Privacy

SyncPoster is built and run by one person, Jubayer. There is no company behind it and no team. If you email [email protected], I am the one who reads it.

• Your account. Your name, your email address, and either a hashed password or the fact that you sign in with Google or an emailed link. I never see your Google password.
• Your connected accounts. For each network you connect: the platform, your handle there, the server address for Mastodon, and the access tokens that let SyncPoster post for you. Tokens are encrypted before they are written to the database.
• Your posts. What you wrote, when you scheduled it, which accounts it goes to, and what each network said back, including errors and the id of the published post.
• Your images. Anything you attach to a post, stored in Cloudflare R2.
• Session records. When you sign in, the app stores a session with your IP address and browser user agent, so you can stay signed in and end sessions you do not recognize. Web server logs hold the same kind of information for a short time.

There is no analytics, no tracking pixels and no third-party scripts on this site. Nothing is sold or shared with advertisers. Your posts are not used to train anything. I do not read your content except when you ask me to look at a problem, or when I have to debug a failure you reported.

SyncPoster runs on a small number of services, and each one sees only the part it needs.

• The networks you connect. Bluesky, Mastodon, LinkedIn and Threads receive the posts and images you schedule to them. Their own terms and privacy policies apply to what happens after that.
• Oracle Cloud. The server and the database run there.
• Cloudflare. Serves the site and stores your uploaded images and the database backups.
• Resend. Sends sign-in links, password resets and the alerts that tell you a post failed.
• Google. Only if you choose to sign in with Google, and only to confirm who you are.

When paid plans launch, a payment provider will handle checkout and hold your billing details. I will name it here before that happens, and card numbers will never reach my server.

One cookie keeps you signed in. That is the only cookie, and the site does not work without it. Your browser also remembers your light or dark theme locally, and holds the address you typed while the “check your inbox” page is open. There are no advertising or tracking cookies, so there is no cookie banner to click away.

Posts, images and connected accounts stay until you delete them or delete your account. Database backups are kept for 14 days, plus a weekly copy for 8 weeks, so anything you delete can survive in a backup for up to roughly two months before it is overwritten.

You can disconnect a network at any time from the accounts page, which removes its tokens. You can delete individual posts and images from inside the app.

To delete your whole account, email [email protected] and I will do it within 7 days, then confirm by reply. If you want a copy of your data first, ask in the same email and I will send it as a file.

Platform tokens are encrypted before they are stored. Passwords are hashed, never stored in a readable form. Traffic runs over HTTPS. Resetting your password signs you out everywhere else.

This is a small operation, so I will not pretend it has been through a formal audit. If you find a security problem, email [email protected] and I will treat it as the first thing I do that day.

The server, the file storage and the email provider are hosted abroad, so your data crosses borders to reach them. Using SyncPoster means you are fine with that.

SyncPoster is not built for children, and you need to be 16 or older to create an account.

When this page changes, the date at the top changes with it. If a change matters to you, for example a new company getting access to your data, I will email you before it takes effect.

Questions, deletion requests, or anything else about your data: [email protected]. See also the terms of service.