What we store
Your email address, used to sign you in. We use magic links, so we never hold a password.
Access tokens for the social accounts you connect. These are what let us publish on your behalf. They are stored server-side and are not readable by any browser session, including your own — the database explicitly withholds those columns from client access.
The posts you write, the media you upload, and when each was scheduled or published.
Engagement figures we fetch back from each network for posts you published through AttentionPilot.
Basic billing records if you subscribe. Card details are handled by Stripe and never reach our servers.
What we do with it
We use it to run the product: writing captions, scheduling posts, publishing them, and showing you what happened.
If you use the AI writer, the text of your idea and your brand-voice settings are sent to Anthropic to generate captions. We do not send your access tokens, your media, or anything about your audience.
We do not sell your data, and we do not use your posts to train anything.
Who else sees it
The social networks you connect, when we publish on your behalf — that is the point of the product.
Supabase, which hosts our database and file storage. Vercel, which hosts the application and counts page views for us — cookielessly, with no profile of you built and nothing shared onward. Anthropic, for AI caption generation only. Stripe, for payments. We run no advertising trackers and no third-party analytics beyond that.
Nobody else. We do not run advertising trackers on the application.
How long we keep it
For as long as your account exists. Delete your workspace and the posts, media, tokens and metrics go with it.
Disconnecting a social account deletes its stored tokens immediately.
Your rights
You can export or delete your data at any time — see the data deletion page for how. If you are in the UK or EU, you additionally have the rights granted by UK GDPR and GDPR, including access, rectification, erasure and portability.
To exercise any of these, or to ask anything about this policy, email the address on the data deletion page.
Changes
If this policy changes in a way that materially affects you, we will tell you by email before it takes effect rather than quietly updating the date at the top.