Privacy Policy

1. Data we collect

• Account data: your name, email address, language, country and a hashed password if you sign up with one. If you sign in with Google we receive your name, email address and profile picture.
• Workspaces and team: workspace names, settings, posting times and the people you add to a workspace. On the Agency plan, the name, logo URL, colour and domain you set for white-label.
• Connected accounts: when you connect Facebook, Instagram, Threads, TikTok, YouTube, LinkedIn, Telegram, Discord, Bluesky, Pinterest or Google Business Profile we store the access and refresh tokens the platform gives us, or the Bluesky app password you enter (encrypted with AES-256-GCM), the account or Page name, id and picture, the posts we publish for you (status, link, errors, time) and, where the platform provides them, their view, like, comment and share counts for 30 days.
• Content: the text, links, images and videos you give us to post, from the dashboard, the API, a CSV file or an RSS feed you add (we keep the links of the feed entries we have seen).
• API data: API keys (we keep only a hash), webhook URLs and their signing secrets (encrypted), and how many API calls you make. Accounts connected through a connect link may carry an identifier you choose (externalRef).
• Billing data: your plan, payment history and invoices. Card and MoMo-through-Stripe payments are handled by Stripe; we never see full card numbers. For bank transfers, MoMo QR or USDT we keep the invoice code, the amount and, for USDT, the transaction hash.
• Technical data: IP address, browser, pages and actions in the app, from our server logs.

2. How we use it

• To provide the service: check your content for each platform, publish it at the time you choose and tell you (in the app, by email or webhook) how it went.
• To run your account: sign-in, security, plan limits, billing and invoices.
• To send service emails: sign-in codes, failed post alerts, reconnect reminders and payment receipts.
• When you ask for an AI caption (in the composer or on an RSS feed), to send the brief, your draft or the article's title and description to our AI text provider and return the caption.
• To prevent abuse of the platforms we post to (spam, mass duplicate posting) and to keep the service secure.
• To keep the free plan fair: when an account on the free plan connects a channel, we keep a one-way hash of the platform and the channel's id with that account, so the same channel cannot be connected to another free account.

We do not sell your data, use it for advertising, or train AI models on your content.

3. Social platforms

We access each platform only with the permissions you grant on its consent screen, only to publish the content you ask us to publish and to read what is needed for that (account name, picture, post status and link). Some consent screens show the name of our partner app (tovid), which belongs to the same company. You can revoke our access at any time in the platform's settings or by disconnecting the account in dopost, which deletes its tokens.

Our use of YouTube follows the YouTube Terms of Service (www.youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy). Information received from Google APIs is used in line with the Google API Services User Data Policy, including the Limited Use requirements.

4. Who processes it

• IDrive e2 (object storage for your media files), served through Cloudflare (cdn.dopost.app).
• Our servers and database (Vietnam / Singapore region), Redis for queues.
• Amazon SES and Mailtrap (emails).
• Stripe (card and MoMo payments); BNB Smart Chain public nodes (to read USDT transactions you give us).
• An AI text provider with an OpenAI-compatible API, only for the AI captions you ask for; it receives the brief or article text, not your account data.
• The social platforms you post to, which receive the content you publish.

5. How long we keep it

• Media files (images, videos and their converted copies) are deleted automatically 30 days after upload (converted copies after 7 days). We never keep them longer.
• Account tokens are kept while the account is connected and deleted when you disconnect it or delete your account.
• The hash of a channel connected on the free plan (no name, token or content) is kept after the channel is disconnected, to apply the free-plan rule above.
• Posts (text, status, links) are kept while your account exists so you can see your history.
• Invoices are kept as long as accounting law requires.

6. Your choices and rights

You can export or correct your data, disconnect accounts, revoke API keys and delete posts at any time in the app. To delete your account or for any other request, write to [email protected]; we answer within 30 days.

7. Cookies

We use only cookies needed to run the service: the sign-in session, your language, the last workspace you opened and a short-lived cookie that protects account connections (OAuth). No advertising cookies.

8. Changes

We will update this page when what we collect or who processes it changes, and email account owners about important changes.