Privacy policy
About this policy
unpostedcontent is a work tool for social media managers and agencies. This policy explains what we collect when you use this website and the app, why we collect it, where it is kept and the choices you have.
What we collect
Your account. Your email address, and your password if you set one. Passwords are kept by our sign-in provider only as a secure hash, and nobody can read them.
What you put in the app. Your workspace and team, your clients with their contact details and links, posts with their captions, dates, photos and videos, invoices and their files, and tasks. This is your content. We use it only to run the app for you and your team.
Technical data. Our hosting and database providers keep short-lived logs of requests, such as IP address, browser and time, to keep the service secure and to fix faults.
Cookies. Only the cookies the app needs to work, to keep you signed in and to finish a sign-in with Google or Apple. No advertising or analytics cookies.
Signing in with Google or Apple
If you continue with Google or Apple, we receive your email address and an account identifier from that provider, and from Google also your name and profile picture. We use them only to create your account and sign you in.
Apple lets you hide your email address. We then receive a private relay address from Apple instead, and email sent to it reaches you through Apple.
Google Calendar
Connecting Google Calendar is your choice. It shows your own meetings next to your posts in the content calendar, so you can plan around them.
When you connect it, you give unpostedcontent read-only access to your calendar events. We read the events of your primary calendar for the dates on your screen, with their title, start and end times, link and your reply to the invitation. We also keep the email address of the Google account you connected.
The events are shown only to you, in your content calendar. Your teammates do not see them. We fetch them from Google each time you open the calendar and do not store them on our servers. To keep the connection working we store one token from Google, encrypted.
We do not sell Google user data or share it with anyone. We do not use it for advertising, and we do not use it to develop, improve or train AI or machine learning models. No person at unpostedcontent reads it, unless you ask us to for support, it is needed for security, or the law requires it.
unpostedcontent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google Calendar in Settings at any time. We then delete the token and the account's email and revoke our access at Google. You can also remove our access in your Google account permissions.
A workspace can connect a client's Instagram professional account to see the posts already on it in the Studio. With the permission the account's owner gives, read-only access to the profile and its posts, we read the account's username, profile picture and newest posts from Instagram while the Studio is open. We keep the account's identifier, its username and one encrypted token, shared with the workspace's team, and we do not store the posts. Disconnecting the account deletes the token.
Writing captions with AI
When you press Write with AI or Improve with AI in the Studio, we send Anthropic that post's photos and draft, the client's name, business type, area and Instagram handle, and a few of the client's earlier captions, and its model writes a caption. This is sent only when you press the button and only to write that caption. Google Calendar data is never sent.
Sharing a plan with a client
When you send a client a link to the content plan, anyone who has the link can see that client's plan for 14 days, without an account.
Where data is kept and who processes it
Supabase keeps the database, the accounts and the files, on servers in Frankfurt, Germany.
Vercel runs the website and the app, on servers in Frankfurt, Germany, and delivers pages through its global network.
Google, Apple, Meta and Anthropic receive data only when you use the matching feature, as described above.
Some photos on the website and in the app load from Unsplash, which then sees your IP address.
We do not sell your data. We share it only with these providers, to run the service, or when the law requires it.
How long we keep it
We keep your account and content while your account exists, and delete them when you ask us to delete your account. Google Calendar and Instagram tokens are deleted as soon as you disconnect.
Your rights
You can ask to see the data we hold about you, to correct it, or to delete your account and its data.
Security
Data travels over encrypted connections. In the database, each workspace's data can be reached only by its members, and connection tokens are stored encrypted.
Changes to this policy
When this policy changes we update the date at the top. We also tell you in the app about an important change.