Privacy Policy

#What we collect

• Your account: your email address and a password (stored encrypted), or the account you signed in with, such as Google.
• Your workspace: posts, captions, schedules, media, templates, who approved what, and the roles of the people on your team.
• Connected channels: each account's name and handle, plus the key that lets us publish for you. Depending on the platform that is a login token, a bot or API key, or your Bluesky app password. All of these are encrypted before we save them.
• Inbox: the messages and comments we load for the channels where you use the inbox (more on this below).
• Notifications: a push token for each device where you turned notifications on.
• Imports and automations: the Notion page or Google Sheet you import from and the content you bring in, and any API keys you create for Zapier or AI agents.
• Billing: Stripe handles payments on the web, and the app store handles them on mobile. We only keep a customer and subscription reference. We never see your card number.

#Your connected social accounts

When you connect a channel, the platform gives us a key so we can publish your scheduled posts. For most platforms that is a login token. For WordPress, Telegram, Discord and Ghost it is an app password, bot token or API key. For Bluesky it is your handle and an app password, which we keep encrypted and only use to start short publishing sessions. We never see or store the password you use to log in to a social network.

Here is what we do with each one:

• X: read your profile, post and upload media for your scheduled posts, and read and answer direct messages. X needs a paid Sosial plan because X charges for its API.
• Instagram: read your Business or Creator profile, publish your photos, videos and reels, and read comments and direct messages so you can answer them. We do not ask for access to your Instagram insights.
• TikTok: read your basic profile and video stats, publish your videos and photos, and check your posted videos to confirm they went out.
• Facebook: list the Pages you manage, publish to them, and read their posts, comments and Messenger conversations so you can reply. We never touch your personal profile.
• Threads: read your profile, publish your posts, read and answer replies, and read stats for posts made through Sosial.
• Bluesky: publish your posts with their images and video, and read and answer direct messages and comments.
• Mastodon: on the server you choose, publish your posts and media, and read and answer direct messages and comments. We save your server address so posts reach the right place.
• LinkedIn: once LinkedIn approves us, confirm who you are, publish as you or as a Company Page you run, and read those posts and their stats.
• YouTube: upload videos, check your channel and video list to confirm uploads, and manage comments on videos you posted through Sosial.
• Pinterest: read your account and boards, and publish your scheduled Pins to the boards you pick.
• WordPress, Dev.to, Hashnode and Ghost: publish your scheduled articles (and their cover images, where the platform supports it) to the site or publication you connect.
• Telegram and Discord: send your scheduled posts to a channel, group or server through a bot you add.
• VK: publish your scheduled posts to your VK profile or community.
• Google Business Profile: once Google approves us, publish posts to a business location you manage.

LinkedIn and Google Business Profile are marked "Soon". You can see them in the app, but they cannot be connected yet, and we collect nothing for them until they can.

You can disconnect a channel at any time on the Channels screen. That deletes its key and stops publishing. If you also want everything we saved for that channel gone, use Delete data, which removes its posts, stats, comments and messages. You can also remove Sosial's access from the platform's own settings, which stops publishing straight away.

#Media and import sources

When you add a photo or video from one of these sources, we show you your files so you can pick one, then download only that file. We never change, move, share or delete anything in your storage or design library. Unsplash photos automatically get the photographer's name and link in your caption, because Unsplash's license asks for it.

• Dropbox and OneDrive: browse your folders and download the file you pick.
• Canva: browse your designs and download the one you pick.
• Unsplash: search for photos and add the one you pick, with its credit.
• Notion: turn pages you have shared with Sosial into drafts. Nothing is written back to Notion.
• Google Sheets: turn rows from a sheet you share into scheduled posts. Nothing is written back to the sheet.
• Zapier and MCP: let your own automations and AI agents create posts, using an API key you make and can delete at any time.

Google Drive and Google Photos are marked "Soon" while Google reviews our access. We do not touch any Drive or Photos data until then.

Login tokens for Dropbox, OneDrive and Canva stay on your device (in your phone's secure storage, or your browser on the web). They never reach our servers, and disconnecting a source deletes them from your device right away.

#How we use your data

• To publish your posts at the times you set.
• To show your calendar, queue, inbox, comments and results.
• To run approvals and let the right teammates know when something needs a look.
• To send the notifications you turned on, and account emails like sign-in links, invites and notices.
• To handle your subscription and answer your support requests.

We do not sell your data. We do not use your content to train AI. We do not use Google user data for ads. Our use of data we get from Google APIs follows the Google API Services User Data Policy, including its Limited Use rules.

#AI features

When you use the writer, channel captions, or blog and studio drafts, we send your brief and the material you chose to OpenAI, and the result comes back to your workspace. We do not train AI on it, and OpenAI does not train on data sent through its API. If you turn on web research, the writer searches the web and shows you the sources it used. AI can make mistakes, so check the result before you publish.

#Messages and comments

If you use the inbox, we load the direct messages and comments that arrive on your connected channels so you can see and answer them in one place. That covers direct messages on Facebook Pages, Instagram, X, Mastodon and Bluesky, and comments on Facebook, Instagram, Threads, X, Mastodon, Bluesky and YouTube. The other channels do not give us messages or comments.

• For messages we save: the other person's name and profile picture, what each of you wrote, attachments, the time, and whether it was sent or received.
• For comments we save: the author's name and profile picture, the comment, which post it is on, the time, and whether you replied.

We check each platform for new messages on a schedule and when the platform tells us something new arrived, and we save them so your inbox loads quickly. Anyone in your workspace who can see a channel can read its inbox. Messages stay until you use Delete data for that channel or delete your workspace. Deleting a message on the platform does not remove it from Sosial, so you do not lose the thread you were working on. We never sell this data, use it for ads, or train AI on it.

#Notifications

If you turn on push notifications, your device gets a push token from Expo, which delivers them for us. We save it with your account and device type so we can tell you when a post goes out, fails or needs approval, or when your team changes. A notification can show a post title or a teammate's name, so that much may appear on your lock screen. You can turn notifications off in the app or in your phone's settings, and we delete the token when you delete your account.

#Who else sees your data

Only the companies we need to run Sosial, and only for that:

• The social platforms you connect, to publish your posts and load your inbox.
• Supabase, which runs our database, sign-in and part of our file storage.
• Cloudflare, which stores your uploaded media (R2) and protects our domains.
• Vercel, which hosts the Sosial website and web app.
• The hosting providers that run our background worker, which publishes your scheduled posts and syncs your inbox.
• Expo, which delivers push notifications to your phone.
• Resend, which sends our emails.
• OpenAI, for the AI features you choose to use.
• Stripe and the app stores, for payments.
• The import sources you connect (Dropbox, Canva, Unsplash, OneDrive, Notion, Google Sheets), only to fetch what you pick, and Zapier or an AI agent, only through an API key you created.

These companies can only use your data to provide their service to us, and they are bound by contract to protect it. We may also share data if the law requires it or to protect people's safety, and where we are allowed to, we will tell you first.

We do not sell Google user data, use it for ads, or use it to train general AI models. No one on our team reads your Google data unless you ask us to for support, it is needed for security or the law, or it has been made anonymous.

#How we keep it safe

• Everything travels over HTTPS (TLS 1.2 or newer).
• Our database, file storage and backups are encrypted.
• Channel keys, app passwords and API keys are encrypted with AES-256-GCM before they are saved. They are only unlocked when we need to publish or load your inbox, and never shown in the app or written to logs.
• We ask platforms for the smallest set of permissions each feature needs.
• Only the people who run Sosial can reach our production systems, they need two-factor sign-in to do it, and that access is logged.
• Encryption keys live in a secrets manager, not in our code, and we change them regularly.
• If there is ever a breach that affects your data, we will tell you, and Google where it involves Google data, as soon as we can.

#How long we keep it

We keep your data while your account is active. When you delete your workspace, we delete your content, connected accounts and personal details. A few records may stay a little longer for legal, tax or security reasons, and old copies in backups expire on their own.

Accounts with no sign-ins or activity for six months are deleted with all their data. We email you a month before, and signing in stops it. Accounts on an active paid plan are never deleted for inactivity, and a shared workspace stays as long as one member is active. Support tickets and their screenshots are deleted 30 days after the ticket is closed. You can also delete everything yourself at any time from your profile or on the deletion page.

#Marketing emails

We only send product news and tips if you ask for them, at signup or in your settings. Every email has an unsubscribe link that works right away. We never give your email address to advertisers, and unsubscribing does not stop account emails like security alerts, receipts or publishing notices.

#Your choices

• See and export: everything in your workspace is visible to you, and you can export your content at any time.
• Fix: you can edit or delete any post, draft or connected channel.
• Delete: you can delete your workspace and everything in it. Request deletion.

#Cookies

We use one cookie, to keep you signed in. There are no ad trackers and no third-party analytics following you around the web.

#Children

Sosial is a work tool and is not meant for children. We do not knowingly collect data from anyone too young to have a social media account where they live.

#Changes and contact

If we make an important change to this policy, we will tell you in the app first. Questions about your data? Email [email protected]. EGATE WORLDWIDE is responsible for your data under this policy.

#Changelog

What changed in this document, newest first.

#27 October 2026

• Rewritten in plain language, with the current list of service providers.
• Now covers every channel, the inbox, approvals, notifications and the AI writer.
• Removed mentions of comment moderation features that are not available yet.

#24 October 2026

• Added sections on messages and comments.
• Disconnecting a channel keeps its post history; Delete data erases it.
• Effective date set to 24 October 2026.

#17 October 2026

• Added OneDrive and Pinterest.

#13 October 2026

• Covers AI, integrations, the MCP server, deletion, and how long support tickets are kept.

#12 October 2026

• Sign-up consents and the marketing email opt-in.

#8 October 2026

• Updated for 18 channels and the live integrations.
• Added how Google user data is shared and protected.

#5 October 2026

• Lists which media sources Sosial can access, and why.

#29 September 2026

• Links the dedicated data deletion page.

#26 September 2026

• Names EGATE WORLDWIDE as the operator, with [email protected] as the contact.

#21 September 2026

• Explains how Sosial uses each platform’s API.