YesPoster is operated by Webquiel, a sole proprietorship of Rahul Arun Gore (“we”). It lets you write a post once and publish it to your own connected social accounts — including X, LinkedIn, Instagram, Facebook, Pinterest, YouTube, TikTok and Bluesky. This policy explains what we hold, why we hold it, and how to make us delete it.
What we collect
- Account details. Your email address, name and profile image, supplied by Clerk when you sign up.
- Connected social accounts. For each platform you connect: the platform’s user id, your handle, display name and avatar, the granted permission scopes, and the OAuth access and refresh tokens needed to post on your behalf.
- Content you create. Post text, any per-platform variants, images and video you upload, and scheduled publish times.
- Publishing results. The identifier and link of each published post, and any error the platform returned.
We do not collect advertising data, and we do not read your social feeds, follower lists, direct messages, or any content you did not create here. We do use privacy-friendly product analytics to understand which features are used and where the app fails — see Product analytics below for exactly what that involves and how to opt out.
Why we hold it
Solely to operate the service: to authenticate you, to publish the posts you ask us to publish, to publish scheduled posts at the time you chose, and to show you what succeeded or failed. We do not sell your data, share it for advertising, or use it to train machine learning models.
How access tokens are protected
OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database, and decrypted only in server-side code at the moment a post is published. They are never sent to your browser and never appear in logs.
Uploaded media is publicly reachable
Instagram and LinkedIn publish media by fetching it from a public HTTPS URL, so images and video you upload are stored in a public storage bucket under a randomly generated, unguessable file name. Anyone who has the exact URL can open the file. The URLs are not listed or indexed anywhere, but you should treat anything you upload as potentially public.
Who else processes your data
- Clerk — authentication and account management.
- Supabase — database and media storage.
- Vercel — application hosting, and cookieless aggregate page-view counts (Vercel Web Analytics).
- PostHog (EU region) — product analytics, only if you consent. See Product analytics below.
- The social networks you connect — X, LinkedIn, Meta (Facebook and Instagram), Pinterest, Google (YouTube), TikTok and Bluesky — receive the posts you choose to publish to them, and are governed by their own privacy policies. We are not affiliated with, endorsed by, or sponsored by any of them.
Sharing, transfer and disclosure of your data
We share, transfer or disclose your data only in these ways, and never for any other purpose:
- To the service providers listed above (Clerk, Supabase and Vercel), who process it on our behalf, under their own terms, solely to run the service.
- To the social platform you choose to publish to — including Google (YouTube) — transmitting only the content and the metadata needed to publish that post on your behalf, at the moment you ask us to publish it.
- Where required by law, or to protect the rights, safety and security of our users or the service.
We do not sell, rent or trade your data; we do not share it with anyone for advertising; and we do not use it — including any Google user data — to train generalized artificial-intelligence or machine-learning models.
Google user data
When you connect a YouTube (Google) account, we receive Google user data (your channel’s id and name via the YouTube Data API, and an OAuth token to upload on your behalf). YesPoster’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to upload the videos you ask us to publish to your own channel and to show you the result; we do not transfer it to third parties except as needed to provide that feature, and never for advertising or to train AI/ML models.
Product analytics
To understand which features are used and where the app is failing, we use PostHog, hosted in the EU region. This is off by default: nothing loads and nothing is recorded until you accept in the consent banner, and declining keeps it off. If you accept:
- We record page views and in-app actions (buttons clicked, flows started and finished) — never the content of your posts, your media, or your connected-account data.
- If you are signed in, events are attributed to your account by its internal id only — never your email or any other detail.
- PostHog sets its own cookie / local-storage entry to recognise a returning browser. We honour your browser’s Do Not Track setting, and route analytics through our own domain rather than a third-party host.
You can change your mind at any time by clearing this site’s data in your browser, which brings the consent banner back. We never sell or share analytics data, and never use it for advertising.
How long we keep it
Until you delete it. We do not impose a retention period of our own and we do not keep backups of deleted accounts.
Deleting your data
- One platform. Disconnect it on your dashboard. Its tokens, profile details and publishing history are deleted immediately.
- Everything. Delete your account from your profile menu. That removes every connected account, every post record and every file you uploaded.
- Instagram, via Meta. Removing YesPoster from your Instagram settings deletes the connection automatically. You can also submit a data deletion request through Meta, which we process on receipt and confirm with a tracking code.
- By email. Write to support@yesposter.com and we will action it.
Deleting content here does not delete posts already published to a platform. Those live on that platform and must be deleted there.
Your rights
You can download everything we hold about you at any time from your dashboard. You may also ask us to correct it, or ask us to delete it. Write to support@yesposter.com. Depending on where you live you may also have the right to complain to a data protection authority.
Cookies
Two cookies are strictly necessary and always set: a session cookie from Clerk that keeps you signed in, and a short-lived encrypted cookie that protects the OAuth connection flow against cross-site request forgery. There are no advertising cookies. One analytics cookie is set only if you accept in the consent banner (see Product analytics); decline and none is set.
Children
YesPoster is not intended for anyone under 16, and we do not knowingly collect data from children.
Changes
If we change this policy we will update the date at the top of this page. Material changes will be notified by email before they take effect.
Contact
Webquiel, a sole proprietorship of Rahul Arun Gore, support@yesposter.com.