts visits to silma.app	Google Analytics (silma.app only)	Up to 2 years	Analytics, only after Accept

The app also keeps a few settings in your browser's local storage, such as your theme, Discover filters, the brand you last used, and your signup quiz progress and referral source until you create an account (then they are saved to your account). These are strictly necessary for features you use and are not used for analytics.

11. Age limit and children

Silma is a paid business tool for adults. You must be at least 18 years old to use it, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, email support@silma.app with the account email if you know it. We will delete that account and all data linked to it (profile, brand profile, quiz answers, chats, saved videos, connected-account data, and analytics identifiers) within 30 days, and cancel any subscription.

12. Changes to this policy

We may update this policy. If a change is material, we will email account holders before it takes effect. The date at the top shows the latest version.

13. Contact

SILMA LLC, 522 W Riverside Ave Ste N, Spokane, WA 99201-0581, United States. Email: support@silma.app.