SuprPost
Sign inStart free trial

Privacy Policy

Last updated: October 8, 2026

1. Who we are

SuprPost (“we”, “us”) is a service for scheduling and publishing social media posts. We are the controller of the personal information described here. This policy explains what we collect, why, who helps us process it, how long we keep it and how you can control it. Questions about this policy or your data: support@suprpo.st.

2. Information we collect

  • Your account. When you sign in with Google we receive your name, email address and profile picture. We don’t receive your Google password.
  • Connected social accounts. When you connect an account on Bluesky, X, Threads, Instagram, Facebook, LinkedIn, YouTube, TikTok or Pinterest, we receive an access token (and, where the platform issues one, a refresh token) that lets us act on that account for you, plus its profile details: platform account ID, username or handle, display name, profile picture, account type, and the Pages, channels or organizations you choose to use. Tokens are encrypted before they are stored and are never shown in the app.
  • Your content. Posts, captions, first comments, schedules, queues, media (images, video, documents) and their edits, brand kit assets, saved captions, important dates, and the results of publishing (each platform’s post ID, link and any error).
  • Workspaces and teams. Workspace names, logos and settings, and the people invited to them — including the email address of anyone you invite, which we use to send the invite.
  • Billing. Your plan, trial and subscription status, and payment dates. Checkout and payments are handled by Polar, our merchant of record; we receive a customer and subscription reference from Polar but never your card details.
  • Developer and AI access. API keys (we store only a hash of each key), webhook endpoints and recent delivery records, and the AI assistants you connect over MCP, with the permissions you granted them.
  • Usage and technical data. Server and request logs (IP address, browser user agent, timestamps, and the pages or API endpoints requested), used for reliability, security and abuse prevention, and aggregate page-view statistics from our web analytics.
  • Messages to us. What you send when you email support, including refund requests.

3. How we use it

  • To provide the Service: sign you in, store and schedule your posts, publish them to the accounts you choose at the times you choose, and show you the results.
  • To send service emails: a welcome email, team invites and changes, alerts when a post fails or an account needs reconnecting, and a weekly summary of your workspace. We don’t send marketing email from the app.
  • To run billing, trials and plan limits, and to handle refunds and support requests.
  • To keep the Service secure, prevent abuse and fraud, debug problems and enforce our Terms.
  • To understand, in aggregate, how the Service is used so we can improve it.
  • To meet legal obligations.

We act on a connected account only when you ask — by scheduling, publishing, editing or deleting a post, or by an assistant or API key you authorized. We do not sell your personal information, share it for cross-context behavioral advertising, or use data from connected accounts for advertising.

Legal bases (EEA/UK): performance of our contract with you (providing the Service), our legitimate interests (security, abuse prevention, service emails and improving the Service, balanced against your rights), compliance with legal obligations, and your consent where we ask for it — which you can withdraw at any time.

4. Google user data and YouTube

We use Google APIs in two ways. Google Sign-In gives us your name, email address and profile picture to create and secure your account. We record which Google account you signed in with, but we don’t keep the tokens Google issues at sign-in.

Connecting a YouTube channel uses the YouTube API Services and asks Google for one permission, “Manage your YouTube account” (https://www.googleapis.com/auth/youtube). We use it only for the channel you connect, and only to:

  • read your channel’s ID, name and profile picture, to show which channel is connected;
  • list your playlists and YouTube’s video categories when you open a video’s YouTube settings;
  • upload the videos you schedule or publish, with the title, description, tags, category, visibility, audience setting and custom thumbnail you choose, and add them to the playlist you pick;
  • when you let YouTube release a video at its scheduled time, upload it as Private with that release time, then move the release time, take it off schedule or make it public straight away when you change the post or choose “Publish now”;
  • check a video’s processing status and visibility after upload, and change the title, description and tags of, or delete, a video you published through SuprPost when you ask us to.

From Google we store: your channel’s ID, name and profile-picture link; the access token and refresh token Google issues for the channel; the list of permissions you granted; and, for each video SuprPost uploads, its YouTube video ID, link, visibility and scheduled release time, with the post’s chosen playlist and category. Your list of playlists is fetched when you need it and isn’t stored. We don’t download or keep your other videos, your watch history, your subscribers’ details or your channel’s private settings. How we protect this data is described in Security.

SuprPost’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described here; we don’t sell it, use it for advertising, or let people read it except with your permission, for security, or to comply with the law.

By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can revoke SuprPost’s access at any time from your Google security settings, or by disconnecting the channel in SuprPost, which immediately deletes its stored tokens and also revokes our authorization with Google (unless the same Google account is still connected in another SuprPost workspace). Videos already published to YouTube stay on YouTube until you delete them there.

5. Who we share it with

We use these service providers (subprocessors) to run SuprPost. Each processes data only to provide its service to us:

  • Vercel — application hosting and request logs.
  • MongoDB Atlas — the database for accounts, workspaces, posts and settings.
  • Cloudflare R2 — storage for uploaded media.
  • Resend — delivery of service emails.
  • Polar — checkout, payments, invoicing and tax, as merchant of record.
  • Google — sign-in (and the YouTube API Services when you connect a channel).

We also send data where you direct it: your posts and media to the platforms you publish to, your workspace’s data to members of that workspace, and data you request to AI assistants, API clients and webhook endpoints you connect. Those recipients handle it under their own terms and privacy policies. We may disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of the Service (with notice to you).

6. How long we keep it

  • While your account exists we keep your data so the Service works, including after a trial or subscription ends — nothing is deleted because a plan lapsed.
  • Deleting your account (Account settings → Account → Delete account) immediately and permanently deletes your account, the workspaces you own and everything in them — posts, media files, queues, connected accounts and their tokens, webhooks, saved captions, brand kits, notifications — and ends your sessions, API keys and AI-assistant access, after cancelling any paid subscription. Content you created in workspaces owned by someone else stays with those workspaces.
  • Disconnecting a social account deletes its stored tokens immediately, and for YouTube, X, TikTok and Bluesky also revokes SuprPost’s access on the platform.
  • Sessions expire after 30 days without use.
  • Webhook delivery records are deleted after 30 days; short-lived sign-in and connection links expire on their own.
  • Billing webhook log. For each billing event Polar sends us we record its event ID and type, when it arrived and was processed, the outcome, and the SuprPost user ID it applied to — never payment details. We use it to apply each event exactly once and to investigate billing problems. It is kept after you delete your account.
  • Billing records. Your plan and subscription status are deleted with your account. Polar, as merchant of record, keeps its own transaction records and invoices.
  • If you can’t sign in, email us from your account’s address and we will verify your identity and delete your data within 30 days — see Data Deletion Instructions.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or download (port) your personal information, to object to or restrict certain processing, and to withdraw consent. In the app you can:

  • update your profile and workspace details in Account settings and Settings;
  • disconnect any social account from the Accounts page;
  • revoke API keys and connected AI assistants under AI Agents & API;
  • delete your account and its data from Account settings → Account.

For anything else, email support@suprpo.st. We respond within one month and may need to verify your identity first. If you are in the EEA or UK, you can also complain to your local data protection authority.

California residents have the right to know what personal information we collect and how we use and disclose it, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA. You can use an authorized agent to make a request on your behalf.

8. Cookies and local storage

We don’t use advertising or cross-site tracking cookies. We use:

  • A session cookie that keeps you signed in. It is strictly necessary, and expires after 30 days without use.
  • Short-lived security cookies while you connect a social account, which protect the sign-in handshake with the platform and expire within minutes.
  • A preference cookie that remembers whether you collapsed the sidebar, and browser local storage for display preferences.

9. Security

We protect your data — including Google user data and the tokens that let us act on your connected accounts — with these measures:

  • Encryption in transit. SuprPost is served only over HTTPS, and browsers are told to always use HTTPS for it (HTTP Strict Transport Security). Our servers reach Google, YouTube and the other platforms over HTTPS, and our connection to the database is encrypted with TLS.
  • Tokens encrypted at rest. Access and refresh tokens for connected accounts, including YouTube, are encrypted by SuprPost before they are written to the database, with AES-256-GCM authenticated encryption and a fresh random nonce for each value. The encryption key is kept as a server secret in our hosting configuration, separate from the database, so a copy of the database alone doesn’t reveal any token.
  • Tokens stay on our servers. A token is decrypted only on our servers, at the moment we make a request to the platform for you. Tokens are never sent to your browser, never included in responses from our API or MCP server, never shown to workspace members or in our admin tools, and never written to our logs; error details returned by Google are stripped of credentials before they are logged.
  • Hashed credentials. API keys, and the tokens issued to AI assistants you connect, are stored only as SHA-256 hashes, never in readable form.
  • Sign-in and connection protection. Your session cookie is HttpOnly, Secure and SameSite, and sessions expire after 30 days without use. Each YouTube connection is bound to a random state value, kept in an HttpOnly cookie that expires after 10 minutes and checked when you return from Google, so a forged connection request is refused.
  • Access restrictions. A connected channel can be used only by signed-in members of the workspace it is connected to, within what their role allows.
  • Private media storage. Uploaded media is kept in a private storage bucket with no public address. It is reached only through signed links that expire within 24 hours, created when you view a file or when SuprPost publishes it. To post a video to YouTube, our server reads it from storage and uploads it directly to Google over HTTPS.
  • Deletion. Disconnecting an account deletes its tokens immediately; deleting a file, a workspace or your account deletes the stored media and data as described in How long we keep it.

No system is perfectly secure; if a breach affects your personal information, we will notify you and the authorities as the law requires.

10. International transfers

Our providers may process data in the United States and other countries outside your own. SuprPost’s server functions run in Vercel’s Washington, D.C., USA region. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses (and the UK addendum) in our providers’ data processing terms.

11. Children

SuprPost is not intended for anyone under 18, and we don’t knowingly collect personal information from children. If you believe a child has given us personal information, contact support@suprpo.st and we will delete it.

12. Changes to this policy

We will update this policy when our practices change and revise the date above. If a change is material, we will tell you by email or in the app before it takes effect.

13. Contact

Email support@suprpo.st, including for data protection requests.