Privacy Policy · YesPoster

YesPoster is operated by Webquiel, a sole proprietorship of Rahul Arun Gore (“we”). It lets you write a post once and publish it to your own connected social accounts — including X, LinkedIn, Instagram, Facebook, Pinterest, YouTube, TikTok and Bluesky. This policy explains what we hold, why and on what legal basis, who else handles it, how long we keep it, and how to use your rights. If you are in the European Economic Area or the United Kingdom, see especially Legal basis, International transfers and Your rights. If you are in the United States, see the US state privacy notice.

Who is responsible for your data

The controller of your personal data is Webquiel, a sole proprietorship of Rahul Arun Gore, established in India. Contact us about anything in this policy at support@yesposter.com. We have not appointed a data protection officer, as we are not required to; write to the same address.

Because we offer YesPoster to people in the EU and the UK without an establishment there, we appoint representatives under Article 27 of the GDPR and of the UK GDPR. You and supervisory authorities can contact them instead of us about anything to do with your data:

EU representative: being appointed. Their name and contact details will appear here. Until then, contact us directly at support@yesposter.com.
UK representative: being appointed. Their name and contact details will appear here. Until then, contact us directly at support@yesposter.com.

What we collect

Account details. Your email address, name and profile image, supplied by Clerk when you sign up.
Connected social accounts. For each platform you connect: the platform’s user id, your handle, display name and avatar, the granted permission scopes, and the OAuth access and refresh tokens needed to post on your behalf.
Content you create. Post text, any per-platform variants, images and video you upload, and scheduled publish times.
Publishing results. The identifier and link of each published post, and any error the platform returned.
Billing. Your plan, billing interval, subscription status and the customer id our payment provider, Polar, gives you. Card details go straight to Polar; we never see or store them.
Technical data. IP address, browser and device type, and request logs, which our hosting provider records whenever any website is visited, and error reports when something fails on our servers.
Your consent choices, so we do not ask again.
Only if you opt in: product analytics (see Product analytics) and advertising measurement (see Advertising measurement).

We do not read your social feeds, follower lists, direct messages, or any content you did not create here. We do not collect special categories of data (such as health, religion or political opinions), and we do not buy data about you from anyone.

Why we use it, and our legal basis

Under the GDPR and the UK GDPR we must have a legal basis for each use of your data. These are ours:

Running the service — authenticating you, publishing the posts you ask us to publish, publishing scheduled posts at the time you chose, and showing you what succeeded or failed. Basis: performance of our contract with you (Art. 6(1)(b)).
Billing — knowing which plan you are on. Basis: contract (Art. 6(1)(b)), and our legal obligations to keep business records (Art. 6(1)(c)).
Service emails — for example telling you that a scheduled post failed to publish. Basis: contract (Art. 6(1)(b)). We do not send marketing email.
Keeping the service secure and working — request logs, server error reports, preventing abuse, and cookieless, aggregate page counts. Basis: our legitimate interests in a secure, reliable service (Art. 6(1)(f)). These use as little data as possible and are not used to profile you. You can object; see Your rights.
Product analytics — Basis: your consent (Art. 6(1)(a)), given in the consent banner. Off unless you opt in.
Advertising measurement — Basis: your consent (Art. 6(1)(a)), given separately in the consent banner. Off unless you opt in.
Complying with the law and establishing, exercising or defending legal claims. Basis: legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)).

Where we rely on consent you can withdraw it at any time, as easily as you gave it, from Your privacy choices in the site footer. Withdrawing does not affect what happened before. Providing account details is necessary to use YesPoster; everything that depends on consent is optional, and the service works without it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We do not sell your data, and we do not use it to train machine learning models. We do not share the contents of your account — your posts, media, connected accounts or tokens — with anyone for advertising. The only advertising-related sharing is the opt-in measurement described in Advertising measurement.

How access tokens are protected

OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database, and decrypted only in server-side code at the moment a post is published. They are never sent to your browser and never appear in logs.

Uploaded media is publicly reachable

Instagram and LinkedIn publish media by fetching it from a public HTTPS URL, so images and video you upload are stored in a public storage bucket under a randomly generated, unguessable file name. Anyone who has the exact URL can open the file. The URLs are not listed or indexed anywhere, but you should treat anything you upload as potentially public.

Who else processes your data

These service providers process data on our behalf, under contracts that limit them to providing their service to us (data processing agreements):

Vercel (United States, with servers worldwide) — application hosting and request logs, and cookieless aggregate page-view counts (Vercel Web Analytics).
Supabase (project hosted in India; company in the United States) — database and media storage.
Clerk (United States) — sign-in and account management.
Resend (United States) — sending service emails.
PostHog (EU region, Germany) — product analytics, only if you consent, and anonymous server error reports. See Product analytics.

These receive data as independent controllers, under their own privacy policies:

Polar — our merchant of record. Polar sells you the subscription, takes payment, and handles sales tax and VAT, so it collects your payment and billing details directly.
The social networks you connect — X, LinkedIn, Meta (Facebook and Instagram), Pinterest, Google (YouTube), TikTok and Bluesky — receive the posts you choose to publish to them. We are not affiliated with, endorsed by, or sponsored by any of them.
Meta, Google and TikTok as advertising platforms — only if you opt in to advertising measurement. See Advertising measurement.

Sharing, transfer and disclosure of your data

We share, transfer or disclose your data only in these ways, and never for any other purpose:

To the service providers listed above, who process it on our behalf solely to run the service.
To Polar, to take payment for your subscription.
To the social platform you choose to publish to — including Google (YouTube) — transmitting only the content and the metadata needed to publish that post on your behalf, at the moment you ask us to publish it.
To advertising platforms, only with your consent, as described in Advertising measurement.
Where required by law, or to protect the rights, safety and security of our users or the service.
If the business is transferred to a new owner, who would be bound by this policy.

We do not sell, rent or trade your data, and we do not use it — including any Google user data — to train generalized artificial-intelligence or machine-learning models.

International transfers

We are based in India, and our providers are in the United States, India and the EU. So if you use YesPoster from the EEA, the UK or Switzerland, your data is processed outside those regions. Neither India nor (for every provider) the United States has an adequacy decision covering these transfers, so we rely on these safeguards:

Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK data, as included in each provider’s data processing agreement.
The EU–US Data Privacy Framework and its UK Extension, for US providers certified under it, in addition to the clauses above.

PostHog keeps analytics data in its EU region. To get a copy of the safeguards that apply, write to support@yesposter.com.

Google user data

When you connect a YouTube (Google) account, we receive Google user data (your channel’s id and name via the YouTube Data API, and an OAuth token to upload on your behalf). YesPoster’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to upload the videos you ask us to publish to your own channel and to show you the result; we do not transfer it to third parties except as needed to provide that feature, and never for advertising or to train AI/ML models.

Product analytics

To understand which features are used and where the app is failing, we use PostHog, hosted in the EU region. This is off by default: nothing loads and nothing is recorded until you accept in the consent banner, and declining keeps it off. If you accept:

We record page views and in-app actions (buttons clicked, flows started and finished) — never the content of your posts, your media, or your connected-account data.
We record session replays with every piece of text and every input masked, so they show where people click and get stuck but never what is written.
If you are signed in, events are attributed to your account by its internal id only — never your email or any other detail.
PostHog sets its own cookie / local-storage entry to recognise a returning browser. We honour your browser’s Do Not Track setting, and route analytics through our own domain rather than a third-party host.

You can change your mind at any time from Your privacy choices in the footer. We never sell or share analytics data, and never use it for advertising.

Separately, when something fails on our servers — a scheduled post that could not publish, a connection that could not be renewed — we send a technical error report to PostHog so we can fix it. It holds the error message a platform returned, where in our code it happened, and internal record ids. It is not attached to your analytics profile, does not depend on the consent banner, and has access tokens and other credentials stripped out before it is sent.

Advertising measurement

If we advertise YesPoster on Meta (Facebook and Instagram), Google or TikTok, we may use those platforms’ measurement tags to learn which ads bring people to the site. These tags are off by default and load only if you opt in to “Advertising measurement” in the consent banner. That choice is separate from analytics: saying yes to one does not say yes to the other. Until you opt in, no advertising script is downloaded, no advertising cookie is set, and nothing is sent to any advertising platform.

If you opt in:

What is sent: that a page was viewed, and these conversions only — signing up, starting a trial, and paying for a plan (with the amount and currency). With each, a tag in your browser sends what any embedded script receives: your IP address, browser and device details, the page address, and an identifier stored in a cookie.
From our servers: when you start a trial or make your first payment, we tell the platform whose ad you followed. We send a SHA-256 hash of your email address, the click id that platform added to the ad link (Meta fbclid, Google gclid, gbraid or wbraid, TikTok ttclid), the event name and time, the amount and currency, and an event id so it is not counted twice. We do not send your plain email, IP address, browser details, name or account id this way.
What we keep for this: if you arrive from an ad, we keep that ad’s click id and campaign tags (the utm_ parameters), with the time and page you landed on, in a first-party cookie (yp_attr, 90 days) and, once you sign up, on your account. This is stored only after you opt in, and deleted with your account.
What is never sent: your posts, media, connected accounts, access tokens, or anything you do inside the app beyond the conversions above. We do not upload customer lists to advertising platforms.
What the platforms use it for: to tell us which ads worked (we see totals, not individuals), and to decide who to show our ads to, which may include showing our ads to you.
Who they are: in the EEA and the UK, Meta Platforms Ireland Ltd., Google Ireland Ltd. and TikTok Technology Ltd. (Ireland). For the collection and transmission of this data through a tag on our site we may be joint controllers with the platform; what the platform does with it afterwards is under its own privacy policy.
Google Consent Mode: we tell Google tags that advertising and analytics storage are denied by default, everywhere and explicitly in the EEA, the UK and Switzerland, and update that only when you choose.

You can withdraw at any time from Your privacy choices in the footer. If your browser sends Global Privacy Control, we treat it as a refusal and never load these tags.

Cookies and similar technologies

Always set, because the service cannot work without them:

Clerk’s session cookies, which keep you signed in.
A short-lived encrypted cookie that protects the social-account connection flow against cross-site request forgery.
A local-storage entry (yp_consent) that remembers your consent choices.

Set only if you opt in:

Analytics: PostHog’s cookie and local-storage entry (named ph_…_posthog).
Advertising measurement: the platforms’ cookies — for example _fbp (Meta), _gcl_au (Google) and _ttp (TikTok) — if we use that platform; our own yp_attr cookie, which remembers the ad you arrived from; and yp_ad_consent, which tells our server you opted in.

Decline, and none of the optional ones is set. Vercel Web Analytics uses no cookies.

How long we keep it

Account, connected accounts, posts, media and publishing results: while your account exists, or until you delete them. They are deleted when you delete them or your account (see below).
Database backups made by our database provider roll over within 30 days, so deleted data leaves them by then.
Billing records: your plan and subscription status while your account exists. Polar keeps invoices and tax records for as long as the law requires it to.
Analytics events and server error reports: up to 12 months.
Request logs and email delivery logs: a short period set by Vercel and Resend, typically days to weeks.
Ad attribution (the ad you arrived from): 90 days in the yp_attr cookie; on your account until you delete it.
Your consent choices: in your browser until you clear it, and on your account while it exists.
Data held by advertising platforms under their own retention rules.

We may keep data longer only where the law requires us to.

Deleting your data

One platform. Disconnect it on your dashboard. Its tokens, profile details and publishing history are deleted immediately.
Everything. Delete your account from your profile menu. That removes every connected account, every post record and every file you uploaded.
Instagram, via Meta. Removing YesPoster from your Instagram settings deletes the connection automatically. You can also submit a data deletion request through Meta, which we process on receipt and confirm with a tracking code.
By email. Write to support@yesposter.com and we will action it.

Deleting content here does not delete posts already published to a platform. Those live on that platform and must be deleted there.

Your rights

Wherever you live, you can download everything we hold about you at any time from your dashboard, and delete it as described above. If the GDPR or the UK GDPR applies to you, you also have the right to:

access your data and get a copy of it;
correct data that is wrong or incomplete;
erase your data;
restrict how we use it;
portability — receive it in a machine-readable format (the dashboard export is JSON);
object to uses based on our legitimate interests;
withdraw consent at any time, from Your privacy choices in the footer.

To use any of these, write to support@yesposter.com from the email address on your account (or tell us how to confirm it is you). We will answer within one month, and tell you if we need longer for a complex request. It is free.

You have the right to complain to a supervisory authority. In the EEA, that is the data protection authority in the country where you live or work, or where you think the problem happened (the European Data Protection Board lists them at edpb.europa.eu). In the UK, it is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to fix things first, so please contact us.

US state privacy notice

This section is for residents of California and other US states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon). It adds to the rest of this policy.

What we collect, and why

In the categories these laws use, we collect: identifiers (name, email, account ids, IP address); customer records (account and connected-account details); commercial information (your plan and subscription); internet activity (request logs, and, only if you opt in, analytics and advertising measurement events); and content you create. We collect it from you, from the platforms you connect, and from your browser. We use it for the purposes in Why we use it and keep it as described in How long we keep it. We disclose it for business purposes to the service providers in Who else processes your data.

Your social-account tokens may count as sensitive personal information (account credentials). We use them only to publish what you ask us to publish, and for no purpose that would give you a right to limit their use.

Do not sell or share

We do not sell personal information for money. The advertising measurement tags described in Advertising measurement may count as “sharing” for cross-context behavioral advertising, or as “targeted advertising”, under these laws. They run only if you opt in, and you can opt out at any time:

use Your privacy choices in the site footer; or
turn on Global Privacy Control in your browser — we honour it automatically as an opt-out; or
write to support@yesposter.com.

We do not knowingly sell or share the personal information of anyone under 16. In the past 12 months we have not sold personal information.

Your rights

Depending on your state, you have the right to know what we collect and disclose, to get a copy, to correct it, to delete it, and to opt out of sale, sharing and targeted advertising. To use them, write to support@yesposter.com from the email on your account; we verify requests against your account and answer within 45 days. You may use an authorized agent, who must show your signed permission. If we decline your request, you can appeal by replying to our answer, and we will respond within the time your state law sets; if you disagree with the outcome, you can contact your state’s attorney general. We will not treat you differently for using any of these rights.

Children

YesPoster is not intended for anyone under 16, and we do not knowingly collect data from children.

Changes

If we change this policy we will update the date at the top of this page. Material changes will be notified by email before they take effect.

Contact

Webquiel, a sole proprietorship of Rahul Arun Gore, India, support@yesposter.com.