Privacy policy
Effective from 2026-10-07
Who processes your data
This copy of Nodpost is run by the person who installed it.
The operator of Nodpost (https://nodpost.app) is the controller of your personal data under Regulation (EU) 2016/679 (GDPR).
What we keep and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail address, profile picture and the identifier of the way you sign in (Google, Facebook, Microsoft, LinkedIn or e-mail) | Signing in, one account per address | Contract |
| Access tokens for the networks you connect (LinkedIn, Facebook, Instagram, Threads, Bluesky, Mastodon) | Publishing the posts you approve. Tokens are stored encrypted. | Contract |
| Drafts, ideas, images and videos, projects, posting times, feeds | The service itself | Contract |
| Browser notification subscriptions, a Telegram link | Reminders you turn on | Contract |
| Plan, Stripe customer id, AI drafts used this month | Subscription and plan limits. Card details stay with Stripe, never with us. | Contract, legal obligations (accounting) |
| Technical logs (IP address, time, errors) | Security, abuse prevention, fixing bugs | Legitimate interest |
We use no advertising or analytics tracking and we do not sell data.
AI
When you ask for a draft or for ideas, we send the AI model provider the topic, your voice description and a few of your recent posts. The result is always only a draft; nothing is published without your approval.
Who we share data with
- Hosting and database: a server provider in the EU.
- E-mail (sign-in codes, reminders): Resend.
- Payments: Stripe.
- AI drafts: the model provider (Anthropic or a model we run ourselves).
- Notifications: your browser's push service (Google, Apple, Mozilla, Microsoft), and Telegram if you link it.
- The networks you publish to: only what you approve, and only where you send it.
- Domain and DNS: Cloudflare.
Some of them are outside the EU (mostly in the USA). Transfers rely on an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
How long
Account data is kept while the account exists. Deleting the account in Settings removes drafts, media, tokens and ways to sign in at once; backups are overwritten within 14 days. Billing records are kept as long as the law requires. Sign-in codes live 15 minutes and are removed within a day.
Cookies
Only strictly necessary cookies: the session, protection of sign-in through other services, your language and the page you were going to before signing in. These need no consent.
Your rights
You may ask for access, correction, erasure, restriction and portability, and object to processing. You can delete the account yourself in Settings and disconnect a network in Settings or in the network itself. You may complain to a data protection authority, in Slovakia the Úrad na ochranu osobných údajov SR (dataprotection.gov.sk).
Data from Google and Meta
Data we receive from Google, Facebook, Instagram or Threads accounts is used only to sign you in and to publish what you approve. It is not used for advertising or to train models and is not passed on. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If you remove our app in Facebook, we delete its data.
Security
Connections are encrypted (HTTPS), network tokens are stored encrypted, and there are no passwords at all.
Changes
We will tell you about a material change by e-mail or in the app.