Privacy Policy

We collect information you provide directly to us, such as when you create an account, connect social media accounts, or contact us. This includes:

•Account information: Name, email address, and password (stored as a secure hash)

•Social media tokens: OAuth access tokens for connected platforms (Facebook, Instagram, YouTube, LinkedIn, TikTok, X/Twitter) — stored encrypted at rest using AES-256-GCM

•Post content: Text, images, and videos you upload for publishing

•Usage data: Pages visited, features used, and actions taken within the app

We use the information we collect to:

•Provide, maintain, and improve our services

•Publish and schedule social media posts on your behalf

•Send you transactional emails (verification, password reset, publish notifications)

•Send newsletters if you have subscribed (you can unsubscribe at any time)

•Analyze usage patterns to improve the product

•Respond to your support requests

We do not sell, trade, or rent your personal information to third parties.

We may share your data with:

•Social media platforms: Only to execute posts you explicitly authorize

•Service providers: Email delivery (Resend), infrastructure (database, hosting) — bound by data processing agreements

•Legal requirements: If required by law or to protect rights and safety

When you connect a social media account, we store OAuth access tokens encrypted in our database. These tokens allow us to publish content on your behalf.

•We never post without your explicit instruction

•You can disconnect any account at any time from Settings → Connections

•Upon disconnection, tokens are revoked with the platform and deleted from our database

We retain your data for as long as your account is active. If you delete your account:

•Your profile and post history are permanently deleted within 30 days

•Social media tokens are immediately revoked and deleted

•Backup copies may persist for up to 90 days

You can request data deletion at any time by contacting us or using the delete account option in settings.

We use only essential cookies required for authentication (JWT session tokens stored in memory). We do not use tracking cookies or third-party advertising cookies.

We implement industry-standard security measures:

•All data in transit is encrypted via HTTPS/TLS

•OAuth tokens are encrypted at rest (AES-256-GCM)

•Passwords are hashed with bcrypt (cost factor 10)

•API endpoints are rate-limited to prevent abuse

You have the right to:

•Access: Request a copy of your personal data

•Correction: Update inaccurate information in your account settings

•Deletion: Request account and data deletion

•Portability: Export your post history

•Opt-out: Unsubscribe from marketing emails at any time

To exercise these rights, contact us at privacy@publitup.io

We may update this privacy policy from time to time. We will notify you of significant changes by email or via an in-app notification. Continued use of the service after changes constitutes acceptance of the new policy.