Privacy Policy

SupahPost ("we", "us") helps creators, agencies, and social-media managers create, schedule, publish, and analyze content across the social accounts they connect. This policy explains what we collect, how we use it, how long we keep it, and your choices.

SupahPost is offered only in the United States. It is for people and businesses located in the United States, aged 18 or over. It is not offered in the European Economic Area, the United Kingdom, Switzerland or anywhere else outside the United States, and we may refuse or close an account that is outside the United States. If you are outside the United States and believe we hold information about you, email privacy@supahpost.com and we will delete it.

1. Information we collect

• Account information — your name, your email, your password (stored only as a salted hash), your workspace name, and any team members you add. If you sign in with Google, where we offer that, Google tells us your name, your email address and that it has verified the address; we never receive your Google password.
• Two-step sign-in, if you turn it on — this is optional and off unless you switch it on for yourself. When it is on, a correct password, or a sign-in with Google, is followed by a six-digit code that we email to your account's address and that works for 10 minutes. The one sign-in that is not asked for a code is the password sign-in made in the few minutes after you reset your password by email. We keep whether you have it switched on, and the code itself only in scrambled (hashed) form with its expiry time. The code goes to you through the email provider named in section 5a and to nobody else.
• The Terms you agreed to — the version of our Terms of Service you agreed to, and when, kept on your account, together with a history entry holding your account, the version, the time and how you agreed: when you signed up, when you accepted an invitation, when you signed in with Google, or on the screen that asks again after the Terms change. We do not record an IP address, a device or a location with it. It is deleted with your account.
• From the social accounts you connect — for every platform, the account's public identity (name or handle, platform account ID, profile picture and, where the platform provides it, category), the post content you create or have published through us (text, media, links, type), the metrics that platform reports for those posts and for the account (likes, comments, shares, views, reach or impressions where available), and the OAuth access and refresh tokens needed to act on your behalf. What each platform gives us differs, and section 3 sets it out platform by platform. We do not access your personal profile data, private messages, direct messages, contact or friend lists, or any information you have not explicitly authorized, on any platform.
• Each workspace holds its own copy — when you connect an account, the posts and statistics we sync are stored as your workspace's own records. If somebody else — an agency you work with, or a client — connects the same account in their own workspace, they get their own separate copy. Neither workspace can see the other's, and removing the account from one leaves the other's untouched.
• Text we read out of a public post — for the posts on the Facebook, Instagram, TikTok and X accounts you connect, we use an automated service (Google Gemini — section 4a says exactly what is sent) to read the words visible inside the picture (for example a screenshot of a tweet) and to describe what the image shows, so you can search your own posts by what is in them. Because that text is read out of a post the platform already publishes to everyone, we keep one copy of it per post rather than one per workspace, and show it to any workspace that connects the same public account. It is read-only in that form: it never contains anything private, and any correction you type over it stays in your workspace alone and is never shown to anyone else.
• What the public writes under your posts, and posts that tag you — for a connected Facebook Page or Instagram account we read the public comments on your recent posts, with the commenter's public name or handle, and for Instagram the public posts that tag your account or name it as a collaborator. These are other people's words and names, so section 2a sets out what we keep, for how long, and how such a person can ask us to remove it.
• Competitor accounts you choose to follow — if you add a competitor, we read publicly available information about that account: its public profile details and follower count, its public posts, and the public engagement counts on them (likes and comments; for Facebook Pages, reactions by type and shares as well). Instagram business and creator accounts are read through Instagram's own API, using the Instagram account you connected. Public Facebook Pages are read through Meta's own API for public Page content, with SupahPost's own app credentials rather than your account; while Meta reviews that access, following Facebook Pages is limited to our own workspace and a review workspace. Section 2a has the details.
• Content you create — graphics, captions, carousels, and posts you compose or schedule, and the media you upload.
• Video you upload, edit, or import — SupahPost includes a video editor. We store the video files you upload (up to 250 MB per clip), any video you import by pasting a link to a post on X, the edit itself (your cuts, layers, text, timing, and format), the frames we extract for cover images, and the finished files you export. Exported video can be published to your connected accounts as a Reel, a feed video, or a Story. Video you upload into the editor is edited on our own servers using standard open-source tooling; we do not send it to any AI service, and we do not transcribe its audio. Videos already published on a Facebook Page or Instagram account you connect are handled differently, and section 4a says how.
• A post you bring in by pasting a link — when you paste a link to a post on X, we fetch that public post: its text, the author's name and handle, and its pictures or video. We keep it as media in your workspace until you delete it. Links to X are the only links to a social post that we fetch this way for customers. A link to an image is a different thing, described next.
• Images found on the web, or brought in by link — this happens only if an admin of your workspace has turned it on. When a graphic needs a photo, the words we search for are sent to a web image-search provider. Those words come from what you asked for or from the draft you are working on, so they can include a name that appears in your post. Our servers download the candidate images, and send them, with the subject searched for, to an AI vision service that ranks them. If the image search finds too little, the subject is sent to an AI service that searches the web and reads pages itself to find image addresses. Where a draft was made from a video on a connected YouTube channel, neither AI service is used and nothing about that video is sent to them (section 3c). If you paste a link to an image, or to a page that shows one, our servers fetch that address. For each image that is kept we store the image as media in your workspace, with the address it came from, the page it was on where we know it, which search found it, whether it was chosen automatically, picked by a person or pasted, which member asked for it, when, and a fingerprint of the file. We also keep which admin turned the feature on, when, and which wording of the acknowledgement they accepted. An admin of your workspace can turn the feature off at any time in Settings: from then on no image is searched for, sent to those services or fetched from a pasted link for your workspace, we keep which admin turned it off and when, and nothing already kept is removed, so the images in your library and the records described here stay. Sections 4a and 5a name the companies involved and what each one receives.
• Billing information — handled by our payment processor, Stripe. We never see or store full card numbers.
• Usage data — the records needed to operate and secure the service. Section 5b lists them, including the places where an IP address is recorded.
• A record of changes made in your workspace — when someone invites or removes a member, changes a role, connects or removes an account, makes or revokes an access key or a share link, changes the plan, or takes a similar action, we record the action, who took it and when. It records that something was done, never the content it was done to. Only admins of the workspace can read it. It is kept for 13 months and is deleted with the workspace.
• If you join our mailing list or ask for access — the email address you typed, when and where you signed up, whether you confirmed it, and whether you later unsubscribed; and, for a request for access, the answers you gave on the form (how many accounts you run, how often you post, the tools you use, and whether your pages are monetized). For the emails we send to that list we record whether each one was delivered, bounced or was marked as spam, and, where our email provider reports it, whether it was opened or a link in it was clicked.
• Records that stop a free trial being taken twice — when a free trial starts we keep a one-way fingerprint of the email address and the card fingerprint our payment processor gives us (a token, never a card number), so the same person or card is not given a second trial.

2. How we use your information

We use the data we collect only to provide and improve the service to you:

• Create on-brand graphics, carousels, and captions.
• Edit video and export it in the formats your connected platforms accept.
• Schedule and publish your posts — photos, carousels, video, Reels, and Stories — to the accounts you connect.
• Show your page/account performance, with search, filtering, and date ranges.
• Show you the public comments on your posts, and how the public accounts you follow as competitors are doing.

We do not sell or rent your data, use it for advertising, retargeting or cross-app profiling, use it to train any AI model, or share one customer's data with another. We do not combine data from your different connected platforms to build a profile of you. Each customer's data is isolated to their own workspace.

2a. People who are not our customers

Some of what a workspace holds is about people who never signed up to SupahPost. This section says what that is, why we have it, how long it is kept, and how to have it removed.

• People who comment on a customer's posts. For a connected Facebook Page or Instagram account, we read the public comments on its recent posts: the comment text, the commenter's public name or handle as the platform shows it, the comment's like and reply counts, and when it was written. We do not keep the commenter's account ID. It is there so the customer can read and answer their comments in one place, see which ones may be spam, and see who comments most often on their own posts. Each comment is deleted 90 days after we read it, at the latest, and sooner if the customer removes the account.
• People whose Instagram posts tag a customer's account, or who collaborate on a post with it. We keep the public post (its caption, a link to it and to its picture, and when it was posted) and the username and Instagram account ID of the account that posted it or was invited to collaborate. It is kept until the customer removes that Instagram account or deletes the workspace.
• Accounts a customer follows as competitors. We keep the account's public profile details (name, handle, profile picture, follower count), its public posts, and the public engagement counts on them (likes and comments; for Facebook Pages, reactions by type and shares). Only public business, creator and Page information is read; nothing private is, and we never read the text of comments or who wrote them. It is kept until the customer stops following that account or deletes the workspace.
• The author of a post on X that a customer pastes a link to. We keep the public post, with the author's name and handle, as media in that customer's workspace until they delete it.
• People shown in, or who made, an image found on the web. Where a customer's workspace has web images turned on, a publicly available image, and the address it came from, can be kept as media in that workspace until the customer deletes it or the workspace. If it is your image, or you are in it, write to us as described below; a copyright owner can also use the notice process in our Terms of Service.
• People who send us a copyright notice or a counter-notice. We use the name and contact details in a notice to handle it, and keep the notice as a record of what we did. If the customer answers with a counter-notice, the law requires us to send a copy of it, including the name, address and telephone number in it, to the person who sent the notice.
• People who leave feedback on a shared calendar. A customer can share a content calendar by link. A visitor who leaves feedback types a name (anything they choose) and their comment; we keep those two things and nothing else about the visitor. They are deleted after 180 days at the latest.
• People who are invited to a workspace. We keep the email address the customer typed, and any note they wrote to go with the invitation, so the invitation can be sent and accepted. It stays with the workspace until the workspace is deleted or you ask us to remove it.

We do not build a profile of any of these people across customers: each workspace's copy is separate, we do not join one workspace's records to another's, and we do not sell this information or use it for advertising. Inside one workspace, the customer can see how often the same public name has commented on their own posts.

If you are one of these people and want something removed, email privacy@supahpost.com and tell us what it is — a link to the post or comment, or the account name, is enough. We will remove what we hold and confirm it. We can only remove our copy: the original stays on the platform where it was posted, and that platform's own tools are how you delete it there.

3. The platforms you connect, one by one

SupahPost connects to a social platform only when you authorize it, and only through that platform's own sign-in screen. We never see, ask for, or store your password for any connected platform. In every case we request the narrowest set of permissions the features you use require, we use the resulting data solely to deliver those features to you, and you can disconnect at any time — from SupahPost, from the platform's own app settings, or both.

As at the date at the top of this page, the platforms you can connect are Facebook Pages, Instagram accounts, TikTok accounts, YouTube channels and X accounts. Each section below describes that connection as it actually works, and we hold no data for a platform you have not connected. Two limits are on publishing rather than on connecting, and they are the platforms' own: anything we publish to TikTok and YouTube arrives on your account as private, visible to you, for you to make public yourself — sections 3b and 3c say why. Threads and LinkedIn cannot be connected at all — see section 3e. We will update the date above when any of this changes.

Each platform section below tells you the same five things in the same order: how the connection is made, what permissions we ask for and what each one is for in plain words, what we store and for how long, what we do with it, and how to disconnect — both inside SupahPost and from the platform's own settings.

3a. Meta — Facebook Pages and Instagram

How it connects. Facebook Login. You choose which Pages to grant on Facebook's own screen, and an Instagram Business or Creator account is connected through the Facebook Page it is linked to, using that Page's access. We do not use Instagram Login (the newer route that signs you in with an Instagram account directly): the insights permissions an analytics product needs exist only on the Facebook Login side, so Instagram always arrives by way of its linked Page. If we ever add Instagram Login we will describe it here first.

The permissions we ask for, in words.

• See the list of Pages you manage (pages_show_list), so we can show you which Pages you can connect.
• Read a Page's posts, its engagement and the content posted on it (pages_read_engagement, pages_read_user_content), so your posts and their likes, comments and shares appear in SupahPost.
• Read a Page's insights (read_insights), so we can show views, reach, followers over time, and audience breakdowns — and, for a Page enrolled in Meta's Content Monetization Program, the earnings Meta reports for its posts.
• Manage a Page's settings metadata and see the business it belongs to (pages_manage_metadata, business_management), which is what lets us hold a Page access token and receive Meta's notifications about it.
• Read your Instagram account and its insights, and read and post comments (instagram_basic, instagram_manage_insights, instagram_manage_comments).
• Publish to a Page and to Instagram, and post the first comment (pages_manage_posts, instagram_content_publish, pages_manage_engagement) — only for the posts you compose and schedule.

We ask for nothing about your personal Facebook profile, your friends, your ad accounts or your messages. That sentence is about the permissions we request. The public comments people leave on your Page's and your Instagram account's posts, and public Instagram posts that tag your account, do reach us through the permissions listed above; section 2a says what we keep of them.

What we receive and store. The Page or account's public details (name, ID, category, profile picture, follower count); the posts on it, with their text, media, links and type; the post- and account-level metrics and insights Meta reports, including audience breakdowns and, for Pages enrolled in Meta's Content Monetization Program, the earnings figures Meta reports for those posts; the public comments on your recent posts, with each commenter's public name or handle; for Instagram, the public posts that tag your account or name it as a collaborator; and the Page Access Tokens needed to read and publish.

One Page, more than one workspace. A Page can be connected by more than one workspace — an agency alongside its client, for example. Each workspace holds its own copy of the posts, metrics and earnings it reads from Meta, using its own Page Access Token; no workspace can read another workspace's copy, and removing the Page from one workspace deletes only that copy. The one thing kept once rather than per workspace is the text our automated reader transcribes out of a post's public picture (see section 1); it contains nothing private, it is never a workspace's own edits, and it is shown read-only.

How long we keep it. For as long as the Page or account is connected, so your history and reports stay intact. Removing the account, or deleting the workspace, deletes it — see sections 7a, 7b and 8.

What we do with it. Publish and schedule the posts, Reels and Stories you create; show you your own analytics; show you the comments on your posts so you can answer or hide them, which happens only when you choose to; and read what is in your posts' pictures and published videos so you can search them (section 4a names the companies that do that reading for us).

Limited Use. Our use of information received from Meta APIs adheres to Meta's Platform Terms and Developer Policies. We use Meta Platform Data only to provide and improve the features you see in SupahPost; we do not sell it, transfer it to a data broker, use it for advertising, retargeting or any cross-app profiling, use it to train any AI model, or combine it with data from your other platforms to build a profile of you. We keep it only while you have the account connected. We delete it when you remove the account from SupahPost or delete the workspace. If you remove SupahPost on Facebook instead, we delete the stored tokens and connection records at once, and the posts and statistics already collected into a workspace are deleted when the account is removed from that workspace or when you ask us — section 8 explains why those are two steps.

Revoking and deleting. Remove the account on the Connections screen, delete the workspace, or remove SupahPost from Facebook at Settings & privacy → Settings → Business integrations (older accounts show this as Apps and Websites) — facebook.com/settings?tab=business_tools. When you remove us there, Facebook notifies us and we delete the stored tokens and connection records at once. Our full data deletion instructions set out all four routes; see also sections 7b and 8.

3b. TikTok

How it connects. TikTok Login Kit. You sign in on TikTok's own screen and approve the permissions there; SupahPost never handles your TikTok credentials.

What we receive and store.

• Basic profile information (the user.info.basic scope) — your TikTok display name, avatar image and the pseudonymous account identifier TikTok issues to us (your “open ID”). We store this so you can see which TikTok account is connected and so we know where to publish. We do not receive your email address, phone number, date of birth, or the content of anyone else's account through this scope.
• Your account's own follower and profile counts (the user.info.stats scope) — your follower count, following count, likes and video count, so your TikTok account appears in your dashboards alongside your other accounts.
• The list of your own videos (the video.list scope) — the videos on your own account, with their title, cover image, duration, link and the view, like, comment and share counts TikTok reports for them. This is read-only, and it covers your own account only.
• Content you send to TikTok through us (the video.upload and video.publish scopes) — the video file, its cover frame, the caption, and the posting options you choose, such as privacy level and whether comments, Duet and Stitch are allowed. video.upload places a video in your TikTok inbox as a draft for you to finish in the TikTok app; video.publish posts directly to your account. Either way, a post is only ever created because you composed and scheduled it in SupahPost — we do not post to TikTok on our own initiative, and we never add a watermark, logo or branding of our own to your video. You are shown the account it will post to, and the caption and settings it will use, before it goes.
• Post status — TikTok tells us, by webhook and by status check, whether an upload or publish succeeded, is still processing, or failed, and why. We store that outcome so the scheduler can show it to you and retry or report a failure. These events concern your own posts only.
• Tokens — the TikTok access token and refresh token issued to your connection. TikTok's access tokens expire 24 hours after they are issued and its refresh tokens after 365 days; we use the refresh token to renew access in the background, and where TikTok returns a new refresh token in that exchange we store the new one and discard the one it replaces. Both are encrypted at rest (see section 5).

What you see before anything is posted. Before a video is sent to TikTok we show you the TikTok account it will post to, identified by that account's nickname; a preview of the video and its cover; the caption, which you can edit, including any text or hashtags we suggested; and the posting options — privacy level, which you must choose because we set no default for you, and whether comments, Duet and Stitch are allowed. Nothing is sent to TikTok until you have expressly confirmed it. We do not add a promotional watermark, logo or branding of our own. After you publish, TikTok may take a few minutes to process the video before it appears on your profile.

Until we are audited by TikTok. TikTok restricts content posted through a developer that has not completed its Content Posting API audit to private viewing. While that applies to us, anything published to TikTok through SupahPost is visible only to you on TikTok, whatever privacy level you chose, and we say so at the point you schedule it.

What we do not do with TikTok data. We do not sell or rent it, use it for advertising, retargeting or any form of cross-app profiling, use it to train any AI model, combine it with data from other platforms to build a profile of you, or share it with another SupahPost customer. We do not scrape TikTok, and we do not collect data about TikTok users other than you.

Retention. We keep your TikTok profile details, the posts published through us and their status for as long as the account is connected. Disconnecting the account, or deleting your workspace, deletes them and the tokens — see sections 7a, 7b and 8.

Revoking. Remove the account on the Connections screen, or revoke SupahPost inside TikTok at Profile → Settings and privacy → Security & permissions → Manage app permissions. Revoking on either side stops our access; do both, or ask us, if you also want the collected data gone.

Our use of TikTok data adheres to the TikTok Developer Terms of Service, the TikTok Developer Guidelines and the TikTok Content Sharing Guidelines. Content you publish through us goes to your own TikTok account and is subject to the TikTok Terms of Service and Community Guidelines exactly as if you had posted it in the TikTok app.

3c. YouTube and Google

SupahPost uses YouTube API Services. When you connect a YouTube channel, the features that read your channel and publish to it run on YouTube's own APIs. By using them you also agree to the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. You can take our access away at any time at the Google security settings page. Everything below sets out our own handling: what we receive, what we do with it, who else sees it, how long we keep it, and how to end it. Questions or complaints about any of it go to privacy@supahpost.com.

How it connects. Google Sign-In (OAuth). You approve the scopes on Google's own consent screen.

The permissions we ask for, in words.

• Upload videos to your channel (youtube.upload) — the videos you compose and schedule in SupahPost, with the title, description, tags, thumbnail and privacy setting you chose.
• Read your own channel and videos (youtube.readonly) — read-only, so we can list your channel and the videos on it and show them in your dashboards. We deliberately do not ask for the read-write youtube scope, which would also let us manage your playlists and subscriptions; nothing here does that.
• Read your YouTube Analytics (yt-analytics.readonly) — read-only, for your own channel's watch time, average view duration and subscribers gained.
• Post the first comment on your own video (youtube.force-ssl) — this is the only permission Google offers that can post a comment, and it is broader than we would like, so it is separable: if it is not granted, the first-comment feature simply turns itself off and everything else still works.

What we receive and store. Your YouTube channel's public identity (channel name, channel ID, thumbnail); the videos you upload through us, with their title, description, tags, thumbnail and privacy setting; the analytics YouTube reports for your own channel and videos; and the Google OAuth access and refresh tokens for the connection, encrypted at rest.

What we do with it. Four things, and nothing else. Publishing: we send the videos you compose or upload in SupahPost to your channel at the time you chose, with the title, description, tags, thumbnail and privacy setting you set, and — if you asked for one and granted the permission — post your first comment under the video. Showing you your own numbers: your channel's videos, their view, like and comment counts and the analytics YouTube reports for them are displayed back to you in your dashboards, in your scheduler, in the reports and spreadsheets you export, and in the email or Slack digests you switch on. Searching and organising your own work: we read the words visible in a video's thumbnail so you can search your own posts by what is in them, and we group your videos alongside your posts on other platforms so a calendar or a report can cover them together. Keeping the connection alive: we use the stored tokens to refresh access, and to re-check on a 30-day cycle that you have not revoked us and that a video still exists. We do not use YouTube data for advertising, retargeting or profiling; we do not use it to train any AI model; we do not sell or rent it; we do not combine it with data from your other connected platforms to build a profile of you; and we do not use it for anything a customer other than you would benefit from.

Who it is shared with. Inside your workspace: the people you have added to it, subject to the per-tab, per-action and per-account permissions you give them — nobody else who uses SupahPost can see your workspace's YouTube data, and it is never pooled with another customer's. Inside our company: our staff do not read it, except with your affirmative agreement to look at specific data, where necessary to investigate abuse or a security incident, or to comply with applicable law; those administrative actions are written to an audit log. Outside our company: only the sub-processors that run the service on our behalf, listed by name in section 5a — today Render (application hosting), Supabase (the database), Cloudflare R2 (private object storage for your media) and Resend (the emails we send you). They process it under contract, only to run SupahPost, and they may not use it for their own purposes. Two things people reasonably assume and which are not true here: your YouTube data is never sent to an AI provider (the text-in-image reading in section 1 runs on the images your posts contain, and your YouTube video files are never sent to any third-party AI or media service), and it never leaves for anywhere you have not connected yourself. Your own AI assistant: if — and only if — you connect one in Settings, the assistant you chose can read your workspace's analytics on your behalf, using a key you create and can revoke. That connection does not exist until you make it. Everyone else: nobody. We do not sell, rent or trade YouTube data, and we do not hand it to advertisers, data brokers or analytics networks. We disclose it otherwise only where the law requires it, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.

How long we keep YouTube data. YouTube's Developer Policies set stricter retention rules than any other platform we connect, and these are the rules we apply to YouTube data. They apply from the moment a channel is connected, and they are enforced by a daily sweep rather than by hand: anything that is not a statistic is re-fetched or deleted on the 30-day cycle below, your statistics are re-verified on the same cycle, and they are purged at 36 months at the latest. Uploads published through SupahPost land on your channel as private until YouTube completes its audit of our API client, at which point you choose the visibility yourself; that is a limit on publishing, not on this section, which governs everything we store either way.

• Video details — refreshed or deleted within 30 days. Everything we obtain from YouTube API Services that describes a video rather than counts something — its title, description, thumbnail, link, duration and privacy setting, and any text we read out of the thumbnail — is either re-fetched from the YouTube API or removed from our systems within 30 days of being stored.
• Your channel's statistics — up to 36 months, on two standing checks. The counts YouTube reports for your own channel and videos (views, likes, comments, subscribers, video count) may be kept for up to 36 months so your long-run charts and reports do not go blank. They are yours, read with your own permission, and we keep them only while two things stay true, both re-checked every 30 days automatically: that you have not revoked our access, and that the video still exists on YouTube. If either stops being true we delete what we hold — a revoked connection removes your stored YouTube data the same day, and a video you delete on YouTube takes its stored numbers with it. Anything we calculate on top of them — averages, trends, rates and comparisons — is presented as SupahPost's own calculation and never as a figure YouTube reported.
• On request, within 7 days. If you ask us to delete YouTube data, we do it within seven days. Removing the channel in Settings → Profiles, or deleting the workspace, does it immediately.
• If you revoke. Revoking SupahPost at Google (below) ends our access at once. We notice it on the next daily check at the latest, and delete the stored tokens and the YouTube data we hold — statistics included — rather than keeping anything on a permission you have withdrawn.

How we protect YouTube data. Everything we receive from YouTube API Services is handled the same way as our most sensitive data, and the mechanisms are these. In transit: every request between your browser and SupahPost, and between SupahPost and Google, is made over HTTPS (TLS 1.2 or later); we never use unencrypted transport. At rest: your Google OAuth access and refresh tokens are encrypted with AES-256-GCM using a key held only in server configuration and never stored in the database, are decrypted only in memory at the moment a request to Google is made, and are never written to logs or returned by our API; YouTube data, and the database as a whole, is stored on encrypted disks, and our backups are encrypted and held in private storage. Isolation: every record carries the identifier of the workspace it belongs to, and the application reads and writes the database under a restricted role with row-level security, so a query that failed to scope itself returns nothing rather than another customer's data. Access control: within a workspace, access is role-based with per-tab, per-action and per-account permissions, and only the people you have added to the workspace can see its YouTube data; our staff do not read it except with your affirmative agreement to view specific data, to investigate abuse or a security incident, or to comply with applicable law, and administrative actions taken across workspaces are written to an audit log. Minimisation and retention: we request only the scopes the YouTube features you use require, store only what those features need, and apply the retention and deletion schedule above — non-public data refreshed or deleted within 30 days, deletion on request within 7 days, and immediate deletion of tokens and data when you disconnect or revoke. Incidents: if we become aware of unauthorised access to YouTube data we hold, we will notify affected users and Google without undue delay. Section 5 describes these controls for every platform we connect.

Limited Use. SupahPost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we limit our use of that data to providing and improving the user-facing features that are visible and prominent in SupahPost's own interface; we do not transfer it except to provide or improve those features with your consent, for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent; we do not use or transfer it for serving advertising, including retargeting, personalized or interest-based advertising; we do not use it to determine creditworthiness or for lending purposes; we do not sell it or transfer it to data brokers; and we do not allow humans to read it except with your affirmative agreement to view specific data, where necessary for security purposes or to investigate abuse, to comply with applicable law, or where the data is aggregated and de-identified and used for internal operations. We do not use Google user data to train any AI model. We require our employees, agents, contractors and successors to comply with the same policy.

Revoking. Remove the channel in Settings → Profiles, or revoke SupahPost's access to your data via the Google security settings page at security.google.com/settings/security/permissions (also reachable as myaccount.google.com/permissions).

YouTube and Google terms. SupahPost's YouTube features are an API Client built on YouTube API Services. By using them you are agreeing to be bound by the YouTube Terms of Service. Google's own handling of your information is described in the Google Privacy Policy (also published at google.com/policies/privacy); this policy describes ours.

3d. X

How it connects. X's own OAuth sign-in screen, where you approve the permissions. SupahPost never handles your X password.

What X is for here: publishing your posts, and reading how your own posts did. SupahPost publishes the posts you compose, and reads back your own account's posts and their metrics so they appear in your analytics alongside your other accounts. It does not read your timeline or feed, anyone else's posts, your followers list, your likes, or your Direct Messages, and it never reads another account's data on your behalf.

The numbers we read, named. For each of your own posts: the public counts X publishes (likes, replies, reposts, quotes, bookmarks and, where X provides it, impressions) and the owner-only figures X returns for your own recent posts (impressions, profile clicks and link clicks). For the account: your follower and following counts and your total post count. X makes the owner-only figures available for roughly your last 30 days of posts; where X does not return one, we record nothing rather than a zero.

The cost of those reads is ours, not yours. SupahPost limits how many posts it reads from X for a workspace each day. You are never billed for reading your own data.

The permissions we ask for, in words.

• Post on your behalf (tweet.write) — to publish the posts you compose and schedule.
• Read your own posts and their metrics (tweet.read, which X also requires to be requested alongside tweet.write) — to confirm a post we sent was created, and to show you how your own posts performed. We use it only on your own account's posts.
• See who you are (users.read) — your X handle, display name, account ID and profile picture, so you can see which X account is connected and where a post will go, and your follower count so it appears in your audience figures.
• Upload media (media.write) — to attach the image or video you chose to your post.
• Stay connected (offline.access) — X access tokens last two hours, so we hold a refresh token to renew access in the background rather than asking you to sign in again every two hours. X's refresh tokens are single use: each renewal issues a new one, which we store in place of the old one.

What we receive and store. Your X account's public identity (handle, display name, account ID, profile picture) and its follower, following and post counts; the posts you publish through us, with their text and media, and the post ID and outcome X returns; your own account's posts and the per-post metrics listed above; and the access and refresh tokens for the connection, encrypted at rest.

How long we keep it. For as long as the account is connected. Removing the account on the Connections screen, or deleting the workspace, deletes it and the tokens.

What you see before anything is posted. Before a post is sent to X we show you the X account it will go to, the exact text that will be published and any media attached to it. Nothing is sent until you have confirmed it. We add no location information to your posts, and no branding or watermark of our own. If the same content is also going to another platform you connected, you are shown that too.

Revoking. Remove the account on the Connections screen, or revoke SupahPost inside X at Settings and privacy → Security and account access → Apps and sessions → Connected apps — x.com/settings/connected_apps. Revoking on either side stops our access; do both, or ask us, if you also want the collected data gone.

Our use of the X API and of X content adheres to the X Developer Agreement and Policy, including its Developer Policy. Content you publish through us goes to your own X account and is subject to the X Terms of Service and the X Rules exactly as if you had posted it in the X app. X's own handling of your information is described in the X Privacy Policy; this policy describes ours.

3e. Platforms we expect to add

Threads and LinkedIn are on our roadmap and are not available today. Neither can be authorized, nothing is published to either, and we hold no data from either. When one becomes available we will add its own section here — the permissions we ask for, what we store, for how long, and how to revoke — and update the date at the top of this page before the connection can be made, not after.

The same is true of any other platform we add: you authorize it on that platform's own sign-in screen, we request only the permissions the features you use need, we store only the account's public identity, what you publish through us and its outcome, and the tokens for the connection, encrypted at rest; we do not read your private messages; and you can disconnect at any time from SupahPost or from that platform's own settings. Each connection is also subject to that platform's own terms, which you agree to when you connect it.

4. AI assistant access (“Connect Claude”)

SupahPost lets you connect your own AI assistant (for example, Anthropic’s Claude) to your workspace’s data so you can ask questions and generate reports in plain language. This is optional and off until you turn it on.

• You create the connection. From the Connections screen, under Your AI, you generate an access key. The key is shown once and stored only as a one-way hash; you can revoke it (individually or all at once) at any time, which takes effect immediately.
• Scoped to your workspace. A key can read only the data in the workspace that created it — never another customer’s. Keys are read-only by default; you may optionally grant a key permission to draft and schedule posts and, separately, permission to publish a post right away. A key's scheduling and publishing permissions never exceed those of the member who made it. A key cannot change billing or manage users.
• The same keys work with our API and our command-line tool, where we make them available to you. A request made that way is scoped, limited and logged exactly as one from an AI assistant is, and what is sent goes to the software you pointed the key at.
• Your AI provider processes your queries. When you use your connected assistant, your questions and the workspace data needed to answer them are sent to the AI provider you chose (e.g., Anthropic) under that provider’s terms and privacy policy. SupahPost does not control that provider’s processing; review their policy before enabling this feature. SupahPost itself does not use your data to train any model.
• We log access for your protection. We record an audit entry for each assistant request — the tool used, timing, outcome and the IP address the request came from, but not the contents of your data or your key. These entries are deleted after 90 days. Unusual activity (for example, a burst of rejected requests) can trigger an alert so you can revoke a key you don’t recognize.

4a. The AI built into SupahPost: what is sent to which company

Section 4 is about an assistant you connect. This section is about the AI features that are part of SupahPost itself. They run on other companies' AI services, so using them means sending those companies some of your workspace's data. This is all of it.

• Google (Gemini) — pictures. The picture in each post on the Facebook, Instagram, TikTok and X accounts you connect (for a video post, its cover image) is sent to Google Gemini, which reads the words in it and describes what it shows. So is an image or template you give us when you ask for it to be read, recreated or imported. And, in a workspace that has turned on web images (section 1), so are the candidate images our search found, with the subject searched for, so that the best one can be chosen.
• Google (Gemini) — published Facebook and Instagram videos. A video that is already published on a Facebook Page or Instagram account you connect is sent to Google Gemini, picture and sound together, so that it can describe what the video shows and what is said in it. What comes back is a short description, the subjects in it and a short quoted passage of speech, not a full transcript. We do this only for Facebook and Instagram.
• Anthropic (Claude) — questions and writing. When you use the in-app assistant, or the features that write captions, plan reports or describe your brand, the request and the workspace data needed to answer it are sent to Anthropic. Depending on what you asked, that can include your posts' text and statistics, your brand details, your drafts, and a summary of the public comments on your posts, including the public names of the people who comment most often. In a workspace that has turned on web images, when the image search finds too little, the subject searched for is sent to Anthropic, whose service searches the web and reads pages itself to find image addresses.
• Replicate — image editing. When you use the image tools that cut a subject out of a picture, separate a picture into layers, or fill in what was behind something you removed, that picture is sent to Replicate, which runs the image model and returns the result.

What is not sent to any AI company: videos you upload into the video editor; your passwords and access tokens; your billing details; and anything from a connected YouTube channel, which section 3c covers.

Training. We do not use your data to train any AI model, and we send it to these companies only to get the result back for you. Anthropic's commercial terms say it may not train its models on content sent through its service. For Google and Replicate we rely on the terms of the services we use and hold no separate written promise from them, so we make no promise on their behalf here.

5. How we store and protect your data

Your account data, connected-account records, posts, and metrics are held in a managed PostgreSQL database. Your media — uploaded photos and video, rendered graphics, exported video, and post thumbnails — is held in private object storage and reachable only through short-lived signed links, never a public URL.

Every platform credential we hold — each connected account's OAuth access token and, where the platform issues one, its refresh token — is encrypted at rest with AES-256-GCM, using a key held only in server configuration and never in the database. Tokens are decrypted only in memory, at the moment a request to that platform is made, and are never written to logs or returned by our API. Where a platform issues short-lived access tokens with rotating refresh tokens (TikTok and Google both do), we renew access in the background and store the replacement, discarding the one it supersedes. We never see, ask for, or store your password for any connected platform — you sign in on the platform's own screen and it hands us a token, not a credential. Your SupahPost password is stored only as a salted hash, and the token that keeps you signed in is stored on our side only in scrambled (hashed) form. Each workspace's data is isolated: every record carries a workspace identifier, and the application connects to the database under a restricted role with row-level security, so a query that failed to scope itself returns nothing rather than another customer's data. Access within a workspace is role-based, with per-tab, per-action, and per-account permissions, and administrative actions taken across workspaces are written to an audit log. Traffic is served over HTTPS.

The token encryption above is ours. Encryption of the stored database and of stored files is provided by the companies that hold them for us: our database provider and our file-storage provider each state that they encrypt the data they store. Our backups are files in that same private storage and are encrypted in the same way.

If something goes wrong. If we learn that someone has reached your personal information without permission, we will tell the customers affected without unreasonable delay, and within the time the law that applies requires.

5a. Companies that process data on our behalf (sub-processors)

We share data only with the providers needed to run the service, each under their own confidentiality and security terms. We never sell or rent your data. This is the complete list as at the date at the top of this page; we will update it before adding another.

The platforms you connect. When you connect a social account, data necessarily flows between SupahPost and that platform — we read your account's data from it and send it the posts you schedule. Each acts under its own terms and privacy policy, linked in section 3:

• Meta Platforms, Inc. — Facebook Pages and Instagram.
• Google LLC — YouTube and Google Sign-In, when a channel is connected.
• TikTok Pte. Ltd. and its affiliates (ByteDance group) — TikTok, when an account is connected.
• X Corp. — X, when an account is connected.

The vendors that run the service.

• Render Services, Inc. — application hosting.
• Supabase, Inc. — the managed PostgreSQL database, and its own backups of it.
• Cloudflare, Inc. (Cloudflare R2) — private object storage for your media and exported video, and for our backups.
• Cloudflare, Inc. (Turnstile) — the check that a person, not a program, is filling in our sign-up, mailing-list, request-access and password-reset forms. It receives the visitor's IP address and technical details of their browser, and tells us only whether the check passed.
• Stripe, Inc. — subscription billing. Stripe receives your payment details, billing address and email address, never data from your connected accounts, and we never see or store full card numbers.
• Anthropic PBC (Claude) — the in-app assistant and the AI features that plan reports, write captions and describe your brand. It receives the request and the workspace data needed to answer it (section 4a). For a workspace that has turned on web images, it can also receive the subject of an image search. It does not receive your video.
• Google LLC (Gemini) — the AI features that read text out of images and describe them, and that describe videos already published on a connected Facebook Page or Instagram account. It receives the image concerned, or that published video with its sound (section 4a). For a workspace that has turned on web images, it also receives the candidate images found on the web and the subject searched for. It does not receive video you upload into the editor, and it receives nothing from a connected YouTube channel. This is a separate relationship from the YouTube connection above.
• Replicate, Inc. — the image-editing tools that cut out a subject, separate a picture into layers or fill in behind a removed object. It receives the picture concerned.
• Google LLC (Programmable Search) — web image search, used only for a workspace whose admin has turned on web images (section 1). It receives the search words and nothing else from your workspace. This is a separate relationship from the YouTube connection above.
• Serper (serper.dev) — web image search, used only for a workspace whose admin has turned on web images. It receives the search words and nothing else from your workspace.
• Apify Technologies s.r.o. — a third-party service used to retrieve the public post behind a link you paste. It receives the address you supplied, and no data from your connected accounts. In our own workspace only, it also reads public Facebook Pages we followed as competitors before Meta's own API was available to us.
• Resend (Plus Five Five, Inc.) — email: sign-in and verification codes, team invitations, the notifications you choose, and occasional product emails unless you opt out. Receives the recipient address and message, and reports back to us whether it was delivered.
• Slack Technologies, LLC — our own private workspace, where the service sends us operating alerts about errors, spending and capacity. An alert can name the workspace it concerns.

Websites an image is fetched from. When a web image is downloaded, or a link you pasted is fetched, the request goes from our servers to the website that hosts it. That website sees a request from us, not from you, and receives nothing about your workspace.

We do not use Google user data or Meta Platform Data to train any AI model, with any AI provider. What each AI provider's own terms say about training is set out in section 4a. See also sections 3a, 3c and 4.

Connections you choose to make. If you connect your own Slack workspace for alerts and digests, the messages you asked for are sent there. If you add a web address of your own for notifications, we send those notifications to it. If you connect your own AI assistant, see section 4. These go where you point them, under your agreement with that company rather than ours.

5b. What we log

These are the records we keep about use of the service that involve a network address or a count of visitors. None of them is used for advertising, and none is shared outside the companies listed in section 5a.

• When you agree to a subscription — the IP address the agreement came from is saved with your workspace's copy of what you agreed to. The long-term record described in section 7a does not contain it.
• When an AI access key is used — the IP address of each request, kept for 90 days with the entry described in section 4, and, where it is available to us, the country the key was last used from, so you can spot a key being used somewhere you do not expect.
• When an app is registered to connect to a workspace — the IP address it was registered from.
• When a shared dashboard link is opened — we count how many times the link has been opened and when it was last opened, so the customer who made it can see whether it is being used. No IP address and nothing about the visitor is kept with that count.
• A daily count of visitors — to know how many different visitors we had in a day, we turn each visitor's IP address and browser type into a scrambled value that cannot be turned back and that changes every day, so it cannot follow anyone from one day to the next. We store only that value, we delete it after 90 days, and we leave it out of our backups.
• Request logs — our hosting provider records each request to the service: the time, the page or action requested and whether it succeeded, and, for a request that failed, the IP address it came from. Where the request came from someone signed in, the entry identifies them and their workspace by internal account numbers, not by name or email address. These are kept for a limited period for security and fault-finding and then age out.
• Limiting abuse — IP addresses are used for a few minutes at a time to slow down repeated sign-in attempts and form submissions. They are not stored for that.

6. Cookies and local storage

We set two cookies when you sign in, and one more only when someone opens a password-protected shared dashboard. The first is called eb_session, it is set when you sign in, and it is what keeps you signed in as you move between pages. It holds a random session identifier and nothing else — not your name, your email, or your password. It lasts up to 30 days so you are not asked to sign in every day, which makes it a persistent cookie rather than one that disappears when you close the browser; signing out clears it immediately. It is marked HttpOnly (scripts on the page cannot read it), SameSite=Lax (it is not sent from other sites), and Secure in production (it only travels over an encrypted connection).

The second is called sp_in. Its value is always the single character 1: it holds no identifier and says nothing about who you are. It is set and cleared together with eb_session, lasts the same up to 30 days, and is shared with our website at supahpost.com so that opening the website while you are signed in takes you straight to the app instead of asking you to log in again. It is not marked HttpOnly, because the website has to be able to read it; nothing on our side uses it to recognise you or to decide what you may see.

The third is called sp_unlock. It is set only for a visitor who enters the password on a password-protected shared dashboard link, so they are not asked again on every visit. It is limited to that one link, holds no information about who the visitor is, is marked HttpOnly, SameSite=Lax and Secure, and lasts up to 30 days or until the link's password changes.

Those are the only cookies we set. We do not use advertising, analytics, or tracking cookies, and there are no third-party trackers, no advertising pixels, and no cross-site or cross-app identifiers anywhere in the app or on our website. We do not run advertising and we do not build a profile of your browsing. Your browser does make requests to a few other companies while you use the app; they are named at the end of this section.

We do keep a count of which features get used — things like “a report was built” or “the video editor was opened” — so we know what to improve. This is recorded on our own servers against your account, not by a cookie and not by any visitor or device identifier, and it records the action only: never what you wrote, posted, or searched for. It is never shared with anyone else. Counts are deleted after 13 months, and you can switch this off for yourself in Settings → Preferences. The separate records that do involve an IP address are listed in section 5b.

The app also stores things in your browser, in local storage, session storage, and (in browsers that support it) a small IndexedDB entry. It is used to remember how you like the app set up and to avoid losing work: your light/dark theme, whether the sidebar is open, the tab and view you last used, filters and sort orders, the report you pinned, the download format you last chose, the folder you last saved a batch of downloads into, text you have typed but not yet submitted, and a local copy of your drafts so the list appears immediately. A shared calendar page remembers, in the visitor's own browser, the name they typed with their feedback. This stays on your device, we do not read it from our servers, and clearing your browser data removes it.

Third parties your browser contacts. Every typeface the app and our site use is served from our own servers, so loading a page sends no request to Google or any other font service. The sign-up, mailing-list, request-access and password-reset forms, in the app and on our website, can show an anti-spam check from Cloudflare, which loads Cloudflare's script and may store a short-lived item on your device to remember that you passed the check; it is not used to profile you or to track you across sites. When you subscribe or manage your billing you are taken to Stripe's own pages, which are run by Stripe under Stripe's privacy policy and set Stripe's own cookies. When a card form is shown inside the app, it is Stripe's: Stripe's script loads from Stripe and may set its own cookies, which Stripe says it uses to make the form work and to detect and prevent fraud. When you preview a post from X, its pictures can load straight from X's own image servers. Apart from the anti-spam check on its forms, our website loads no third-party scripts.

Because both cookies are strictly necessary to provide a service you have asked for (signing in, and staying signed in as you move between our website and the app), the browser storage above is there to give you the app the way you set it up, and we set no advertising or analytics cookies, we do not show a cookie consent banner. If we ever add anything beyond what is described here, we will ask for your consent first.

7. Data retention and deletion

While your workspace exists: data from the accounts you connect — page and account details, post content, metrics and insights — is retained for as long as those accounts are connected, so that your history and reports stay intact. Pending scheduled posts are kept until they publish or you delete them; published posts keep their metrics for historical analysis.

Removing one connected account: you do not have to delete the whole workspace to get one account's data out. An admin can remove any connected account — a Facebook Page, an Instagram account, a TikTok account, a YouTube channel, an X account, or any other platform you have connected — on its own, from the Connections screen, and doing so deletes everything we hold for that account, including its tokens — see section 7b.

How long we keep each thing, and what removes it.

• Posts, statistics, insights and tokens from a connected account — while the account is connected. Removing the account or deleting the workspace deletes them. YouTube has shorter limits of its own, in section 3c.
• Public comments on your posts — 90 days at most, then deleted automatically.
• Instagram posts that tag you, and competitor accounts you follow — no time limit: until you remove the account, stop following the competitor, or delete the workspace.
• Feedback left on a shared calendar — 180 days at most, then deleted automatically.
• What you make and upload, your drafts and scheduled posts, assistant chats and saved memories — until you delete them or the workspace.
• Images found on the web or brought in by link, and the record of where each came from — until you delete them or the workspace, or until we remove one after a copyright notice (section 7a).
• A file upload that was started and never finished — large files are sent to us in pieces, and the pieces of an upload that is never completed are removed about a day after it was started.
• The record of changes made in your workspace — 13 months.
• A two-step sign-in code — it stops working after 10 minutes.
• The record of the Terms you agreed to — until your account is deleted.
• Counts of which features get used — 13 months.
• The log of AI access key requests, and the daily visitor count — 90 days each.
• Your sign-in — up to 30 days, or until you sign out.
• Mailing-list entries and request-access answers — no time limit: until you ask us to erase them. Unsubscribing stops the emails at once, and we keep the address marked as unsubscribed so that we do not email it again. These are not part of any workspace, so deleting a workspace does not remove them; email privacy@supahpost.com and we will erase the entry.
• The free-trial record (a one-way fingerprint of an email address, and a card fingerprint) — no time limit. We do not erase it on request, because erasing it would let the same person or card take the free trial again, and it cannot be read back into an email address or a card number.
• The record of what you agreed to at checkout — three years, or one year after the subscription ends, whichever is longer; see section 7a.
• Deletion records and our own administrative audit log — no time limit. They record that something was done, not the content it was done to; see section 7a.
• Backups — see section 7a.

7a. Deleting your workspace

How. Sign in and open Settings → Workspace data. An admin of the workspace types the workspace's name to confirm, and the deletion runs at once. If you are not an admin, that panel tells you so and asks you to contact your workspace admin. You can also email privacy@supahpost.com and we will do it for you after verifying that you are entitled to ask.

It is immediate and permanent. There is no grace period and no recycle bin. We cannot restore a deleted workspace, and neither can you, so please export anything you want to keep first.

What is deleted. Everything the workspace holds: every connected account on every platform — Facebook Pages, Instagram accounts, TikTok accounts, YouTube channels, X accounts and any other platform you connected — together with the OAuth access and refresh tokens for them; all collected post content, earnings and audience data; everything you created (graphics, carousels, video, templates, presets, uploaded photos and fonts); scheduled and draft posts; assistant chats and saved memories; integrations; API/assistant access keys; team-member access to the workspace, and the user accounts of members whose home workspace it was. Your media files are deleted from our object storage as well as our database.

An image removed after a copyright notice. When we act on a notice about an image in your library, the image is taken out of the library and out of the graphics that used it, and a post still waiting in your schedule that we can match to it is held back rather than published. The image is kept in our private storage, marked as removed, rather than destroyed, so that it can be put back if a counter-notice succeeds. It is not offered or used while it is marked. The count of notices against a workspace is part of the workspace's own record: deleting the workspace deletes the count, the record of each removal and of any counter-notice, and the removed image itself along with the rest of the workspace's media.

What is not deleted, and why. Posts you already published to a connected platform — Facebook, Instagram, TikTok, YouTube or any other — remain on that platform. They are yours, they live there, and you manage or delete them there. We also keep a small deletion record: a dated entry noting that a deletion was requested and whether it completed, plus a reference code. It contains no post content, no media, no metrics and no message content, and it deliberately outlives the workspace for two reasons — it is what Meta's deletion-status URL answers with, and it is the evidence that we did what we said. Where the request came from Meta, the record includes the Facebook user ID Meta sent with it. Three more things are outside a workspace and so are not removed with it: a mailing-list entry, the free-trial record, and the checkout record below — section 7 says how long each is kept. A fourth exists only where a copyright owner's notice led us to remove an image: the list of images and sources we have been asked not to use again, which holds an image address, a website name or a file fingerprint and is about the picture rather than about any workspace, and the entry in our administrative audit log recording that the notice was acted on, which holds the image address or website the notice was about, our own short note of the notice, and the workspace's internal number. Both are kept with no time limit, so that the block goes on working. Finally, ordinary request logs (timestamps, request paths, error records) age out on their normal schedule rather than being retrieved and edited.

The subscription consent record. If you subscribed, we also keep a separate record of what you agreed to at checkout: the plan and billing cycle, the price we quoted, whether it was a free trial, the exact terms shown to you, and the date. Consumer-protection law for automatically renewing subscriptions requires us to retain that verification for three years, or one year after your subscription ends, whichever is longer, so it deliberately outlives your workspace. It is stored without your email address — we keep an irreversible one-way fingerprint of it instead, so the record can be matched to you if you ever query a charge, but the file is not a list of the addresses of people who have left. It contains no post content, no media, no metrics, no message content, no card details and no IP address. Your own copy of the same record, inside the workspace, is deleted with everything else.

Backups. Deleting something removes it from the live service at once, but a copy made earlier can persist in a backup until that backup is removed. Our database is copied every night, and we keep the 7 most recent nightly copies, 4 weekly ones and 3 monthly ones; older scheduled copies are deleted automatically, so a deleted record drops out of the scheduled database backups within 120 days. A database copy we take by hand before risky maintenance is deleted no later than 90 days after it was made, except that the single most recent one is always kept. We also keep a spare copy of your stored media files (photos, graphics and video): a file that is still in use keeps its spare copy, and a file that has been deleted from the app is removed from the spare copy once it has been gone for 90 days. Our database provider also keeps its own backups, on its own schedule. All of these are held in private storage, encrypted at rest by the storage provider, and are used only for disaster recovery. If we ever had to restore from a backup, we would delete again whatever had been deleted since that backup was taken; that is a step we carry out by hand.

Billing. Deleting your workspace cancels its subscription immediately, so nothing more is charged. If you are within 14 days of your first payment, the refund is issued automatically; otherwise email support@supahpost.com for a prorated refund of the unused time. See our Refund Policy.

7b. Removing one connected account

How. Sign in and open the Connections screen. An admin selects Remove on the account — a Facebook Page, an Instagram account, a TikTok account, a YouTube channel, an X account, or any other platform you have connected — types its name to confirm, and the removal runs at once. Members who are not admins are shown who to ask. If any scheduled post is still set to publish to that account, we refuse and tell you how many, so that queued work is never thrown away silently — cancel or reschedule those posts first.

What is removed. Everything we hold for that one account: every post we synced from it and their earnings, views and reactions; its daily follower and engagement history and its audience breakdowns; the public comments we read from its posts, and the Instagram posts that tagged it; anything we learned from it, such as its best posting times and its scheduler settings; and the stored access and refresh tokens for it, so we stop reading the account and can no longer publish to it. For a Facebook Page we also ask Meta to stop sending us its notifications, unless another workspace still has that Page connected. Its cached post images are deleted from our object storage as well as our database. It is immediate and permanent, and we cannot restore it.

What is not affected. The account itself is untouched — nothing is deleted from Facebook, Instagram, TikTok, YouTube, X or any other platform, and you can connect it again later. If another workspace has the same account connected, its copy is untouched too: removing an account deletes your workspace's records of it and nobody else's. Your other connected accounts, your uploaded photos, and everything you made in Create are untouched. The record that a post was published to that account is kept, with the account's name as it was at the time, because it is the history of what your workspace did rather than data belonging to the account.

8. Data deletion requests

You may have the data we hold from any connected platform deleted in any of four ways. This satisfies Meta's Platform Terms and applies equally to TikTok, YouTube, X and every other platform you connect (see also our data deletion instructions):

• Delete the workspace — Settings → Workspace data, as described in section 7a. This is the complete option: it removes the connected-account data as well as the tokens, for every platform at once.
• Remove one connected account — the Connections screen, as described in section 7b. Use this when you want one account's data gone but want to keep the workspace and your other accounts.
• Revoke us from the platform's own settings — on Facebook and Instagram, Settings & privacy → Settings → Business integrations (facebook.com/settings?tab=business_tools); on TikTok, Profile → Settings and privacy → Security & permissions → Manage app permissions; on Google/YouTube, the Google security settings page at security.google.com/settings/security/permissions (also myaccount.google.com/permissions); on X, Settings and privacy → Security and account access → Apps and sessions → Connected apps (x.com/settings/connected_apps). Our access ends immediately, and where the platform notifies us (Facebook does) we delete the stored tokens and connection records at once. Data already collected into a SupahPost workspace is not removed by this step alone, because a workspace can belong to a team rather than to one person; remove the account or delete the workspace as above, or ask us, to remove that too.
• By request: email privacy@supahpost.com with the subject "Data Deletion Request" and your registration email. We act on verified requests within 30 days and confirm completion.

9. In-app privacy notices

Before you authorize any platform — Facebook, Instagram, TikTok, YouTube, X or another — we show a clear notice explaining exactly what we will and won't access, and why we are asking for each permission. The data we retrieve is shown back to you in your own dashboards, scheduler, and reports. Before anything is published on your behalf, you are shown the account, the content, the caption and the posting options it will use.

10. Your rights

• Access the data we store about your connected accounts.
• Request correction of your data.
• Delete your workspace and everything in it yourself, at any time, from Settings → Workspace data — see section 7a — or ask us to do it for you.
• Change your own name, email and password from Settings → Profile & sign-in.
• Disconnect any connected account from the Connections screen, or revoke our access from the platform's own settings, at any time — see section 8 for where each platform keeps that control.
• Ask for a copy of your personal information in a portable format, ask us to restrict or stop a particular use of it, and withdraw any consent you gave — withdrawing does not affect what was done before.
• Turn off product emails with the unsubscribe link in any of them, and choose which notification emails you get in Settings → Emails.
• Have a mailing-list entry or a request-access entry erased, whether or not you ever had an account.

To use any of these rights, email support@supahpost.com or privacy@supahpost.com. We answer within 30 days; if a request needs longer than that, we tell you why and when. We may ask for enough to confirm that the request really comes from you. If we cannot do what you asked, we say why, and you can reply to ask us to look again.

If you live in a US state with its own privacy law. The rights above are open to everyone, wherever in the United States you live. We do not sell your personal information, and we do not share it with anyone for advertising aimed at you. We will not treat you differently for using any of these rights.

Outside the United States. SupahPost is not offered outside the United States (see the top of this page), so this policy does not set out the rights that the laws of other countries give. If you are outside the United States and believe we hold information about you, email privacy@supahpost.com and we will delete it.

10a. Children

SupahPost is for people aged 18 and over (see our Terms of Service). It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email support@supahpost.com and we will delete it.

11. Updates to this policy

We may revise this policy periodically. Changes are posted here, and significant updates are highlighted via email or in-app notification.

12. Contact

SupahPost is operated by Rocket Visions, LLC, 100 N High St, Columbus, OH 43215, United States. Questions or requests: privacy@supahpost.com.

← Back to home