Privacy policy

What we store

• Your account: your email address and a bcrypt hash of your password. We never store the password itself, and we do not ask for your name; the app shows one derived from your email address.
• Your campaigns: name, website, description, tone, platforms, subreddits, the posts generated for each platform and your edits, their status, scheduled times and publishing results.
• Images you add to a campaign, so platforms can fetch them when you publish. Each image is served at an unguessable public address: anyone with that link can open it.
• Connected social accounts: for each platform you connect, the access token, the refresh token and expiry where the platform issues them, and the account identifier it returns (for example your LinkedIn member ID, or your Bluesky DID and server). For LinkedIn we also read the pages you manage, so you can post as one of them.
• Your AI generation preferences (tone, emoji use, hashtags, length and creativity), so they follow your account across browsers.
• Scheduling and analytics: the scheduled times, publish status and engagement figures recorded with your campaign posts.

We set one cookie, auth_token, an httpOnly cookie that keeps you signed in. AutoMarketer has no advertising or third-party analytics cookies. Your browser also keeps your theme, your AI settings and a local copy of your campaigns in its own storage.

Your AI model key

Your AI key never reaches our servers. It is kept in your browser’s local storage and sent from your browser straight to the provider you choose: OpenRouter, or an OpenAI-compatible endpoint you configure. Your campaign brief goes to that provider so it can write the posts, under the provider’s own terms and privacy policy. Only your non-secret generation preferences are saved on our servers.

How tokens are protected

You sign in on each platform’s own page, so we never see your social media passwords. The tokens a platform gives us are stored on our servers, tied to your account only, and used only to publish what you ask AutoMarketer to publish and to keep the connection refreshed. They are sent only over HTTPS, and only to the platform that issued them.

For Bluesky, the private key your tokens are bound to (DPoP) is encrypted at rest with AES-256-GCM. Access and refresh tokens for the other platforms are not yet encrypted separately in our database; they are protected by restricted access to the database and our hosting provider’s controls. Account passwords are stored only as bcrypt hashes.

How we use it

We use your data only to run AutoMarketer for you: to sign you in, keep your campaigns, publish to the platforms you choose and show your schedule and results. We do not sell your data, use it for advertising, or use your content to train AI models.

Who else handles it

• DigitalOcean hosts the app and its database.
• Cloudflare provides DNS and network delivery for tynhub.com addresses.
• The social platforms you connect: LinkedIn, X (Twitter), Reddit, Meta (Facebook and Instagram) and Bluesky (or the Bluesky server you use). Each receives the posts and images you publish there and handles them under its own policies.
• The AI provider you choose with your own key, which receives your campaign brief directly from your browser.

AutoMarketer does not send email.

Disconnecting accounts and deleting data

• Disconnect a platform in Settings, Connected Platforms: its tokens are deleted from our servers. You can also revoke AutoMarketer’s access from the platform’s own settings at any time.
• The app has no delete button yet. To delete a campaign, or your account and everything stored with it, email [email protected] from the address you signed up with. We delete your account, campaigns, images, tokens and preferences within 30 days.
• Posts you have already published stay on each platform until you delete them there.
• Clearing your browser’s site data removes your AI key and the local copies kept in your browser.

How long we keep it

We keep your data while your account exists, until you delete it or ask us to. Backups kept by our hosting provider may hold copies for a short time before they expire. Our servers and hosting providers keep technical logs, such as IP addresses and the pages requested, for a limited time for security and troubleshooting.

Children

AutoMarketer is a tool for businesses and is not directed at children under 16.

Changes to this policy

When we change this policy we update this page and the date above. For a significant change we will also post a notice in the app before it takes effect.

Contact

Questions and requests about your data: [email protected].