Privacy policy

Draft, last updated 2026-11-01

SocialsForAI publishes posts to social networks on behalf of people who connect their accounts. This page explains what we store and why.

What we store

For each connected account: the network's account id, handle, display name and avatar URL, and the access credentials the network issues (OAuth tokens or, for Bluesky, an app password). Credentials are encrypted at rest with AES-256-GCM. For each post: its text, media URLs, schedule and delivery results.

For workspace owners who give one: an email address, used only to send sign-in links. Signing in sets one cookie (sfa_session), a random session token that lasts 30 days or until you sign out. To limit abuse we store a salted hash of the network address that requests a signup or sign-in email, never the address itself, and delete it after a day.

What we do with it

We use credentials only to publish the posts our customers send and to confirm they went live. We don't read feeds, messages or followers, sell data, or use it to train models.

Disconnecting and deletion

Disconnecting an account deletes its stored credentials immediately. You can also revoke access from the network's own settings at any time.

Sub-processors

Hosting on Vercel; database on Supabase; sign-in email through Resend. Each network's own API receives the posts you publish.