Privacy Policy

Account information: your name, email address, and a hashed password (we never store passwords in plain text).

Connected social accounts: the platform name, handle, and — for live integrations — the access credentials you provide (such as a Bluesky app password) or OAuth tokens issued by the platform. These are used only to publish the content you ask us to publish.

Content: the captions, images, and videos you upload for posting, plus your scheduling preferences.

Basic usage data: pages visited and actions taken inside the app, used to keep the service reliable.

To operate the service: publishing and scheduling your posts on the platforms you connect, showing your analytics, and providing support.

We do not sell your data. We do not share your content or credentials with third parties, except the social platforms you explicitly connect — and only to publish on your behalf.

When you connect a social account, we only use the permissions needed to publish content you create. We never read your private messages, followers lists, or other data unrelated to publishing.

You can disconnect any account at any time from the Accounts page, which removes its credentials from our database immediately.

Passwords are hashed with bcrypt. Sessions use httpOnly cookies. Platform credentials are stored server-side and are never exposed to your browser or other users.

Uploaded media is stored on our servers solely to publish and display your posts.

You can delete your entire account and all associated data (posts, media, connected accounts, credentials) at any time from Settings → Danger zone. Deletion is immediate and irreversible.

You can also email us to request deletion and we will process it within 30 days.

We use a single session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

If this policy changes, we will update this page and note the new effective date below.

Questions? Email support@crossposting.xyz.