Privacy Policy

deploy.social is a tool for publishing short-form videos, photos and text posts to multiple platforms from one place. This page explains what information we handle, why, and what control you have over it. No legalese — if anything here is unclear, email hello@deploy.social and a human will explain it.

The short version

We store your account, your videos, photos and text posts, and encrypted credentials for the platform accounts you connect — because that’s literally what the product does. We don’t sell your data, we don’t mine your content, and we don’t use it to train AI. When you delete something, it’s deleted.

We do use analytics to see how people use the site, and we advertise deploy.social on Google and in ChatGPT, with Google and OpenAI measuring which ads lead to sign-ups. Both are spelled out under Analytics and advertising, along with how to opt out. Neither one’s ad measurement ever receives your videos, your photos, your captions, or anything from the accounts you connect.

Who we are

deploy.social is operated by Deploy Social LLC, Bozeman, Montana, USA. Contact: hello@deploy.social.

What we collect and why

• Your account. Email address, display name, and — if you use password sign-in — a hashed password (we can’t read it). If you sign in with Google, we get your name, email, and avatar from Google. This is how you log in and how we reach you.
• Your content. The videos, photos, thumbnails, text posts, captions, titles, tags, and schedules you create in the app. We store them so we can convert your videos and photos into each platform’s required format and publish your posts where you tell us to.
• Connected platform credentials. When you connect a platform account (YouTube, TikTok, Instagram, Facebook, Threads, X, or Bluesky), we store the credential that platform gives us — an OAuth token or app password. These are encrypted at rest with AES-256-GCM and are used for exactly one thing: doing what you asked (uploading and publishing your content, checking its status, and reading back how your posts are doing so we can show you the numbers on the Analytics page).
• One social account, one Free account. A social account can be connected to one Free Deploy account at a time. To check that, we use the ID the platform gives each social account. If you sign in to one that another Free account already has, we may show you a masked version of that account owner’s email (like a•••@example.com) and let you move it, and we email that owner when it moves. We keep a record of moves, and if a Free account is deleted we keep each connected account’s ID and that month’s post count for 60 days, so the monthly limit can’t be reset by signing up again.
• Your post statistics. For posts you published through us, the counts each platform reports (views, likes, comments, shares, and your follower count where the platform shares it). We read them with the access you gave us, keep them so the Analytics page can show them. They're deleted when the post is removed, and within 7 days of you disconnecting the account.
• Notifications and preferences. Whether you want emails when a deployment finishes or fails, plus in-app notification history. Now and then we also email product updates, like a new destination or a big feature. You can turn those off in Settings under Notifications, or with the unsubscribe link in any of them.
• Feedback you send. When you use the feedback button in the app, we keep your message, your email address, the page you were on, your browser type and, if you leave the box checked, a screenshot of that page. It all lands in the tracker where we fix bugs (more on that under Who else touches your data). Uncheck the screenshot box if something private is on screen.
• Operational basics. Standard server logs (timestamps, requests, errors) and error reports so we can keep the service working and debug problems. No fingerprinting. When you sign in, on the web or in the app, we keep a rough note of the device and network it came from, so you can spot a sign-in that wasn’t you.
• How you use the site. Pages visited, buttons clicked, and recordings of sessions, collected with PostHog so we can see where people get stuck. Once you’re signed in, this is tied to your account and email address. Details under Analytics and advertising.

Google user data (YouTube)

deploy.social uses YouTube API Services to provide every YouTube feature in the app — connecting your channel, uploading your videos to it, and checking their processing status. This section explains exactly what that involves.

If you connect a YouTube channel, we request exactly two Google OAuth scopes: youtube.upload, which lets us upload videos to your channel and set their title, description, tags, and visibility; and youtube.readonly, which lets us read your channel identity (name, ID, avatar) so we can show you which channel you connected, check a video’s processing status after we upload it, and read its view, like and comment counts and your subscriber count. That is the whole list. We don’t request permission to edit, delete, or comment on anything.

How we use, process, and share YouTube data

• What we store: your encrypted OAuth token, your channel’s identity (name, ID, avatar), and the ID and processing status of each video you upload through us. We also keep the statistics YouTube reports for those videos (views, likes and comments) and your subscriber count, and nothing else: no watch history, no subscriber lists, and nothing about videos you didn’t publish through deploy.social. Every 30 days we check with YouTube that your access is still valid and the video still exists. If we can’t, we delete the statistics.
• How we use and process it: only to provide the features you actively trigger — showing you which channel is connected, uploading the video you asked us to publish, telling you whether it went live, and showing you how your videos are doing. We don’t read your subscriptions, watch history, or anything beyond what the publishing flow needs.
• Internal parties: deploy.social is operated by a single operator, and production access is limited to them. There is no other internal party.
• No advertising or analytics use: the data we get from YouTube API Services is never used for advertising and never fed into analytics. None of it is sent to Google Ads or OpenAI’s ads, or recorded as an analytics event in PostHog; our analytics note only that a YouTube channel was connected, never anything about the channel. When PostHog records a click, it keeps no text or labels from the page, so a click on your channel’s name doesn’t carry the name with it. The site-wide analytics and ad measurement described under Analytics and advertising are about how people use deploy.social, not about your channel. The one place your channel can show up is on screen: your channel’s name and avatar appear in the app, so they can be visible in a screenshot you choose to attach to feedback, and the avatar (never the name) can be visible in a session recording. Those are used only to find and fix problems in the app.
• External parties: your YouTube data is shared with nobody except Google itself (when we make the API calls you asked for, on your behalf) and the service providers that host and support the service, listed under Who else touches your data. We never sell it, never share it with advertisers or data brokers, and never use it to train AI.

Deleting stored YouTube data and revoking our access

• Disconnect in the app: remove the channel on the Destinations page at any time — the stored OAuth token is destroyed immediately, and we delete the YouTube statistics we kept for that channel within 7 days.
• Delete the content records: delete videos and deployments in your Library whenever you like.
• Delete everything: email hello@deploy.social and we’ll erase your stored Google user data (tokens, channel identity, video records) within 7 days.
• Revoke from Google’s side: you can also cut off deploy.social’s access at any time from your Google security settings page, without touching the app at all.

Your Google tokens are encrypted at rest and are never shared with anyone except Google itself when we make API calls on your behalf. Google’s own handling of your data is governed by the Google Privacy Policy. deploy.social’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Other platforms (Meta, TikTok, Bluesky, X)

The same principle applies to every platform you connect: we access only what the publishing flow needs (your account identity, the ability to upload and publish, and post status), we use it only when you trigger it, and the credentials are encrypted at rest. Each platform also has its own privacy policy that governs what happens to your content once it’s published there — that part is between you and them.

Who else touches your data

We run on a small set of service providers (“subprocessors”). Each one gets only what its job needs:

• Railway — hosts the application, the database, and the background jobs that convert and publish your videos and photos (USA).
• Cloudflare — DNS, and object storage (R2) where your uploaded and converted videos and photos live. When a platform such as TikTok fetches your video or photo itself instead of us uploading it, it collects the file from media.deploy.social, a small Cloudflare service that hands out one file per short-lived signed link.
• Resend — sends our email (sign-in links, deployment notifications, product updates) and keeps the list product updates go to: your email address, your first name and your plan (USA).
• Stripe — processes payments and runs subscriptions for the paid plans (USA).
• PostHog — product analytics, session recordings, and error reports, hosted in the USA. See Analytics and advertising.
• Google — besides YouTube and Google sign-in, Google Ads measures whether a visit from one of our ads led to a sign-up or a paid plan. See Analytics and advertising.
• OpenAI — measures whether a visit from one of our ads in ChatGPT led to a sign-up or a paid plan (USA). See Analytics and advertising.
• GitHub — where we track bugs, in a private repository. Feedback you send from the app is filed there as an issue with your message, your email address, the page you were on and, if you attached one, the screenshot. Automatic reports, such as a publish that failed on our side, are filed there too; those carry internal ids and error details, never your captions, videos, photos, or email address (USA).
• The platforms you connect — Google/YouTube, Meta (Instagram, Facebook, Threads), TikTok, Bluesky, X — receive your content through their APIs when you publish to them, because that’s the point.

Apps you connect to deploy.social yourself, such as an AI assistant, are your choice rather than our providers; they’re covered under Apps and assistants you connect. We will update this list when it changes.

Analytics and advertising

PostHog (product analytics). We use PostHog to understand how people use deploy.social: which pages get visited, where sign-up stalls, which features get used, and what errors come up. It records page views, clicks, and session recordings: replays of where someone scrolled and tapped. Every piece of text and everything you type is masked out of a recording before it leaves your browser, so a replay can’t carry a caption, an email address or a channel name. Pictures aren’t masked, so an avatar, a photo or a video thumbnail on screen can show up in one. The recorder starts only after the page has finished loading, and never for a browser sending Global Privacy Control, even though the rest of PostHog described here still runs for that browser. Before you sign in you’re an anonymous visitor to it; once you’re signed in, what it collects is linked to your account and your email address, so we can follow up on a problem you hit. PostHog stores this in the USA, and it’s used only by us, to improve the product. We don’t sell it and we don’t use it for advertising. We keep it after an account is deleted, so we can learn what got in someone’s way and fix it.

Google Ads (conversion measurement). We advertise deploy.social on Google. When you arrive from one of our ads, Google’s tag on our site stores an ad click identifier in your browser, and if you then create an account or start a paid plan, the tag tells Google so. That lets us see which ads are worth paying for. While it’s loaded, the tag also tells Google which of our pages you view (the page’s address and title, with a random browser reference), so we can see which pages lead to a sign-up and show our ads to people who have visited before. Google receives the fact that a sign-up or purchase happened (with the plan price for a purchase), the click identifier, a random reference so each one counts once, and the standard details any website request carries, such as your IP address and browser. It never receives your videos, photos, captions, connected accounts, or YouTube data. If you sign up, start a paid plan, or connect your first platform after arriving from one of our ads, our server tells Google Ads too. It sends a scrambled (hashed) copy of your email so Google can match it to the ad click. We never do this if your browser sends Global Privacy Control, or after you’ve told us not to share. Google’s use of this data is covered by the Google advertising policy.

ChatGPT ads (conversion measurement). We also advertise deploy.social in ChatGPT. OpenAI’s measurement pixel on our site works the same way: it stores a random browser reference, plus the ad click identifier when you arrive from one of our ads, and if you then create an account or start a paid plan, it tells OpenAI so. It also tells OpenAI when it loads on a page, with that page’s address. OpenAI receives the fact that a sign-up or purchase happened (with the plan and its price for a purchase), the click identifier, the same random reference Google gets so each one counts once, and the standard details any website request carries, such as your IP address and browser. To match a sign-up to an ad when the click identifier is missing, the pixel can also pick up contact details shown on the page, such as your email address once you’re signed in, and sends them only as a one-way hash (a scrambled code, never the address itself). It never receives your videos, photos, captions, connected accounts, or YouTube data. OpenAI’s use of this data is covered by the OpenAI privacy policy.

Opting out. If your browser sends a Global Privacy Control signal, we don’t load Google’s ad tag or OpenAI’s pixel at all, so none of their cookies are set. You can also block cookies in your browser. Or email hello@deploy.social from the address on your account and we’ll switch Google’s tag off for your account, along with OpenAI’s pixel, so neither loads while you’re signed in, on any device. (It can’t follow you while you’re signed out, because then we don’t know it’s you; Global Privacy Control or blocking cookies covers that.) If your browser sends Global Privacy Control while you’re signed in, that also switches ad reporting off for your account from then on, on any device, the same as emailing us. You can manage how Google uses ad data in your Google ad settings.

Apps and assistants you connect (API and MCP)

Standard and Studio include an API and an MCP server, so your own scripts and AI assistants can work with deploy.social for you. There are two ways in:

• API keys. You create a key in the API tab of your account. We show it to you once and store only a scrambled (hashed) copy, plus its name and when it was last used. Anyone holding the key can act in that workspace, so treat it like a password.
• Connected apps. AI assistants such as Claude, ChatGPT and Cursor can connect through our sign-in and consent screen. You choose the workspace and whether the app can only read or can also post. We keep a record of what you approved and the access tokens that go with it.

A key or connected app can see and act on the workspace you gave it: its videos and photos, its posts and drafts with their captions, and the list of connected destinations (never their credentials). Anything it reads is sent to that app because you asked for it, and what the app does with it from there is governed by its own privacy policy, not ours. You can revoke any key or connected app from the API tab of your account at any time, and its access ends straight away.

Payments

If you’re on a paid plan, your payment details are collected and processed by Stripe, Inc. — card numbers never reach our servers. Stripe gives us back only what we need to run your subscription: a customer identifier and a subscription identifier, which plan you’re on, whether the subscription is paid up, and, when Stripe provides them for display, the last four digits and the brand of your card. What Stripe itself does with your payment data is governed by the Stripe Privacy Policy.

How long we keep things, and how to delete them

• Media, drafts, and deployments: delete them yourself in the Library at any time. Deleting media removes the files from storage. Deployment history for posts you actually published is kept so your records stay accurate.
• Connected accounts: disconnect any destination at any time in your account settings — the stored credential is destroyed immediately. (Publishing history to that account is preserved, minus the credentials.)
• Your whole account: delete it yourself, any time, from Profile in your account settings — account, media, credentials, API keys and connected apps, gone immediately. Product analytics are kept (see Analytics and advertising). Prefer email? Write to hello@deploy.social and we’ll do it for you within 30 days.
• Meta-initiated deletion: if you remove the app from your Meta settings, Meta pings our deletion endpoint automatically and we deactivate the connection and destroy its credentials, with a confirmation page you can check.

Security

Platform credentials are encrypted at rest (AES-256-GCM envelope encryption). Everything moves over TLS. Access to production systems is limited to the operator. No system is perfect; if we ever have a breach that affects you, we’ll tell you promptly and plainly.

If you connect a destination before signing up

You can authorize a destination — Instagram, YouTube, TikTok, Facebook, Threads, X or Bluesky — before you create a deploy.social account. When you do, we hold that platform’s credential — encrypted at rest, the same way every other platform credential is — together with the account’s public identity (handle, display name, avatar) so we can show you what you authorized.

It stops being usable 30 minutes after you create it, whether or not you finish signing up — after that it can no longer be claimed by anyone, including you. The record itself is then erased by a cleanup job that runs hourly, so the deletion follows within about an hour of expiry rather than at the exact minute. Expiry is the only removal path: there is no button that deletes it sooner, and closing the tab or clearing the cookie does not delete it either. If you have already asked us for a sign-in link, opening that link still claims the connection — on any device, with or without that cookie.

It is not attached to any account or workspace until you sign in. If we can tell that the sign-in is the same browser session that authorized it, we attach it as soon as you land; if we cannot — you opened the link on your phone, or the browser cookie is gone — we show you the account we are about to attach it to and wait for you to confirm. If the platform sends you back to a different browser than the one you started in, for example from an app’s built-in browser to Safari, we hold the connection in the browser you land in and always ask you to confirm the account before adding it. The cookie that ties the connection to your browser expires on its own within 90 minutes, and once the connection itself has expired the cookie no longer does anything.

That deletion destroys our copy of the credential. It does not remove deploy.social’s access at the platform itself — and that is the part you can end straight away: remove the app in your Instagram or Google account settings, or revoke the app password in Bluesky, and the credential we are holding stops working immediately, whether or not our copy has been erased yet. Connecting a destination never signs you in or creates an account on its own: only a verified Google login or email link does that.

The same holding applies if you already have an account and the platform sends you back to a browser where you aren’t signed in. We keep the connection for your account only, for the same 30 minutes, and add it once you sign in there as yourself and confirm it. Signing in as anyone else discards it.

Cookies and browser storage

Here is everything deploy.social stores in your browser, and what each piece is for. On the live site our own cookie names carry a browser security prefix (__Secure- or __Host-), so in your browser’s developer tools authjs.session-token shows up as __Secure-authjs.session-token.

• Keeping you signed in (authjs.session-token, plus short-lived authjs.csrf-token and authjs.callback-url while you sign in). The session lasts up to 30 days, or until you sign out.
• Finishing a sign-in link (deploy-login-continuation, deploy-login-redeem). Lets a sign-in link opened on another device, or the code from that email, finish signing you in here. Gone within an hour.
• Connecting before you sign up (deploy-preaccount-flow, deploy-preaccount-visitor, deploy-preaccount-claimed). Tie a destination you connected to your browser, and limit repeated attempts. Each expires within 90 minutes.
• Client connection links (deploy-client-flow, deploy-client-link). Set when someone opens a link a Studio customer sent them to connect their accounts. Each expires within 90 minutes.
• PostHog analytics (a ph_…_posthog cookie and a matching entry in local storage). A random identifier so visits from the same browser are counted together, linked to your account once you sign in. It lasts about a year; clearing it makes you a new anonymous visitor.
• Google Ads conversion measurement (_gcl_au, and _gcl_aw plus a _gcl_ls local storage entry when you arrive from one of our ads). Set by Google’s tag on deploy.social to connect an ad click to a later sign-up or purchase. They last about 90 days. Not set at all if your browser sends Global Privacy Control.
• Google ad click id, set by us (deploy-ad-click). The Google ad click id from the link you arrived by, kept so a later sign-up or purchase can be credited to that ad. It lasts 90 days. Never set if your browser sends Global Privacy Control, and removed on your next visit once it does.
• ChatGPT ads conversion measurement (__obref, and __oppref when you arrive from one of our ads in ChatGPT). Set by OpenAI’s pixel on deploy.social to connect an ad click to a later sign-up or purchase. __oppref lasts 30 days and __obref a year. Not set at all if your browser sends Global Privacy Control.
• A draft you start before signing up (local storage). The caption, title, visibility and release timing you set before you have an account. When you sign in, we move it into your account’s draft and clear it from the browser.
• Small conveniences. Things like which tab you last picked in the docs, how you grouped your Library, whether you dismissed the feedback prompt, one-time flags so a sign-up or purchase is only reported to each ad network once (all in local storage), and a note of which menu item you just clicked so the menu can animate to the next page (in session storage, gone when you close the tab). These never leave your browser.

You can clear or block any of these in your browser settings. Blocking the sign-in cookies will sign you out; everything else keeps working without them.

US state privacy rights

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or sharing. We won’t treat you differently for using any of these rights.

We don’t sell personal information, and we never have. The Google Ads and ChatGPT ads conversion measurement described under Analytics and advertising may count as “sharing” for cross-context behavioral advertising under the California Privacy Rights Act (CPRA) and similar laws, because Google and OpenAI use it to measure and improve ad campaigns. You can opt out of that sharing two ways:

• Global Privacy Control. We honor it. With it on, your browser never loads Google’s ad tag or OpenAI’s pixel on deploy.social, so no ad cookies are set and nothing is reported to Google Ads or OpenAI.
• Email us at hello@deploy.social with “Do not sell or share” in the subject, and we’ll switch Google’s ad tag and OpenAI’s pixel off for your account. From then on neither loads while you’re signed in, on any device. For visits while you’re signed out, Global Privacy Control is what tells us.

For any other request (a copy of your data, a correction, a deletion), email the same address. We’ll confirm it’s really you, usually by replying to the email on your account, and answer within 45 days. You can also have someone you authorize make a request for you.

Kids

deploy.social isn’t intended for anyone under 13, and we don’t knowingly collect information from children.

Changes to this policy

If we change this policy in a way that matters, we’ll note the new date at the top and, for significant changes, email you. We won’t quietly weaken it.

Contact

hello@deploy.social — a human reads this.