Privacy policy
PostEverySocial (posteverysocial.com) is a service for publishing and scheduling posts to social networks. It is run by Rupangkan Kalita, a sole proprietor based in Bengaluru, Karnataka, India ("we", "us"). Questions about this policy: privacy@posteverysocial.com.
Where things stand. PostEverySocial has not launched yet. Today this website only collects waitlist sign-ups. The sections marked "when accounts open" describe how the app will handle data from launch; we will update this page before then if anything changes.
1. What we collect today
Waitlist
- Your email address.
- Which page you signed up from, the date and time, and the country your request came from (as reported by our host, Cloudflare).
- A one-way hash of your IP address, kept only to block abuse such as bulk sign-ups. We do not store the IP address itself.
Visiting the site
- We do not use advertising or tracking cookies. If we turn on visitor statistics, we use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
- Your colour theme choice (light or dark) is saved in your own browser and never sent to us.
- Like any website host, Cloudflare processes technical data such as IP addresses to deliver pages and stop attacks.
2. What we collect when accounts open
- Account: your email address and a password stored only as a salted scrypt hash. A session cookie keeps you signed in; it is used only for that.
- Connected social accounts: when you connect a network (for example Bluesky, X, LinkedIn or YouTube) we receive an access token, and sometimes a refresh token, plus the account's id, name and handle. For Bluesky we store the app password you create for us. Tokens and app passwords are encrypted at rest (AES-256-GCM). We never ask for or see your social network passwords.
- Your content: the posts you write, the media you upload, the accounts and times you choose, and the delivery receipt each network returns (post id, link, time, error if any).
- API and billing: API keys (stored hashed) and request logs for security. When paid plans open, a payment provider acting as merchant of record processes payments; we do not receive your card number.
3. How we use it
- To send you one launch email and early-access details if you joined the waitlist. Every email has an unsubscribe link.
- To publish, schedule and report on the posts you ask us to send, and only to accounts whose owners connected them. We never post on our own.
- To keep the service secure, prevent abuse and fix problems.
We do not sell your data, use it for advertising, or use your content or connected-account data to train AI models.
4. Google and YouTube data
PostEverySocial uses YouTube API Services to upload videos you choose to your own YouTube channel. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
- We request only the access needed to upload videos and to read your channel's name so you can tell accounts apart.
- We use the data only to upload the videos you ask for and show you the result. We do not share it with anyone except Google, and people never read it unless you ask us for support, it is needed for security, or the law requires it.
- You can disconnect YouTube in PostEverySocial at any time, which deletes the stored tokens, and you can revoke access in your Google account permissions.
PostEverySocial's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who else processes data
| Service | What for |
|---|---|
| Cloudflare | Hosting, database, file storage, security, email forwarding |
| Resend | Sending the waitlist and account emails |
| The social networks you connect | Receiving the posts and media you publish to them |
| Payment provider (from paid launch) | Checkout, invoices and tax |
These providers may store data outside India, including in the United States and the European Union. Our database's primary location is in the Asia-Pacific region.
6. How long we keep it
- Waitlist emails: until you unsubscribe, or 12 months after launch if you have not created an account.
- Account data and connected-account tokens: while your account exists. Disconnecting a network deletes its tokens at once; deleting your account deletes the rest within 30 days, except records we must keep by law, such as invoices.
- Uploaded media: deleted after the post is published, with a short safety copy kept for up to 7 days.
7. Your choices and rights
You can ask us to access, correct or delete your data, or withdraw consent, by writing to privacy@posteverysocial.com. We reply within 30 days. These rights apply under India's Digital Personal Data Protection Act, 2023, and, where they apply to you, the EU and UK GDPR and US state privacy laws. If you are unhappy with our answer you can complain to your data protection authority.
Grievance contact: Rupangkan Kalita, privacy@posteverysocial.com.
8. Security
Data travels over HTTPS. Tokens and app passwords are encrypted at rest, passwords and API keys are hashed, and access to production systems is limited to the operator. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
9. Children
PostEverySocial is not meant for anyone under 18, and we do not knowingly collect their data.
10. Changes
We will post changes here and update the date above. If a change is significant, we will email account holders before it takes effect.