Privacy Policy

1. Who We Are

Smart Post Studio ("we", "us", "our") is the controller of your personal data. You can contact us at support@smartpoststudio.com with any privacy-related queries.

2. What Data We Collect

Account data (stored on our servers):

• Email address
• Password (stored as a hashed value using PBKDF2 — we cannot read it)
• Plan type (trial / pro) and account creation date

Waitlist data (stored on our servers):

• Email address and name
• Platforms of interest and follower range (optional)
• Sign-up date and marketing consent status

Data stored only on your device (never sent to us):

• Scheduled posts, captions and media files
• Brand profile information
• Social media OAuth tokens (stored in your OS keychain)

Usage data:

• Anonymous daily API request counts (no personal identifiers)

3. How We Use Your Data

• Account management: To authenticate you and manage your subscription
• Service delivery: To process social media posts you schedule through the app
• Marketing emails: Only if you gave explicit consent at sign-up (you can withdraw any time)
• Security: To detect and prevent fraud or abuse

4. Legal Basis (GDPR)

• Contract: Processing your account data to deliver the service you signed up for
• Consent: Sending marketing emails (only where you opted in)
• Legitimate interests: Security monitoring and fraud prevention

5. Data Sharing

We do not sell your data. We share data only with:

• Cloudflare Inc. — infrastructure provider (servers, database, CDN). Cloudflare processes data under a Data Processing Agreement. Data may be stored in the US and EU.
• Social media platforms (X/Twitter, TikTok, etc.) — only when you connect your accounts and authorise posting. We do not store your social media credentials on our servers.
• Gumroad — payment processor. We receive only your email and licence key from Gumroad on purchase.

6. YouTube Integration

Smart Post Studio lets you publish videos directly to your YouTube channel. This section explains what data we access and how it flows.

What we access:

• youtube.upload — to publish videos to channels you own
• youtube.readonly — to display your channel name inside the app so you can confirm which channel a post will publish to

We request the narrowest scopes that allow the product to function. We do not request scopes for analytics, channel management, comment moderation, or any data we do not need to publish your content.

How the data flows:

• Your YouTube access token is stored in your operating system's secure credential store (macOS Keychain on Mac, Credential Manager on Windows). It is never transmitted to or stored on Smart Post Studio's servers.
• When you publish a video, the file is read from your computer's disk and uploaded directly to YouTube's servers using YouTube's resumable upload API.
• Smart Post Studio's servers are not in the data path for YouTube uploads. We do not receive, process, transmit, or store your video files, video metadata, captions, or thumbnails.
• After upload, YouTube returns the video ID. Smart Post Studio stores this ID locally on your computer so the post appears in your sent history.

Token refreshes: Access tokens issued by Google expire periodically. Smart Post Studio's server includes a thin OAuth helper that exchanges your refresh token for a new access token when needed. This is the only YouTube-related operation that touches our server, and only the token strings are exchanged — no video data or content.

When you disconnect: You can disconnect a YouTube channel from Smart Post Studio at any time through the app's Accounts settings, or directly from your Google Account permissions page. Disconnection removes the access token from your local credential store and revokes it with Google.

Compliance: Smart Post Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By using Smart Post Studio to publish to YouTube, you also agree to be bound by the YouTube Terms of Service.

7. Data Retention

• Account data: retained while your account is active, deleted within 30 days of account deletion
• Waitlist data: retained until you request deletion
• Anonymous usage stats: retained for 90 days

8. Your Rights (GDPR & CCPA)

You have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and all associated data
• Portability — receive your data in a machine-readable format
• Withdraw consent — opt out of marketing emails at any time
• Object — object to processing based on legitimate interests

9. Data Deletion

You can delete your account and all associated data at any time from within the app (Settings → Delete Account) or by emailing us. Deletion is permanent and irreversible. Local data on your device (posts, media, brand profile) must be deleted manually.

10. Security

• Passwords are hashed using PBKDF2 with 100,000 iterations and a random salt — we cannot recover your password
• All API communication uses HTTPS/TLS
• OAuth tokens are stored in your operating system's secure keychain, not on our servers
• We do not log personal data in request analytics

11. Cookies

Our website uses no tracking cookies. Cloudflare may set a security cookie (__cf_bm) for bot protection. The app itself does not use cookies.

12. Children

Smart Post Studio is not directed at or intended for use by anyone under 18 years of age. We do not knowingly collect data from minors.

13. Changes to This Policy

We will notify registered users by email of material changes to this policy at least 14 days before they take effect.

14. Contact & Complaints

Email: support@smartpoststudio.com

If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.