Privacy Policy

What we collect

• Your account. Your name, your email address, a password (stored only as a one-way hash, never in a readable form), your time zone (taken from your browser, so posts are shown and scheduled in your local time) and whether you have verified your email.
• Your connected accounts. For every Facebook Page and Instagram professional account you add: its ID, name, profile picture link, connection status and an access token that lets us publish to it. Tokens are encrypted in our database. We also keep your Facebook user ID as it is known to our app only (a number that means nothing outside it), so we can find and erase your data if Meta sends us a deletion request. We do not store your personal Facebook access token: it is used once to list your Pages and then discarded.
• Your videos and posts. The converted video you upload and a thumbnail of its first frame, plus details about the file (size, length, dimensions, codec and original file name). The captions, accounts and schedule you choose, whether you marked the footage as AI-generated, and the result of each post: its status, a link to the live post and any error message Meta returned. We also count posts per account per day so we can stay inside Meta's daily limits.
• Technical data. Like most websites, our servers and Cloudflare log basic request details (IP address, browser and device type, pages requested and time). We use them to run and secure the site.
• Emails we send you. Service emails only: verifying your address, resetting your password, and telling you when a connected account needs to be reconnected.

How we use it

• To run the service: sign you in, connect your accounts, store your videos, publish them when you choose and show you what happened.
• To send the service emails described above.
• To keep the service working and safe: find and fix failed posts, prevent abuse and meet legal obligations.

We do not sell your data, we do not show ads, and we do not use your data to build advertising profiles.

Facebook and Instagram (Meta)

When you click Connect Facebook, Meta shows you what you are sharing and lets you choose which Pages to add. We ask for these permissions and use each one only for the purpose given:

• pages_show_list lets us see which Pages you manage, so you can choose where to post.
• pages_read_engagement lets us read basic details of those Pages, such as the name and picture.
• pages_manage_posts lets us publish the videos you submit to your Page.
• instagram_basic lets us see the Instagram professional account linked to your Page (its ID, username and picture).
• instagram_content_publish lets us publish your Reels to that Instagram account.
• business_management lets us find Pages and Instagram accounts that are managed through a Meta Business account.

We use what we receive from Meta only to list the accounts you can post to, publish what you ask us to publish and check the result. We never use it for advertising or profiling, never sell it, and never share it with data brokers.

You can withdraw our access at any time: disconnect an account in PublishClip, or remove the app in your Facebook settings (see Data deletion). PublishClip is not affiliated with Meta, and Meta's own privacy policy covers the data Meta holds.

Who else handles your data

• Meta (Facebook and Instagram) receives the videos and captions you choose to publish, and the tokens we use to call its APIs.
• Cloudflare delivers and protects the site, and stores uploaded videos and thumbnails in private storage.
• Our hosting provider runs the servers and the database.
• An email delivery service sends the service emails.
• Telegram carries operator alerts (next section).
• Bunny Fonts serves the typeface used on our pages. Your browser asks it for the font file, so it sees your IP address.

We do not share your data with anyone else, except where the law requires it or to protect our users and the service.

Alerts to the operator (Telegram)

When a post fails or an account needs to be reconnected, the system sends a short message to a private Telegram chat that only the operator of PublishClip reads. The message contains the email address of the affected user, the name and platform of the connected account, and the error text Meta returned. It does not include your video or your captions. Telegram handles the message under its own privacy policy.

Cookies

We use only the cookies the site needs to work: a session cookie that keeps you signed in, a security cookie that protects forms against forgery, and, if you tick “remember me” when you log in, a cookie that keeps you signed in for longer. We do not use advertising or analytics cookies. Cloudflare may set its own security cookies to tell people from bots.

Where your videos are kept

Your videos are kept in a private storage bucket, so nobody can open one with a plain link. We create short-lived signed links instead: one lets your browser upload the file, one lets you preview it, and one lets Meta fetch it when it is time to publish. Once a post is live it is on Facebook or Instagram, under their terms and your privacy settings there, not ours.

Keeping and deleting your data

We keep your data so your scheduled and past posts keep working, and we delete it when you ask. There are three ways, and none of them needs you to contact us:

• Disconnect an account (Accounts, then Disconnect). We delete its stored token and that account's post history straight away.
• Delete your account (Profile, then Delete account). We delete your profile, your connected accounts and their tokens, your post history, and your uploaded videos and thumbnails.
• Remove the app in your Facebook settings. Meta tells us, and we delete every connected account and token linked to your Facebook user and forget your Facebook user ID. You get a confirmation code and a status page.

The Data deletion page walks through each option. Deleted data can remain in our nightly database backups for about two weeks, until they rotate out, and in server logs for a short time.

Security

The site is served over HTTPS. Passwords are hashed, access tokens are encrypted in the database, videos sit in private storage behind short-lived signed links, and access to our systems is limited to the operator. No service can promise perfect security. If a breach affects you, we will tell you as the law requires.

Your rights and choices

You can change your name and email address in Profile and delete your data as described above. Depending on where you live (for example the EU, the UK or California) you may also have the right to ask for a copy of your data, to have it corrected or erased, to object to or restrict how we use it, and to complain to your data protection authority. Use the contact details below to exercise those rights.

Children

PublishClip is not meant for children under 13, or under the minimum age Facebook or Instagram sets in your country. We do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the service grows, for example when we add YouTube Shorts, TikTok or paid features. We will change the date at the top and, for significant changes, tell signed-in users.

Contact

PublishClip does not publish a postal address or a public inbox. To ask about this policy or your data, reply to any service email we have sent you, or write to the site's owner through the contact details on our Facebook app listing. You never need to contact anyone to delete your data: use the options on the Data deletion page.