OOmniPostSign in
Template — not legal advice. This page is a neutral starting point and must be reviewed and completed by the service owner and a qualified lawyer before publication. Replace every placeholder in square brackets, such as [COMPANY NAME] and [CONTACT EMAIL].

Privacy Policy

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains how [COMPANY NAME] ("we", "us") collects, uses, shares and deletes information when you use OmniPost (the "Service"), a tool for writing social media posts once and publishing them to connected accounts on Facebook, Instagram, Threads, TikTok, YouTube, LinkedIn, X and Pinterest. [COMPANY NAME] is the controller of the personal data described here. Contact: [CONTACT EMAIL], [COMPANY ADDRESS].

1. Information we collect

Account information

  • Your name and email address, provided when you register or are invited.
  • Your password, stored only as a salted one-way hash (argon2id). We never store or see your password in plain text.
  • Workspace details you enter, such as workspace name, timezone, members and their roles.

Connected social media accounts

  • When you connect an account, the platform gives us OAuth access and refresh tokens. We store them encrypted with AES-256-GCM and use them only to perform actions you request. We never ask for or store your social media passwords.
  • Basic profile information returned by the platform: account or page ID, display name, username, profile picture URL, granted permissions (scopes), and — for Facebook and Instagram — the app-scoped ID of the user who connected the account so that we can honour deletion requests sent by Meta.
  • Account-specific options needed to publish, for example your Pinterest boards or the Facebook Page an Instagram account is linked to.

Content you create

  • Post text, per-platform captions and options, and scheduled publish times.
  • Images and videos you upload, stored in S3-compatible object storage ([STORAGE PROVIDER, e.g. Amazon S3 or Cloudflare R2]).
  • Publishing results returned by the platforms, such as post IDs, post URLs and error messages.

Technical and usage information

  • Session records (IP address, browser user agent, timestamps) used to keep you signed in and to protect your account.
  • An audit log of important actions in a workspace (for example connecting an account or inviting a member), including the acting user and IP address.
  • Server logs used for security, debugging and reliability.

Billing information

Paid plans are processed by Stripe. Card details are entered directly with Stripe and never reach our servers; we store only Stripe customer and subscription identifiers and the status of your subscription.

2. How we use information

  • To provide the Service: publish and schedule the posts you create, to the accounts you choose.
  • To keep connected accounts working, including refreshing expired tokens.
  • To authenticate you, secure the Service and prevent abuse.
  • To send transactional emails such as password resets and workspace invitations.
  • To process payments for paid plans.
  • To comply with legal obligations.

We do not sell your personal data, we do not use it for advertising, and we do not use content or data obtained from connected platforms to train machine-learning models.

[LEGAL BASIS FOR PROCESSING — e.g. contract, legitimate interests, consent — if GDPR/UK GDPR applies.]

3. Data received from platform APIs

We access each platform only through its official API and only with the permissions you grant. We use that data solely to show you your connected accounts and to publish content you have explicitly created or scheduled in OmniPost. We do not read your feed, messages, followers or analytics beyond what is needed for that purpose.

  • YouTube / Google. OmniPost uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. OmniPost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke OmniPost's access at any time from your Google Account permissions page.
  • Meta (Facebook, Instagram, Threads). We use the Graph API and Threads API to list the Pages and professional accounts you manage and to publish to them. You can remove OmniPost from your Facebook or Instagram settings at any time; Meta will then notify us and we delete the associated accounts (see Data Deletion).
  • TikTok, LinkedIn, X and Pinterest. We use each platform's official posting API to upload media and publish posts you create, and to read the minimum profile information (and, for Pinterest, your boards) needed to do so.

4. How we share information

We share information only as needed to run the Service:

  • Social platforms you connect — Meta (Facebook, Instagram, Threads), TikTok, Google (YouTube), LinkedIn, X and Pinterest receive the content, media and options of posts you publish to them, together with the access token that authorises the request. Once published, content is governed by that platform's own terms and privacy policy.
  • Infrastructure providers — hosting ([HOSTING PROVIDER]), database, object storage ([STORAGE PROVIDER]) and email delivery ([EMAIL PROVIDER]), acting on our instructions.
  • Payments — Stripe, for paid plans.
  • Members of your workspace — content, media and connected accounts in a workspace are visible to its members according to their role.
  • Legal — where required by law, or to protect the rights and safety of users and the Service.

[LIST OF SUB-PROCESSORS AND INTERNATIONAL TRANSFER SAFEGUARDS, if applicable.]

5. Security

OAuth tokens are encrypted at rest with AES-256-GCM, passwords are hashed with argon2id, connections use HTTPS, sessions use rotating refresh tokens, and access to production systems is restricted. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where the law requires.

6. Retention

  • Account, workspace, post and media data are kept while your account is active.
  • Disconnecting a social account immediately wipes its tokens; its name and avatar are kept only so past posts still show where they were published, until you delete your account or workspace.
  • Expired sessions and password reset links stop working after 30 days and 1 hour respectively.
  • When you delete your account, data is removed from our live systems immediately (see below). Encrypted backups are overwritten within [BACKUP RETENTION, e.g. 30 days] and server logs within [LOG RETENTION, e.g. 30 days].
  • Billing records may be kept longer where tax or accounting law requires.

7. Deleting your data

You can delete your account at any time in Settings → Delete account. This removes your profile and every workspace you are the sole owner of, including its connected accounts and tokens, posts and uploaded media. You can also disconnect individual accounts, revoke OmniPost's access from each platform's settings, or email us at [CONTACT EMAIL]. Full details are on our Data Deletion page.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to your data protection authority. To exercise these rights, contact [CONTACT EMAIL]. We will respond within the time required by applicable law.

9. Children

The Service is not directed to children under [MINIMUM AGE, e.g. 16] and we do not knowingly collect their personal data.

10. Changes

We may update this policy. We will post the new version here with a new "last updated" date and, for material changes, notify you by email or in the app.

11. Contact

[COMPANY NAME]
[COMPANY ADDRESS]
[CONTACT EMAIL]