Privacy Policy

Introduction

Welcome to TimeToPost. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our social media scheduling service.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Name and email address when you create an account
• Profile information and preferences
• Payment information (processed securely through third-party payment processors)
• Social media account credentials (stored securely and encrypted)
• Content you create or upload (posts, images, videos)

Automatically Collected Information

When you use TimeToPost, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies
• Log data and error reports

How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining our service
• Processing your transactions and managing subscriptions
• Scheduling and publishing your social media posts
• Sending you updates, notifications, and marketing communications
• Improving and optimizing our service
• Detecting and preventing fraud or abuse
• Complying with legal obligations
• Analyzing usage patterns and service performance

Product analytics

We record events about what you do in TimeToPost: account and billing events (for example signing up, starting or cancelling a trial), which features you use, which platforms you connect, and counts of posts scheduled, published or failed. We store them in our own database, linked to your account. We never record the text or media of your posts. We use them to run and fix the service, to see where people get stuck during setup, and to understand why people cancel. We do not share them with any third party or use them for advertising.

Legal bases: events needed to provide the service and to bill you are processed because they are necessary to perform our contract with you (GDPR Art. 6(1)(b)). Product analytics is processed on the basis of our legitimate interest in improving the service (Art. 6(1)(f)). You can object at any time, as described under Your Rights and Choices.

Data Sharing and Disclosure

We may share your information in the following circumstances:

Social Media Platforms

When you connect an account, we send the content you have written and approved to that platform in order to publish it, and only at the time you chose. We never post on your behalf without an explicit action from you. Below is exactly what we receive and store for each platform we support.

TikTok

If you connect a TikTok account through TikTok Login Kit, we receive and store your TikTok open ID, union ID, display name and avatar image URL, together with the access and refresh tokens TikTok issues. We use the display name and avatar only to show you which TikTok account a post will be published to, and the open ID to identify the connection. We request the scopes user.info.basic and video.publish. We do not request any Display API scope, so we cannot read your videos, your followers, or your statistics. When you publish, we send your video file, your caption, and the audience, comment, duet, stitch and commercial content settings you selected, to the TikTok Content Posting API. We keep TikTok tokens only while the account is connected: disconnecting it revokes the token with TikTok and deletes it from our systems. Your use of TikTok through TimeToPost is also governed by the TikTok Privacy Policy.

Meta: Facebook, Instagram and Threads

If you connect a Facebook Page, we receive and store your Page ID, Page name and a Page access token, obtained with the permissions pages_show_list, pages_read_engagement and pages_manage_posts. If you connect an Instagram professional account, we receive and store your Instagram user ID, username and an access token, obtained with instagram_business_basic, instagram_business_content_publish and instagram_business_manage_insights (to show you post statistics). Comment management is optional and is not active by default. The permission instagram_business_manage_comments is requested only if comment management has been enabled on our service and you choose to turn on a comment feature (DM Funnels); it is not requested when you connect Instagram for scheduling and publishing, and we do not read or act on comments unless you turn that feature on. If you connect Threads, we receive and store your Threads user ID, username and an access token, obtained with threads_basic and threads_content_publish. We use these to list the Pages or accounts you manage, to publish the posts you schedule, and to show you which account a post is going to. We do not use Meta data for advertising, and we do not sell it. Disconnecting an account deletes the stored tokens. Your use of these platforms is also governed by the Meta Privacy Policy.

X, formerly Twitter

If you connect an X account, we receive and store your X user ID, handle, display name, profile image URL and the access and refresh tokens X issues, and we use them to publish the posts you schedule and to show you which account a post is going to.

YouTube

If you connect a YouTube channel, we receive and store your channel ID, channel title, avatar image URL, and the access and refresh tokens Google issues for your OAuth connection. We also retrieve video metadata and statistics that YouTube makes available through the connected account, and we use your selected upload settings, including video privacy, when publishing the videos you schedule or post immediately. Your OAuth tokens are encrypted when stored. You can revoke TimeToPost's access to your Google account at any time at Google Account permissions. Your use of YouTube through TimeToPost is also governed by the Google Privacy Policy and the YouTube Terms of Service.

Google Search Console

If you connect Google Search Console from the AutoSEO dashboard, we request one read-only scope, webmasters.readonly. We access Search Console performance data only: clicks, impressions, click-through rate and average position for pages of the property you choose. We use it to show you how your AutoSEO articles perform in Google search, and to set how often AutoSEO publishes for that site.

We store your Google refresh token, encrypted. We store per-page figures only for the articles TimeToPost published for you, and we keep them for as long as the connection exists. We discard the figures for every other page of your site as soon as they are received. Search queries for an article are fetched from Google when you open it, shown to you, and not stored.

We do not use this data for advertising, we do not sell it or transfer it to data brokers, and we do not use it to train general artificial intelligence or machine-learning models. Our staff do not read it, except with your consent for support, or where needed for security or legal reasons.

Disconnect in the AutoSEO dashboard to revoke the token with Google and delete the token and the synced figures from our systems. You can also revoke TimeToPost's access at any time at Google Account permissions.

TimeToPost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting platform data

You can disconnect any social account at any time from Settings, Accounts & collections, which revokes the token with the platform where the platform supports revocation, and deletes it from our systems. You can delete your whole TimeToPost account, and every connected account and post with it, from the Profile screen in our mobile app or by contacting us. Full instructions are on our data deletion page.

Service Providers

We work with third-party service providers who perform services on our behalf, such as:

• Payment processors
• Cloud hosting providers
• Error monitoring: Sentry (United States). We do not use session recording.
• Customer support tools

Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights, property, or safety.

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Secure storage of social media credentials
• Regular security audits and updates
• Access controls and authentication
• Employee training on data protection

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Your Rights and Choices

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your content and data
• Opt-out: Unsubscribe from marketing communications
• Withdraw consent: Revoke permissions for data processing
• Object: You can object at any time to product analytics based on our legitimate interest, from the Privacy section of your Profile page ("Include me in product analytics") or by emailing hello@timetopost.co. We will stop recording events linked to you and delete what we recorded.

To exercise these rights, contact us at hello@timetopost.co

You can also lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD, aepd.es), or with your local authority.

Cookies and Tracking

We do not use advertising or analytics cookies. The cookies we set are first-party and are used only to run the service: your sign-in session; a short-lived record of an affiliate link, a plan you were looking at, or an experiment arm so they carry through sign-up and checkout (ttp_via, ttp_intent, ttp_mirror_v); and, for our own team's browsers only, a cookie named ttp_int that keeps staff visits out of our statistics. You can control cookies through your browser settings, but disabling them will stop sign-in from working.

We measure visits to our website with Umami, a self-hosted analytics tool that runs on our own servers. It sets no cookies, does not follow you across other sites, records aggregate page and event counts only, and is never linked to your account. We do not share this data with anyone. Product analytics inside the app is separate and is described under Product analytics above.

Turn off website analytics in this browser

Data Retention

We keep personal data only as long as needed to provide the service and meet legal obligations. In practice:

• Account data (profile, workspace settings, posts and their metadata): kept while your account exists. Deleting your account removes it, and we complete deletion within 30 days of your request.
• Connected-account tokens (Instagram, Facebook, Threads, TikTok, YouTube, Google Search Console and others): kept only while the account is connected. Disconnecting an account revokes the token with the platform where the platform supports revocation and deletes it from our systems. Deleting your TimeToPost account revokes and deletes all of them.
• Posts and media: posts stay in your account until you delete them or delete the account. Media you upload to the media library is deleted automatically 30 days after the first post that uses it is published; the platform keeps its own copy of what you published. Media generated in the app that is never used in a published post is deleted 30 days after it was created. Media attached to a draft or scheduled post is not deleted before it publishes.
• Product analytics events and website analytics data: kept for up to 13 months, then deleted. Deleting your account deletes the events linked to you.
• Logs: our servers keep operational logs (for example errors and request records) for security and debugging. We do not use them for advertising. We do not set a fixed retention period for them in our application.
• Records we must keep by law: for example billing records for tax purposes, kept for the period the law requires.

To delete your data, delete your account in the mobile app or email hello@timetopost.co; see our data deletion page. We delete your data within 30 days of a verified request and confirm by email. Platform-side data (for example posts already published to Instagram) stays on that platform and is governed by its own policies; you can remove it there.

Children's Privacy

Our service is not intended for children under 14 years of age. We do not knowingly collect personal information from children under 14. If you become aware that a child has provided us with personal data, please contact us.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable laws.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have questions or concerns about this privacy policy or our data practices, please contact us:

• Data controller: OWEN MEL MAYSSON, trading as TimeToPost. Postal address and business details are in our legal notice.
• Email: hello@timetopost.co
• Support: hello@timetopost.co