Privacy Policy

• Account: your email address, a hashed password if you set one, whether the address is confirmed, and your sign-in method (password or Google).
• Your brand: the profile you write or approve — niche, audience, tone, things never to say — and any website you asked us to read for it.
• Your sources: the text extracted from documents you upload and links you import. The original file is discarded after reading; only its text and the material found in it are kept. Pictures found inside a file are kept if you choose to use them.
• What is made for you: posts, captions, openings, generated pictures, and your conversation with the assistant.
• Your plan and usage: which plan you are on, posts and pages used this month, your credit balance, and a ledger of every model call made for you and what it cost.
• Payment: handled by Paddle. We receive your subscription status, the plan bought and a customer reference — never your card or bank details.
• Technical: your IP address, kept briefly in memory to limit sign-in attempts and abuse; server logs of requests without their contents.

• To run the service you asked for (performance of a contract): everything above is used to write from your material, keep your work, and count your plan.
• To keep the service safe and honest (legitimate interest): rate limits, sign-up caps, the spend ledger, and the refusal of throwaway email domains.
• To email you about your account (contract): confirmation links, password resets, and notices about changes to terms or prices. We send no marketing email.
• To invite you when plans open (consent): if you leave your address on the waiting list, we keep it with the date and, if the link said so, the campaign it came from, and we send you one invitation. Nothing else is sent to it; write to us to be removed sooner.
• Where the law requires it (legal obligation): tax and accounting records held by our merchant of record, and responses to lawful requests.

We do not sell personal data, show advertising, or use your material to train AI models.

The service is built on other companies' systems. Each receives only what its job needs, under a data-processing agreement, and none may use your data for its own purposes except as noted:

• Anthropic (United States) — writes the openings and the posts, and reads your sources for material.
• Google (Gemini API) (United States) — the assistant's chat, topic suggestions, picture scenes and picture checks.
• Pixazo and fal.ai (United States) — draws generated pictures from a scene description; no personal data is sent.
• Resend (United States) — sends sign-in, confirmation and reset emails.
• Oracle Cloud Infrastructure (Israel (Jerusalem region)) — hosts the service and stores its database and backups.
• Paddle (United Kingdom and United States) — sells subscriptions and credits as merchant of record and handles payment, tax and invoices.

The assistant's chat and helper tasks run on Google's Gemini API. On the tier we currently use, Google may use the content of those requests to improve its products. We send it your messages to the assistant and short excerpts of your material, not your documents whole. Writing, and reading of your documents, runs on Anthropic's API, which does not use your content to train models.

When you ask the service to import a public link, we fetch that page or feed on your behalf. When the service looks for a free photograph for a post, it searches public image collections with a description of the post, not with your data.

Your data is stored in Israel (Oracle Cloud Infrastructure, Jerusalem region). Israel is recognised by the European Commission as providing adequate data protection. The AI and email providers above process data in the United States under standard contractual clauses and their data-processing terms.

If you are in Türkiye: your data leaves the country to be stored and processed as described above. By creating an account you are told of this and agree to it; if you would rather not, please do not use the service. [Counsel to confirm the KVKK transfer basis and the wording of this consent.]

• For as long as your account exists.
• A free account with no activity for 6 months is deleted automatically, with everything in it.
• When you delete your account from Settings, its data is deleted at once. Copies can persist in encrypted backups for up to 90 days and are then gone.
• Invoices and tax records are kept by our merchant of record for as long as tax law requires.

You can see and download your work at any time (the Posts board exports every post as a ZIP). You can correct your brand profile and remove any source yourself. You can delete your account and everything in it from Settings. You can also ask us to confirm what we hold about you, to correct it, to delete it, to restrict or object to its processing, or to receive a copy in a portable form — write to [contact email] and we will answer within 30 days.

If you are in the EU or UK, you may complain to your data-protection authority. If you are in Türkiye, applications under the Personal Data Protection Law (KVKK) may be made to the address above, and complaints to the Personal Data Protection Board.

• Connections are encrypted (TLS). Passwords are stored only as salted hashes.
• Uploaded files are identified by their contents, read for text, and thrown away; the text is treated as untrusted data and never as an instruction to the assistant.
• Card and bank details never reach our servers.
• Every paid action is quoted first and recorded; nothing spends silently.

We use only the cookies the service needs to work: your sign-in session and which brand you last had open. There are no advertising, tracking or analytics cookies, and nothing from third parties runs in your browser.

The service is for people 18 and over. We do not knowingly hold data about anyone younger; tell us and we will delete it.

When this policy changes in a way that matters, we will email you before the change takes effect and update the date at the top.