Privacy Policy

• Account information. Your email address, name and profile picture (if you sign in with a provider that shares them), and a user ID, all from our sign-in provider, Clerk.
• Connected social accounts. When you connect a platform we store the access and refresh tokens it issues, the permissions you granted, and basic profile details for that account: its ID, name, handle and profile picture. Tokens are encrypted with AES-GCM before they are stored.
• Your content. The posts you draft, schedule or publish: text, per-platform settings, schedule times, templates, projects (including brand details you enter) and the media attached to them.
• Media. Images and videos you upload or generate with our AI tools.
• Publishing results. For each publish attempt: the platform's post ID and link, the status, and any error message.
• Post performance. Public counts the platforms report for posts you published through publishez, such as views, likes, comments and shares, so we can show them to you.
• API keys. If you create a key to connect Claude or another tool, we store only a hash of it, plus its name, its first characters and when it was last used.
• Technical logs. Our hosting provider records standard request logs (such as IP address, browser and time) for security and troubleshooting.

We do not use advertising trackers or analytics cookies, and we don't collect your precise location. The only cookies we set are the ones sign-in needs.

Only to provide the service you asked for:

• To sign you in and keep your data separate from everyone else's.
• To email you about your account, for example when a post fails to publish. You can turn those emails off in Settings.
• To publish what you chose, to the accounts you chose, at the times you chose.
• To store your drafts, schedules, templates and media.
• To show you how your published posts are performing.
• To run the AI features when you use them (see section 3).
• To fix problems, prevent abuse, and keep the service secure.

We do not sell your data, share it with advertisers, or use it to train AI models. We never post anything you didn't create or schedule.

We use a few service providers. Each receives only what it needs to do its job for us.

• Clerk, for sign-in. It receives your email address and sign-in activity.
• Cloudflare, for hosting, media storage, the queue that publishes scheduled posts, and sending our emails to you.
• Neon, for our database (posts, accounts, settings; tokens are encrypted before they get there).
• OpenAI, for text features such as per-platform rewrites and captions. It receives the text you send and, for captions, the media you pick.
• fal.ai, for image and video generation. It receives your prompts and any reference images you add.
• The platforms you connect (for example YouTube, Facebook, Instagram, Threads, TikTok, X, LinkedIn, Reddit, Bluesky and Mastodon). They receive the content you publish to them, along with your access tokens.

Our providers process data in the United States and other countries. We may also share data if the law requires it, to protect people from harm, or if publishez is transferred to a new owner (for example a company the operator forms); in that case this policy keeps applying to your data.

publishez uses YouTube API Services. When you connect a YouTube channel, you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

We ask for permission to upload videos to your channel and to read your channel and video details. We use that to publish the videos you schedule, set their titles, descriptions, tags and thumbnails, list your channels, and show your videos' view and like counts. We use this data only for those purposes.

publishez's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We don't use Google data for ads, don't sell it, and don't let people read it except where you ask us to, where it's needed for security, or where the law requires.

You can revoke publishez's access at any time from your Google security settings, or by disconnecting the channel in publishez.

We ask Meta for permission to list your Pages and Instagram accounts, publish to them, and read engagement for your posts. If you remove publishez in your Facebook, Instagram or Threads settings, Meta tells us and we delete the stored tokens. If you ask Meta to have your data deleted, we delete those accounts and their history from publishez and give you a confirmation code you can check on our data deletion page.

Platforms download your media from us when they publish it, so uploaded and generated files are served from long, unguessable web addresses. Anyone with an exact address can open that file, so treat those links like private links and don't share them.

• While your account is open, we keep your content, media and connected accounts so the service works.
• When you delete a post or a media file, it is removed right away.
• When you disconnect an account, we revoke our access at the platform where the platform allows it and delete the stored tokens. Your past posts stay in your publishez history, and on the platform until you delete them there.
• When you delete your publishez account, we revoke platform access and immediately delete your posts, media, templates, projects, API keys and connected accounts.
• Deleted data can remain in database backups for up to 30 days before it is overwritten, and in hosting logs for a short period.

• Disconnect an account on the Accounts page, or remove publishez in that platform's own settings.
• Delete your whole account in Settings. See also our data deletion page.
• Get a copy of your data, or correct it: email us and we'll reply within 30 days.

Depending on where you live (for example the EU, the UK or California), you may have further rights, such as to object to processing or to complain to a data protection authority. Email us to use them; we'll honor them regardless of where you live.

Tokens are encrypted before storage, API keys are stored only as hashes, every connection uses HTTPS, and every account's data is kept separate. No system is perfectly secure; if we learn of a breach that affects your data we will tell you promptly. Report security issues to support@publishez.app.

publishez is not for children under 13 (or under 16 where local law requires). We don't knowingly collect their data; if you believe a child has signed up, contact us and we'll delete the account.

If we make a material change, we'll update the date at the top and email account holders at least 14 days before it takes effect.

Questions, requests or complaints: email support@publishez.app. The service is operated by Roger Proenza, doing business as publishez.