Privacy Policy

This service lets you connect social media accounts you already control and publish posts to them. It is used by the organisation that signed up for it. We are the data controller for your account details and the content you create here; Meta and TikTok are separate controllers for what happens on their own platforms once a post is published.

The controller under the EU General Data Protection Regulation (GDPR) is Fahmi Ben Khalifa, Spandauer Damm 153, 14050 Berlin, Germany, reachable at [email protected].

Each use of your data rests on one of these legal bases under the GDPR:

• Providing the service you signed up for: your account, the accounts you connect, your posts and their publishing, and payment (Article 6(1)(b), performance of a contract).
• Keeping the service secure and accountable: operational records, audit logs and fraud prevention (Article 6(1)(f), our legitimate interest in running a secure and reliable service).
• Meeting legal obligations, such as keeping billing records for as long as German tax law requires (Article 6(1)(c)).

When you register we store your name, email address and organisation name.

Passwords are never stored. We keep only an argon2id hash, which cannot be reversed to recover the original password.

When you connect an account, the platform gives us an access credential. What we store depends on the platform:

• Meta (Facebook Pages and Instagram): the identifier and display name of the granting Meta user, and, for each Page or Instagram professional account it unlocks, the account identifier, username, display name, avatar URL and its access token.
• TikTok: the account’s open_id, display name, username, avatar URL, the granted scopes, and both the access token and the refresh token.

All access and refresh tokens are encrypted at rest with AES-256-GCM and are never returned by our API, never sent to the browser, and never shown in the interface.

Your accounts’ posts and performance. For each connected account we also read and store its posts and how they perform, so you can see results over time and report them:

• Facebook Pages and Instagram: the account’s existing posts (caption, link, media type and date) and the reach, engagement and follower figures Meta reports for the account and for each post.
• TikTok: the account’s follower, following, like and video totals and, for its public videos, the caption, link, date and view, like, comment and share counts, read through TikTok’s API with the permission you grant when you connect.

Disconnecting an account stops this collection; deleting the account removes what was collected. We request only the permissions these features need. We do not read your private messages, who your followers are, or content from accounts you have not connected.

Before showing you the TikTok composer we read your current posting settings from TikTok — your nickname, the privacy levels available to you, whether comments, Duet and Stitch are enabled on your account, and your maximum video length.

These are not stored. They are read fresh each time and used only to render the form correctly, because TikTok requires the options you see to be current rather than remembered.

We store the posts you write — captions, links, per-platform settings such as your chosen TikTok privacy level — along with any media you upload, its scheduled time, and which accounts you chose to publish to.

Uploaded media is served from a public URL. This is a requirement of both platforms: Meta and TikTok do not accept file uploads from us, they fetch the file from our server themselves. Anyone with the exact URL can therefore retrieve the file. Do not upload anything through this service that you would not be willing to publish.

For every publishing attempt we record the account, the outcome, and, where it failed, the error code and message returned by the platform. We also keep an audit log of significant actions — connecting or removing an account, publishing, editing, deleting — with the user who performed them and when.

These exist so that a failed campaign can be diagnosed and so an organisation can see who did what. They are visible to administrators of your organisation and to the operators of this service.

Queue jobs and rate-limit counters are held temporarily in Redis. Rate-limit counters contain only timestamps and expire automatically within 24 hours.

Paid subscriptions are processed by Stripe. When you start a checkout you are handed to a page hosted by Stripe, and your card details are entered there — they never reach this service, and we neither receive nor store them.

What we store is the identifier Stripe gives your workspace’s customer and subscription records, the subscription’s status, the price it is on, the date the current period ends, and whether the most recent payment failed. That is what we need to know which plan your workspace is entitled to. We also record the identifier of each Stripe event we have applied, so a repeated delivery is not applied twice.

Stripe is an independent controller for the payment itself and holds your card and billing details under its own privacy policy. Invoices and receipts come from Stripe.

When you invite someone to your workspace you give us their email address so the invitation can be issued for it. We store that address, who invited them, when the invitation expires and whether it has been accepted.

The invitation link contains a token that we store only as a hash, which is why the link is shown once and cannot be retrieved afterwards. Revoking an invitation makes its token unusable immediately. If the person accepts, they get their own account and the information in section 3 applies to them.

This service sets no advertising or analytics cookies and does no cross-site tracking.

Your browser’s local storage holds your session tokens, so you stay signed in between visits, and small interface preferences such as whether you chose the light or dark theme. Signing out clears the tokens. Stripe’s own checkout and billing pages may set cookies necessary for payment and fraud prevention, under Stripe’s policy.

Content you choose to publish is sent to the platform you selected — Meta or TikTok — together with the settings you chose for it. That is the purpose of the service.

We do not sell your data, share it with advertisers, or use it to train machine learning models. Besides the platform you are publishing to, the only recipients are Stripe, for processing a paid subscription as described in section 8, and the infrastructure providers hosting this deployment.

Some of these recipients process data outside the European Union, notably in the United States: Meta and TikTok when you publish to them, and Stripe for payments. Where data leaves the EU, the transfer relies on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified recipients, or on the Commission’s standard contractual clauses.

Connected accounts, posts and media are kept until you delete them or close your account.

Disconnecting an account removes its stored credentials from our database immediately. For TikTok we additionally ask TikTok to revoke the token. You can also revoke our access at any time from the platform’s own settings, without asking us — in Facebook under Business Integrations, and in TikTok under Security & Login. Doing so stops us publishing on your behalf.

Content already published stays on the platform. Removing it there is done in that platform’s own app, except where the platform offers a delete API — Facebook and Instagram do; TikTok does not.

Publishing logs and audit records are retained for operational and accountability purposes and are removed when the organisation’s account is deleted.

Step-by-step instructions for revoking access and having all of your data deleted are on the data deletion page.

Platform tokens are encrypted at rest with AES-256-GCM. Passwords are hashed with argon2id. Traffic is served over HTTPS. Access to the database and to stored credentials is limited to the operators of this deployment.

No system is perfectly secure. If we become aware of a breach affecting your data we will tell you and, where required, the relevant supervisory authority.

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, and to receive it in a portable format. Where we rely on our legitimate interests, you have the right to object.

To exercise any of these, contact [email protected]. We answer within one month.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. The authority responsible for FlashPosts is the Berlin Commissioner for Data Protection and Freedom of Information.

This service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

If this policy changes materially we will update the date at the top of this page and, where the change affects how your data is used, tell account holders directly.