Privacy Policy

This Privacy Policy explains how Social Poster, a product of XtroEdge ("we", "us", "our"), collects, uses, stores, shares, and protects information when you use our social media publishing service (the "Service").

We designed the Service to handle the minimum data necessary to publish content on your behalf. We do not sell your personal data, and we do not use the data obtained from connected social platforms for advertising.

Account information: your name, email address, password hash, and timezone, provided when you register.

Connected account data: when you connect a social platform, we receive OAuth access and refresh tokens, the granted permission scopes, and basic profile details (such as account name, ID, and avatar) needed to display the connection.

Content you create: captions, hashtags, designs, uploaded images and videos, schedules, drafts, and post history.

Usage data: log records of actions taken in the Service, such as when a post was published or a job failed, used for reliability and support.

We use the information we collect to:

• Authenticate you and operate your account.
• Publish, schedule, and manage content on the social platforms you connect — only when you instruct us to.
• Refresh platform tokens so scheduled posts can run at their scheduled time.
• Display analytics derived from your own publishing history.
• Provide support, debug failures, and improve the reliability of the Service.

When you connect Facebook, Instagram, LinkedIn, X, TikTok, Pinterest, YouTube, Threads, Canva, or Google Drive, the platform issues us access tokens scoped to the permissions you approve. We use these tokens strictly to perform the actions you request.

We request the narrowest scopes needed: typically the ability to read your basic profile, upload media, and publish or schedule posts. We do not read your private messages, browse content unrelated to your request, or post without your instruction.

TikTok: data obtained through the TikTok API (such as your profile information and the videos you upload through the Service) is used only to display your connected account and to publish content you create. It is not shared with third parties or used for any other purpose.

You can revoke our access at any time by disconnecting the account in the Service, or directly in the platform’s own app settings.

Social Poster’s use of information received from Google APIs (including YouTube and Google Drive) adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide and improve the Service’s user-facing features (uploading videos to YouTube, picking media from Google Drive); we do not transfer or sell this data; we do not use it for advertising; and humans do not read this data except where you explicitly request support, where required for security, or where required by law.

We share information only as needed to operate the Service:

• With the social platforms you connect, to publish the content you create.
• With infrastructure providers (such as hosting, database, and object-storage providers) that process data on our behalf under confidentiality obligations.
• When required by law, or to protect the rights, safety, and security of our users and the Service.

We do not sell personal data, and we do not share platform data with advertisers or data brokers.

OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. Plaintext tokens are never written to our database.

Connections to the Service and to third-party APIs use encrypted transport (HTTPS/TLS). Access to production systems is restricted to authorized personnel.

No system is perfectly secure; while we work hard to protect your data, we cannot guarantee absolute security.

We retain account and content data for as long as your account is active. When you disconnect a social account, the associated platform tokens are revoked and deleted.

When you delete your account, we delete or anonymize your personal data and content within a reasonable period, except where retention is required by law or for legitimate operational records.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

You can exercise these rights from within the Service, or by contacting us at mayclaude@xtroedge.com. You can disconnect any social account at any time from the Connected Accounts page.

The Service integrates with third-party platforms that each have their own privacy policies. We encourage you to review the privacy policies of Meta, TikTok, LinkedIn, X, Pinterest, Google/YouTube, Canva, and any other platform you connect.

The Service is not directed to children. You must be at least 16 years old, or the age of digital consent in your jurisdiction, to use it. We do not knowingly collect personal data from children.

Your data may be processed in countries other than where you live. Where required, we rely on appropriate safeguards for such transfers.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app.

For privacy questions or requests, contact us at mayclaude@xtroedge.com.