Privacy Policy

1. Information We Collect

1.1 Account Information

When you register with an email address, we collect that email address and your password, which Supabase Auth stores only as a hash. If you sign in with Google, Google sends us your name, email address, profile picture and Google account ID; we use them only to create and sign in to your account. We use Supabase for authentication and database storage, and Resend delivers the sign-in, confirmation and password-reset emails and account notices (such as the warning before an inactive free account is deleted, section 8).

1.2 Social Media Platform Credentials

To provide our Service, we require OAuth tokens and API keys for the social media platforms you connect (Instagram, Facebook, LinkedIn, TikTok, Threads, X, Discord, YouTube and Pinterest), and, for platforms without OAuth, the credentials you enter on our connection page: a Telegram bot token you created and a Bluesky app password. These credentials are encrypted at rest and used solely to perform actions you authorize through our platform. You can revoke a Telegram bot token in @BotFather and delete a Bluesky app password in Bluesky at any time.

1.2.1 LinkedIn Data

For LinkedIn connections, Ampost currently requests the LinkedIn scopes openid, profile, email, and w_member_social. We store encrypted access tokens, refresh tokens when LinkedIn provides them, token expiry, refresh-token expiry, granted scopes, the member ID or URN, OIDC claims such as name, email address, email verification flag, profile image URL, locale, and connection metadata such as the auth flow, selected platform set, and whether organization posting is enabled for that workspace.

1.2.3 TikTok Data

For TikTok connections, Ampost currently requests the TikTok scopes video.upload, video.publish, and user.info.basic. We store encrypted access and refresh tokens, token expiry, granted scopes, the creator open ID, creator username, avatar URL, nickname, available privacy levels, disabled comment/duet/ stitch flags, max video duration, selected platform set, and related connection metadata needed to validate TikTok publishing.

1.2.4 YouTube Data (YouTube API Services)

Ampost uses YouTube API Services to publish videos to the YouTube channel you connect. By connecting a YouTube channel you agree to be bound by theYouTube Terms of Service, and Google processes your data under theGoogle Privacy Policy. Ampost requests the scopesyoutube.uploadandyoutube.force-ssl, through a Google OAuth client separate from Google sign-in.

• What we access and store: encrypted access and refresh tokens, granted scopes, your channel's ID, title, handle and picture, and for each video you publish through Ampost its video ID, link, processing state and the platform's response. For analytics we read the view, like and comment counts of those videos and your channel's subscriber and video counts. We do not read your other videos, comments, watch history or subscriptions.
• How we use it: only to upload the videos you send us with the title, description, privacy and other settings you choose, post the first comment you write, edit or delete those videos when you ask, and show you their statistics. We do not use YouTube data for advertising and do not sell it.
• Who we share it with: YouTube receives the videos and settings you publish. Our subprocessors (section 4) store and process the data for us. AI clients, API keys and webhooks you set up receive what you ask them to. Nobody else.
• Cookies: Ampost does not let YouTube or other third parties place cookies on your device through Ampost.
• Revoking access and deletion: disconnect the channel in Ampost (we revoke the token at Google at once), or revoke Ampost on theGoogle security settings page. Either way we delete the tokens immediately and the rest of the channel's data within 7 days (section 8).

1.2.5 Pinterest Data

For Pinterest connections, Ampost requests the scopesboards:read,boards:write,pins:read,pins:writeanduser_accounts:read. We store encrypted access and refresh tokens, token expiry, granted scopes, your Pinterest username, account type and picture, the default board you pick (its ID and name), and for each Pin you publish through Ampost its Pin ID, link and the platform's response. We list your boards only to let you pick one, and create a board only when you ask. For analytics we read impressions, saves, reactions and comments of those Pins and your follower and Pin counts.

1.3 Content and Usage Data

We collect the content you create and schedule through our Service (posts, media, captions, metadata), analytics data (engagement metrics, post performance), and usage data (API calls, feature usage, log data).

For TikTok publishing specifically, this can include post text, photo or video metadata, requested privacy and disclosure settings, creator restriction snapshots, publish IDs, published URLs when available, provider lifecycle states, token-health transitions, and disconnect or revocation events. TikTok may be limited to private-only visibility while app review or Direct Post approval is still pending.

For LinkedIn publishing specifically, this can include member post text, link metadata, image or video metadata, alt text, visibility controls, post URNs, published URLs, provider lifecycle states, retry history, token-health transitions, and disconnect or revocation events. Ampost's current LinkedIn launch surface is limited to member publishing; we do not claim organization/Page posting, analytics, comments, or feed-reading APIs in this launch.

The analytics beta covers connected Facebook Pages, Instagram Professional, Threads, TikTok, Bluesky, YouTube and Pinterest accounts (YouTube and Pinterest: only posts published through Ampost), X accounts whose owner turned X analytics on (only posts published through Ampost, for 29 days), and the member count of Telegram channels. We cache up to 90 days of provider-available content discovery, lifetime content metric snapshots, daily follower counts, capability results, and sanitized sync diagnostics. It is not real-time, does not deduplicate followers across profiles, and does not include Stories, analytics exports, or webhook-driven analytics.

1.4 Technical Data

We automatically collect certain technical information including IP address, browser type, device information, operating system, and timestamps of API requests.

Sign-in, sign-up and password reset run a Cloudflare Turnstile bot check, which sends your IP address and browser signals to Cloudflare. To limit abuse we count attempts per IP address and per email address; we store these counters only as hashes, for the length of the rate-limit window.

1.5 API Keys, MCP Access and Webhooks

• API keys: the name you give a key, its prefix and last characters, its scopes and platform sets, when it was last used, and a hash of the key. We never store the key itself.
• MCP OAuth: AI clients that register with our MCP server (client name, redirect addresses, a hash of the registering IP address), and the access you grant them (authorization codes, hashed access and refresh tokens, scopes and platform sets). You can revoke a grant in Settings.
• Outgoing webhooks: the endpoint URL and description you enter, the signing secret (encrypted), the events you chose, and a delivery log with each event payload, the response status, the first part of the response body and timing. We delete delivery log entries after 30 days.

1.6 Feedback and Bug Reports

When you report a bug or suggest a change (in the dashboard, or through the API or MCP), we store your message with: the page or API call it is about, your browser, your plan, your connected accounts (platform, status and health, not their tokens), the request and error you report, and the dashboard's last 20 API calls (address, status, request ID and error message, not their content). We remove fields named like passwords, tokens or keys. A screenshot is attached only if you tick the box and pick what to share. We are notified, and the report is copied to our own issue tracker on a server we run, where an AI assistant (Claude, by Anthropic) helps us sort it. We delete reports 12 months after they are sent, or with your account.

2. Legal Basis for Processing

We process personal data under the following legal bases, depending on the purpose of processing:

• Account creation, authentication, and service delivery: performance of a contract with you.
• Connecting social platforms, storing OAuth credentials, scheduling posts, and publishing content: performance of a contract and carrying out your instructions.
• Billing, subscriptions, invoices, and tax records: performance of a contract and compliance with legal obligations.
• Security, abuse prevention, debugging, rate limiting, and fraud prevention: our legitimate interests in protecting the Service, our users, and connected platform integrations.
• Server request logs (security, abuse prevention, aggregate traffic and crawler analysis): our legitimate interests (Art. 6(1)(f) GDPR); see section 7.
• Feedback and bug reports: performance of a contract (fixing the Service you use) and our legitimate interests in improving it.
• Service communications: performance of a contract and our legitimate interests in keeping you informed about the Service.
• Optional marketing communications: consent, where required by applicable law.
• Google Analytics on the public website: your consent, given in the cookie banner, which you can withdraw at any time on the Cookie Settings page.

Where we rely on legitimate interests, we balance those interests against your privacy rights and expectations.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Publish and schedule content to connected social media platforms on your behalf
• Process API requests and deliver analytics
• Send service-related communications (notifications, updates)
• Detect, prevent, and address technical issues and abuse
• Comply with legal obligations

We do not use your content to train AI models or for any purpose other than providing the Service to you. We do not sell your personal data.

4. How We Share Your Information

We share your information only in the following circumstances:

• Social Media Platforms: Content you publish is transmitted to the platforms you have connected (including Instagram, Facebook, LinkedIn, TikTok, Threads, X, Bluesky, Telegram, Discord, YouTube and Pinterest) according to their respective APIs.
• Service Providers (subprocessors): the companies in the table below process data on our behalf under data processing agreements. The same list, kept up to date, is on our subprocessor page.
• Payments (Link): paid plans are sold through Link, so Stripe is the merchant of record. At checkout Stripe collects your name, email, billing address and payment details as its own controller, under the Link Privacy Policy, to take the payment, handle tax, fraud, refunds and disputes, and answer payment questions. We send Stripe only the plan and your Ampost account id; Stripe sends us the Stripe ids, plan, status and dates of your subscription. If you ask Link to delete your data, Stripe also cancels the subscription it sold and erases you from its records; we then end the paid plan.
• Feedback and bug reports: Anthropic (United States, under Standard Contractual Clauses) processes the text and any screenshot of a report when our AI assistant helps us sort it (section 1.6). Anthropic does not use it to train its models.
• Endpoints you configure: webhook endpoints and AI clients you authorize receive the data you chose to send them.
• Legal Compliance: We may disclose information if required by law, regulation, or valid legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Storage and Security

Our primary application database and server-side application runtime are hosted in Frankfurt, Germany. We use Supabase for database and authentication services, and Vercel for application hosting and server-side functions. We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest (AES-256)
• Platform tokens and webhook secrets are encrypted before storage with keys managed in AWS KMS (Frankfurt); API keys and OAuth tokens are stored only as hashes
• Row-Level Security (RLS) policies in the database ensuring data isolation between users
• Regular security reviews and monitoring

While we implement strong security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Third-Party Services

Our Service integrates with third-party social media platforms. Each platform has its own privacy policy and terms of service. When you connect a platform to Ampost, you are also subject to that platform's policies. We encourage you to review the privacy policies of:

• Meta (Instagram, Facebook, Threads)
• TikTok
• LinkedIn
• Google (YouTube):Google Privacy PolicyandYouTube Terms of Service
• Pinterest:Privacy Policy

Ampost's use and transfer to any other app of information received from Google APIs, YouTube API Services included, adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

For LinkedIn, please also review LinkedIn's Privacy Policy and Professional Community Policies. LinkedIn may separately impose product-access restrictions, commercial-use review, or token revocation requirements on applications like Ampost.

7. Cookies

We use minimal cookies and browser storage for essential functionality, including Supabase authentication session cookies, temporary OAuth state cookies for connected platform flows, and local storage for theme preference.

We do not use advertising or retargeting cookies. Optional analytics cookies are set only after you accept them in the cookie banner. You can change or withdraw that choice, and see the full cookie list, on the Cookie Settings page. Your choice is stored for 12 months in the essential ampost_consent cookie.

Google Analytics (with your consent): on our public website (not the signed-in dashboard, sign-in callbacks or account connection pages) we use Google Analytics 4 to understand in aggregate which pages are visited, how visitors move between them, and which buttons they click. It sets the cookies _ga (2 years) and _ga_<container-id> (2 years) and processes a pseudonymous browser identifier, the pages you view, your browser, device and approximate location derived from your IP address. Google does not log or store IP addresses for Google Analytics 4. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC process this data as our processor; Google signals and ad personalization are off and no data is used for advertising. Data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework, in which Google LLC participates. We keep Google Analytics data for 14 months. Without your consent, Google Analytics is not loaded at all; when you withdraw consent we delete the Google Analytics cookies from your browser.

On our public website (not the signed-in dashboard) we use Vercel Web Analytics to count page views and clicks on key buttons in aggregate. It sets no cookies and stores no IP addresses; visitors are counted with a hash that changes daily, and query strings other than campaign (UTM) tags are removed before sending. Vercel Inc. processes this data as our hosting provider.

Server logs: when you request a page on ampost.io, our hosting provider Vercel Inc. records the IP address, browser (user agent), requested page, referrer, response status and time. We receive these logs in our own internal tool, which stores the IP address only as a hash, uses it to tell visitors, search engine bots and AI crawlers apart, and aggregates the requests into traffic statistics. We use them for security, abuse prevention, and aggregate traffic and crawler analysis, based on our legitimate interests (Art. 6(1)(f) GDPR). No cookies are involved. We keep raw log entries for up to 90 days; after that only aggregated statistics remain.

8. Data Retention

We retain your account information and content for as long as your account is active. When you delete your account (Settings, Account), we cancel any subscription and immediately delete your posts, media, connected accounts and their tokens, analytics, platform sets and queues, API keys, MCP grants, webhooks and their delivery log, upload and connection requests, usage counters, plan data and your feedback reports. Your sign-in record is deleted too: Supabase Auth replaces your email address with a hash and removes your password, name, profile picture and Google sign-in data. We keep only:

• Billing records for paid plans: your Stripe customer ID and your subscriptions (plan, status, billing period, Stripe IDs), and a log of Stripe event IDs. Polish tax law requires us to keep accounting records for 5 years from the end of the year they relate to; we delete them after that. Stripe, as merchant of record, keeps your invoices and payment details under the Link Privacy Policy.
• A hash of each disconnected social account, for 30 days, so the same social account can't be moved between free accounts to get around plan limits.
• Logs and backups: server request logs for up to 90 days (section 7), the authentication provider's security log of sign-in events (including your email address and IP address) for 90 days, and database backups, which are overwritten within 60 days.
• Meta data deletion requests: when Facebook, Instagram or Threads asks us to delete your data, we log the request (your Meta user ID, the confirmation code and the outcome) for 1 year as evidence that we deleted it, then delete the log entry.
• Aggregated, anonymized data that cannot identify you.

Feedback and bug reports are deleted 12 months after they were sent, or earlier with your account.

Inactive free accounts. If nobody signs in to a free account (one without a paid subscription) or uses its API keys for 24 months, we email the account's address 30 days in advance and then delete the account as described above, unless you sign in before the date in the email. Accounts with a paid subscription are never deleted for inactivity.

You can export your posts from the dashboard or the API at any time, and ask us for a copy of all your data at privacy@ampost.io.

Images and videos you upload, or that we copy for a scheduled post, are stored at a public, hard-to-guess address so the social platforms can fetch them. We re-save images without their metadata, such as camera details and GPS location. We delete these files when you discard the post, 7 days after the post is published or has failed, and within a day when no post uses them. The copies the platforms published stay there.

When you disconnect a social account, delete a platform set, or delete your Ampost account, we delete the stored access and refresh tokens for those accounts immediately. We also ask the platform to revoke Ampost's access where it offers a way to do so (Facebook, LinkedIn, TikTok, X and YouTube; for Discord we delete the channel webhook). Instagram, Threads and Pinterest offer no such endpoint, and a platform may still list Ampost as a connected app after a revoke. You can remove Ampost in the platform's own settings, for example Instagram: Settings, Website permissions, Apps and websites; LinkedIn: Settings, Data privacy, Permitted services; Threads: Settings, Account, Website permissions; Pinterest: Settings, Security and logins, Apps; or Google (YouTube): the Google security settings page. For Telegram and Bluesky, remove the bot from your channel or delete the app password. Published posts remain on the platform unless you delete them there.

A disconnected social account (disconnected by you, by deleting its platform set, or by the platform, for example when you remove Ampost there) keeps its name, picture and the links to your published posts for 30 days (a YouTube channel: 6 days, as YouTube's policies require deletion within 7 days), so you can reconnect it as it was. After that we delete it, or, where your posts still refer to it, remove its account ID, name, picture and profile details and the platform's post IDs, links, responses and error messages from those posts. Your own post text and media stay with your posts. A Meta data deletion request removes the same data at once, also for accounts that were already disconnected.

If LinkedIn does not provide a refresh token for your app or later revokes it, Ampost marks the connection as reconnect-required and asks you to complete the OAuth flow again.

Disconnecting a Facebook or Instagram account immediately and permanently removes its cached analytics and follower history from Ampost. Provider deauthorization, uninstall, Meta delete-data, and Ampost account deletion also stop analytics jobs and purge analytics. Cancelling an analytics-only reconnect leaves the existing publishing connection and cached history unchanged.

9. Your Rights

As Ampost is based in Poland (EU), the General Data Protection Regulation (GDPR) applies to all users. Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, commonly used format.
• Objection: Object to processing of your personal data in certain circumstances.
• Withdraw Consent: Withdraw consent where processing is based on consent.
• Restriction: Restrict processing of your personal data in certain circumstances.
• Complaint: Lodge a complaint with a supervisory authority. The Polish Data Protection Authority (PUODO) is our lead supervisory authority.

To exercise any of these rights, contact us at the email address below. We will respond within 30 days (or the statutory period under GDPR) as required by applicable law.

Your US state privacy rights

If you live in California or another US state with a consumer privacy law, you have the same rights described above: to know what personal information we collect, use and disclose (the categories are in section 1, the purposes in section 3, and the recipients in section 4), and to access, correct, delete and port it. We do not sell or share personal information, including for cross-context behavioral advertising, and we do not use sensitive personal information for anything other than providing the Service, so there is nothing to opt out of. Send requests to privacy@ampost.io, yourself or through an authorized agent; we verify requests against your account email, answer within 45 days, and will not treat you differently for using these rights. If we refuse a request, you can appeal by replying to our answer.

10. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it promptly.

11. International Data Transfers

Our primary application database and server-side application runtime are hosted in Frankfurt, Germany, within the European Union. The providers we use, and where they process data, are listed in section 4. Some of them may process limited personal data outside the EU/EEA. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other GDPR-approved transfer mechanisms. Google Analytics data, collected only with your consent, may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework.

Our company is based in Poland, an EU member state. The processing of personal data is governed by Polish law and the GDPR, with PUODO (Polish Data Protection Authority) as the lead supervisory authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website. Your continued use of the Service after such notification constitutes acceptance of the updated policy.

13. Contact Us

Ampost is operated from Poland (EU). If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Privacy requests: privacy@ampost.io
• Legal requests: legal@ampost.io
• Support: support@ampost.io

You also have the right to lodge a complaint with the Polish Data Protection Authority (PUODO) at uodo.gov.pl.