diff --git a/buffit/index.html b/buffit/index.html
index ce1cb40..693d935 100644
--- a/buffit/index.html
+++ b/buffit/index.html
@@ -14,8 +14,6 @@
 <meta name="twitter:image" content="https://danielmorrisey.com/media/image/seo/buffit.png">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link href="https://fonts.googleapis.com/css2?family=Lora:ital,wght@0,400;0,600;1,400&family=DM+Sans:wght@400;500;600&display=swap" rel="stylesheet">
-<script src="https://kit.fontawesome.com/0ca27f8db1.js" crossorigin="anonymous"></script>
-<script type="module" src="https://cdn.jsdelivr.net/npm/emoji-picker-element@1"></script>
 <style>
   :root {
     --bg: #0e0d0c;
@@ -468,45 +466,11 @@
 
   footer a { color: var(--text-faint); }
 
-  #emoji-picker-modal {
-    display: none;
-    position: fixed;
-    inset: 0;
-    background: rgba(0, 0, 0, 0.5);
-    z-index: 1000;
-    align-items: center;
-    justify-content: center;
-  }
-
-  #emoji-picker-modal.show {
-    display: flex;
-  }
-
-  #emoji-picker-container {
-    background: var(--bg-raised);
-    border: 1px solid var(--border);
-    border-radius: 12px;
-    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.3);
-    width: 90%;
-    max-width: 380px;
-    max-height: 500px;
-  }
-
-  emoji-picker {
-    --category-emoji-padding: 0.5rem;
-    --category-emoji-size: 1.5rem;
-    --emoji-padding: 0.25rem;
-    --emoji-size: 1.25rem;
-    --font-family: 'DM Sans', sans-serif;
-    --skin-tone-indicator-height: 3px;
-  }
-
   @media (max-width: 480px) {
     .panel, .composer-panel { border-radius: 10px; }
     .panel { padding: 30px 22px; }
     textarea { padding: 24px 22px 8px; font-size: 18px; }
     .composer-footer { padding: 12px 22px 18px; }
-    #emoji-picker-container { width: 95%; max-height: 60vh; }
   }
 </style>
 </head>
@@ -527,7 +491,7 @@
   <div class="connect-screen" id="connectScreen">
     <div class="panel">
       <h1>Connect your Buffer account</h1>
-      <p>Share your ideas and thoughts instantly to your social media accounts using Buffer. Everything runs in your browser, no data is sent or stored anywhere. <br>
+      <p>Share your ideas and thoughts instantly to your social media accounts using Buffer, with support for media uploading!<br>
         You may read our <a href="/buffit/privacy.html" target="_blank">privacy policy</a> for more information.
       </p>
 
@@ -539,8 +503,8 @@
   <!-- COMPOSER SCREEN -->
   <div class="composer" id="composerScreen">
     <div class="account-bar">
-      <span><span id="accountLabel">Connected</span></span>
-      <button id="disconnectBtn">Disconnect</button>
+      <span><span id="accountLabel">Connected</span> <button id="refreshBtn" class="account-action">Refresh</button></span>
+      <button id="disconnectBtn" class="account-action">Disconnect</button>
     </div>
 
     <div class="composer-panel">
@@ -549,7 +513,6 @@
       <div class="composer-footer">
         <div class="footer-left">
           <button class="media-btn" id="mediaBtn" type="button"><i class="fa-solid fa-image"></i></button>
-          <button class="media-btn" id="emojiBtn" type="button"><i class="fa-solid fa-face-smile"></i></button>
           <span class="charcount" id="charCount">0</span>
         </div>
         <button class="btn-primary" id="sendBtn" style="width:auto;margin:0;padding:10px 22px;">Post now</button>
@@ -568,12 +531,6 @@
   <footer>BuffIT never sees your Buffer credentials · tokens live only in this browser tab</footer>
 </div>
 
-<div id="emoji-picker-modal">
-  <div id="emoji-picker-container">
-    <emoji-picker></emoji-picker>
-  </div>
-</div>
-
 <script>
 (function () {
   const PROXY_BASE = 'https://buffit-proxy.madebydannyuk.workers.dev';
@@ -597,8 +554,8 @@
   const sendBtn = $('sendBtn');
   const channelList = $('channelList');
   const accountLabel = $('accountLabel');
+  const refreshBtn = $('refreshBtn');
   const mediaBtn = $('mediaBtn');
-  const emojiBtn = $('emojiBtn');
   const mediaInput = $('mediaInput');
   const mediaPreview = $('mediaPreview');
 
@@ -978,27 +935,6 @@
 
   mediaBtn.addEventListener('click', () => mediaInput.click());
 
-  // ---------- emoji picker ----------
-  const emojiModal = $('emoji-picker-modal');
-  const emojiPicker = document.querySelector('emoji-picker');
-
-  emojiBtn.addEventListener('click', () => {
-    emojiModal.classList.add('show');
-  });
-
-  emojiModal.addEventListener('click', (e) => {
-    if (e.target === emojiModal) {
-      emojiModal.classList.remove('show');
-    }
-  });
-
-  emojiPicker.addEventListener('emoji-click', (e) => {
-    postText.value += e.detail.unicode;
-    postText.dispatchEvent(new Event('input'));
-    emojiModal.classList.remove('show');
-    postText.focus();
-  });
-
   mediaInput.addEventListener('change', () => {
     const files = Array.from(mediaInput.files || []);
     mediaInput.value = '';
@@ -1131,6 +1067,38 @@
     updateSendState();
   });
 
+  refreshBtn.addEventListener('click', async () => {
+    const tokens = loadTokens();
+    if (!tokens) return showConnect();
+
+    refreshBtn.disabled = true;
+    const originalText = refreshBtn.textContent;
+    refreshBtn.textContent = 'Refreshing…';
+
+    try {
+      const res = await fetch(PROXY_BASE + '/channels', {
+        method: 'GET',
+        headers: { 'Authorization': 'Bearer ' + tokens.access_token },
+      });
+      const data = await res.json();
+
+      if (!res.ok || !data.success) {
+        throw new Error(data.error || 'Failed to refresh channels');
+      }
+
+      allChannels = data.channels || [];
+      selectedChannelIds.clear();
+      renderChannels(allChannels);
+      setStatus(composerStatus, 'Channels refreshed.', 'success');
+      setTimeout(() => setStatus(composerStatus, '', null), 2000);
+    } catch (e) {
+      setStatus(composerStatus, 'Failed to refresh: ' + e.message, 'error');
+    } finally {
+      refreshBtn.disabled = false;
+      refreshBtn.textContent = originalText;
+    }
+  });
+
   disconnectBtn.addEventListener('click', () => {
     clearTokens();
     selectedChannelIds = new Set();
diff --git a/buffit/privacy.html b/buffit/privacy.html
index a6399e6..04a1897 100644
--- a/buffit/privacy.html
+++ b/buffit/privacy.html
@@ -181,25 +181,46 @@
 
     <div class="panel">
       <h1>Privacy</h1>
-      <p class="intro">BuffIT helps you post to your social media accounts instantly using Buffer. We do not store your Buffer credentials on our servers.</p>
+      <p class="intro">BuffIT helps you post to your social media accounts instantly using Buffer. Your access tokens are stored only in your browser session and never transmitted to our servers.</p>
+
       <div class="section">
         <h2>App Permissions</h2>
-        <p>Buffit only requests the permissions it requires to function.</p>
+        <p>BuffIT requests only the permissions needed to function:</p>
+        <ul>
+          <li><b>Account Read</b>: Read access to your Buffer account and connected channels</li>
+          <li><b>Posts Write</b>: Create and publish posts to your social media accounts</li>
+        </ul>
+      </div>
+
+      <div class="section">
+        <h2>What is shared with Buffer</h2>
         <ul>
-          <li><b>Account Read</b>: Read access to account information</li>
-          <li><b>Posts Write</b>: reate and manage posts and queue</li>
+          <li>Your post content and selected channels are sent to Buffer when you press "Post now".</li>
+          <li>Media files are uploaded to our CDN and the URL is included in your post.</li>
         </ul>
       </div>
 
       <div class="section">
-        <h2>What is shared</h2>
+        <h2>Backend services</h2>
+        <p>BuffIT uses a Cloudflare Worker backend for:</p>
         <ul>
-          <li>The content you choose to post is sent directly to Buffer.</li>
-          <li>Your selected channels and post text are sent to Buffer when you press post.</li>
-          <li>BuffIT does not store any data on external servers/databases.</li>
+          <li><b>OAuth handling</b>: Securely exchanges your authorization code for an access token (client secret never exposed to browser).</li>
+          <li><b>Media storage</b>: Accepts file uploads and stores them in Cloudflare R2 object storage. Files are publicly accessible via the CDN.</li>
+          <li><b>Channel caching</b>: Caches your Buffer channels for 1 hour to reduce API calls to Buffer. Cache is keyed by a hash of your access token and is only accessed with valid authorization.</li>
         </ul>
       </div>
-      <p>You can always disconnect Buffit from your Buffer account at any time.</p>
+
+      <div class="section">
+        <h2>Data retention</h2>
+        <ul>
+          <li>Your access token is stored in your browser's session storage only and is not sent to our servers.</li>
+          <li>Cached channel data expires automatically after 1 hour.</li>
+          <li>Uploaded media files are stored indefinitely on our CDN until manually deleted.</li>
+          <li>We do not log or store your posts, channels, or account information.</li>
+        </ul>
+      </div>
+
+      <p>You can disconnect BuffIT from your Buffer account at any time. Disconnecting clears your browser session and revokes future access, but does not delete previously uploaded media files.</p>
     </div>
   </div>
 </body>