Privacy Policy

Post and Ghost (the "Service") is operated by Pierce Labs and Consulting LLC ("we", "us"), which is the data controller for personal data processed through the Service.

1. Information We Collect

We collect the following information:

• Account information: email address when you sign up
• Profile information: name, username, and timezone (optional)
• Social media tokens: OAuth tokens and credentials for connected platforms, stored securely with AES-256-GCM encryption at rest
• Post content: the messages you compose and post through the Service
• Connected account data: the account ID and username of each platform you connect, and engagement metrics (such as likes, replies, views, and reach) for posts you publish through the Service
• API keys: hashed (SHA-256) API keys for external access; we never store the plaintext key
• Usage data: basic analytics such as post counts and subscription status

2. How We Use Your Information

We use your information to:

• Provide the Service (posting to your connected social accounts)
• Show you analytics for posts you publish through the Service
• Authenticate your identity and manage your account
• Process payments and manage subscriptions
• Improve and maintain the Service

3. Data Storage and Security

Your data is stored in Supabase (PostgreSQL) with row-level security policies. Social media credentials are encrypted at rest using AES-256-GCM encryption. API keys are stored as SHA-256 hashes only. We use HTTPS for all data transmission.

4. Third-Party Services

We share data with the following third-party services only as needed to operate:

• Supabase: database and authentication
• Vercel: hosting and deployment
• Trigger.dev: background jobs that publish your scheduled posts
• Stripe: payment processing and subscription management (Stripe is the merchant of record)
• AI model providers (via Vercel AI Gateway): if you enable AI questions, your chosen topic and your answers are sent to generate personalized writing prompts
• Social media platforms: your posts are sent to the platforms you select (X, Bluesky, Threads, LinkedIn, Mastodon, Nostr, TikTok, Instagram, Discord)
• Nostr relays: posts are published to public relays (relay.damus.io, nos.lol, relay.nostr.band, relay.snort.social)

5. Data From Meta (Threads and Instagram)

When you connect Threads or Instagram, we receive from Meta your account ID, username, an access token, and, for posts you publish through the Service, engagement metrics. We use this data only to publish content you create, show which account is connected, and show you analytics for your own posts. We do not sell this data, use it for advertising, or share it with anyone other than the service providers listed above that host and run the Service. Disconnecting an account deletes its stored access token immediately. You can also revoke access at any time from your Threads or Instagram settings.

6. Requests From Public Authorities

We only disclose personal data to public authorities when legally required. We review every request for legality, challenge requests we consider unlawful, disclose only the minimum data necessary, and keep a record of each request, our response, and the legal reasoning behind it.

7. Data Retention and Deletion

We retain your data for as long as your account is active. To delete a connected account's data, disconnect it from Profile, Connections, which removes its stored credentials immediately. To delete your entire account and all associated data, email support@bannme.com from your account email address with the subject "Delete my account", and we will delete your personal data within 30 days. Posts already published to third-party platforms are not affected by account deletion. Nostr posts are immutable once published to relays.

8. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Disconnect your social media accounts at any time
• Revoke API keys at any time

To exercise these rights, contact us at support@bannme.com.

9. Cookies

We use essential cookies only for authentication and session management. We do not use tracking cookies or third-party advertising cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the email associated with your account.