Privacy Policy

2.1. Data provided at registration

• Email address
• First name and last name (if provided)
• Password hash — we do not store passwords in plain text, only a cryptographic hash (bcrypt)

2.2. Data received via OAuth authorisation

When you authorise via third-party services (Google, VKontakte, Telegram, Odnoklassniki, Pinterest) we receive only public profile information:

• User identifier in the corresponding system
• First name and last name (public)
• Email address (if provided)
• Avatar URL (if available)

2.3. Social network account data

To perform the core function of the Service — publishing content to social networks — we obtain and store:

• Access tokens for social network APIs (VK, Telegram, OK, YouTube, Pinterest)
• Identifiers of connected pages, groups, and channels
• Account metadata (name, avatar, follower count)

Tokens are stored in encrypted form and used solely to perform actions requested by the User (publishing posts, retrieving statistics).

2.3a. Pinterest integration

When you connect a Pinterest account to PublPost, Pinterest issues us an OAuth access token that grants limited access to your boards and pins. The token is used exclusively for actions you initiate:

• creating, scheduling, editing, and deleting pins;
• reading engagement analytics (impressions, saves, pin clicks, outbound clicks) for pins published through PublPost;
• reading the list of your boards so the composer can let you choose where to publish.

PublPost does not share Pinterest data with third parties, does not use it for advertising, and revokes our access immediately when you disconnect the account. Our use of Pinterest data complies with the Pinterest API Terms of Service and Developer Guidelines.

2.3b. TikTok integration

When you connect a TikTok account to PublPost, TikTok issues us an OAuth access token with the following scopes: user.info.basic, video.upload, video.publish, video.list. The token and related data are used exclusively for actions you initiate:

• uploading and publishing videos to your TikTok account;
• polling publish status (TikTok processes videos asynchronously — we poll until status transitions to «published»);
• reading engagement metrics (views, likes, comments, shares) for videos you published through PublPost to display analytics in your dashboard;
• reading basic profile information (display_name, avatar) to render the connected account in the UI.

PublPost does not share TikTok data with third parties, does not use it for advertising or retargeting, and does not aggregate data across users. When you disconnect the account, we revoke the access token via TikTok's OAuth revoke endpoint and delete stored tokens and metadata. Our use of TikTok data complies with the TikTok API Terms of Service and Developer Platform Guidelines.

TikTok API limitations: deleting or editing already- published videos via the API is not supported by TikTok — these actions are only available inside the TikTok app. PublPost does not simulate these actions and does not provide UI for them.

2.3c. YouTube (Google API) integration

When you connect a YouTube channel to PublPost, Google issues an OAuth access token with the scopes: youtube.upload, youtube.readonly, youtube.force-ssl. Data usage:

• uploading videos and Shorts to your channel;
• reading channel information (title, subscriber count, list of your own videos) for display in the dashboard;
• deleting videos that were uploaded through PublPost (requires youtube.force-ssl scope);
• retrieving published-video metrics (views, likes, comments) for analytics.

PublPost complies with the Google API Services User Data Policy, including the Limited Use requirements: Google user data is not transferred to third parties, is not used for personalised advertising, is not used to develop, improve, or train AI/ML models, and is not accessible to humans (except with the user's explicit consent or to resolve technical support issues).

2.3d. X (Twitter) integration

When you connect an X account to PublPost, we receive an OAuth 2.0 access token with the scopes: tweet.read, tweet.write, users.read, offline.access. Data usage:

• publishing tweets and threads on behalf of the user;
• reading basic profile information (handle, display name, avatar);
• deleting tweets published through PublPost;
• retrieving published-tweet metrics (impressions, likes, retweets, replies) for analytics;
• refreshing the token via refresh-token (offline.access) without re-prompting OAuth.

Our use of X data complies with the X Developer Agreement & Policy. PublPost does not pull data outside actions initiated by the user and does not aggregate third-party data.

2.3e. Instagram (Meta) integration

Instagram integration via the Meta Graph API requires an Instagram Business / Creator account linked to a Facebook Page. Requested scopes: instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights, pages_show_list, pages_read_engagement, pages_manage_posts. Data usage:

• publishing posts, Reels, and Stories;
• reading and replying to comments (moderation);
• reading post metrics (impressions, reach, engagement, saves);
• fetching the list of Facebook Pages so the user can pick the linked Instagram account.

Complies with the Meta Platform Terms and Developer Policies.

2.3f. Threads (Meta) integration

When you connect Threads to PublPost, we receive an OAuth token with the scopes: threads_basic, threads_content_publish, threads_manage_insights. Data usage:

• reading basic profile info (username, avatar);
• publishing posts and threads;
• reading published-post metrics (views, likes, replies, reposts).

The Threads API is a Meta product; data use follows the same Meta Platform Terms and Developer Policies as Instagram/Facebook (see section 2.3e for links).

2.3g. Facebook (Meta Pages) integration

When you connect a Facebook Page to PublPost, we obtain a Page Access Token (derived from a User Access Token) with the scopes: pages_show_list, pages_manage_posts, pages_read_engagement, pages_manage_engagement, pages_manage_metadata, pages_read_user_content, read_insights. Data usage:

• displaying the list of your Pages so you can pick the target;
• publishing posts, photos, and videos to the selected Page;
• reading comments and reactions for moderation;
• deleting and editing posts published through PublPost;
• reading Page Insights (impressions, reach, engagement) for analytics.

Complies with Meta Platform Terms and Developer Policies (links in section 2.3e). PublPost does not request access to Page direct messages and does not publish content without an explicit user action.

2.3h. Reddit integration

When you connect Reddit to PublPost, we receive an OAuth token with the scopes: identity, submit, edit, read, history. Data usage:

• reading basic account info (username);
• submitting posts to subreddits you select;
• editing and deleting posts published through PublPost;
• reading public subreddit posts for the preview that appears when choosing a target subreddit;
• reading your own submission history so we can correlate Reddit posts with their entries in PublPost.

Complies with the Reddit Data API Terms. PublPost does not use Reddit data to train AI models and does not aggregate third-party content.

2.4. User content

• Post text (posts, descriptions)
• Uploaded images and video files
• Publication schedules
• Drafts and templates

2.5. Automatically collected data

• IP address
• Browser type and version (User-Agent)
• Operating system
• Date and time of access to the Service
• Cookies (see section 8)
• Analytics data (Yandex.Metrica)

2.6. Payment data

Service payments are processed by a certified payment provider. We do not store payment card data (card number, CVV, expiration date). The payment provider processes data in accordance with PCI DSS. We retain only: transaction ID, payment date and amount, subscription status.

6.2. Social networks

To publish content, we share data via official social network APIs: VKontakte, Telegram, Odnoklassniki, YouTube. Data shared: post text, media files, publication parameters. Processing of data by social networks is governed by their own privacy policies.

6.3. Payment providers

For payment processing, data is shared with a PCI DSS certified payment provider. We share: User email, payment amount and description.

6.4. Analytics

We use Yandex.Metrica to analyse use of the Service. Yandex.Metrica automatically collects de-identified visit data. Yandex.Metrica's processing of data is governed by Yandex's Privacy Policy.

6.5. AI providers

To generate content at the User's request, we share text data (prompts, brand context) with OpenAI. Data is used solely to generate the response and is not retained by the provider for model training (when accessed via API). Media files and personal User data are not shared with AI providers.

6.6. Other cases

We may disclose personal data upon request by authorised state bodies in cases provided for by Russian Federation law.