Privacy Policy

SocialRoster is a commercial scheduling product available to creators, businesses, and agencies. It helps you organize videos and schedule posts to social accounts you choose to connect. This policy explains the information used by that service. You do not need your own developer credentials to use SocialRoster; the service operates its own platform integrations.

Information stored in your browser

The application stores imported media, drafts, scheduling preferences, and a local copy of your queue in your browser. It also stores a session used to identify your workspace to the backend. Clearing browser data can remove your local media and access to an anonymous workspace. Keep your original video files separately.

Information stored by the service

When you sign up, we collect your email address and a required contact phone number. Your phone number is stored with your account as contact information. Providing it does not enroll you in marketing texts or verify ownership of the number.

When you sync a scheduled post, SocialRoster sends its caption, hashtags, selected destinations, time, disclosure choices, and attached video to its backend. This can happen before you connect a social account. The backend also stores publishing attempts, provider responses, errors, and subscription status.

When you connect TikTok, Instagram, Facebook, or YouTube, the service receives the account identifiers, profile information, permissions, and authorization tokens needed by the selected integration. Tokens are stored on the backend and are not included in the account-status response sent to the browser. SocialRoster uses connected-account information to identify the destination account and perform publishing actions you request.

TikTok information

When you connect TikTok, the service stores the TikTok account identifier returned by TikTok, the display name and handle shown on your account card, the authorization tokens and their expiry, the granted permission scopes, and an avatar URL when TikTok returns one.

Before you review a TikTok post, the service requests your current TikTok creator information: nickname, the visibility options TikTok allows for your account, the maximum video length, and whether comments, Duet, or Stitch are turned off. This information is shown to you while you review the post and is not stored as a saved record.

For each TikTok post you approve, the service stores the choices you made: the visibility level, the comment, Duet, and Stitch settings, the commercial-content disclosure selections, the video length read from your file, the connected TikTok account identifier, and the time you gave consent. After a post is sent, the service stores the publish reference TikTok returns, the processing state, and, when TikTok reports a failure, the failure reason and diagnostic fields TikTok provides. SocialRoster does not add a watermark, overlay, or any other modification to your video file.

Nothing is sent to TikTok until you review the post and give explicit consent for that upload. Changing the account, video, visibility, or disclosure choices clears that consent and requires a new approval. Only content you own or have permission to publish should be scheduled.

Support requests

When you use the Support form, we store your reply email, request category, message, reference number, and processing status in a private support inbox. We also store a keyed hash of connection information and the submission hour to limit repeated requests. There is no automatic confirmation email. The operator reviews requests through the service's backend. Request records remain until removed by the operator.

Service providers and social platforms

Lovable provides application hosting and Supabase provides backend, authentication, database, and media storage services. Stripe handles checkout and subscription management. Checkout and billing information you provide to Stripe is processed under Stripe's policies. Social platforms receive the content and metadata you authorize for upload and apply their own policies and retention rules. Hosting and infrastructure services may process connection and usage logs to operate and secure the service.

Google user data

When you connect YouTube, Google user data received by SocialRoster (account identifiers, profile information, permissions, and authorization tokens) is shared with the infrastructure that runs the product — Lovable for application hosting, and Supabase for backend, authentication, database, and media storage — and with YouTube, the social platform you connect. It is used to identify the destination account and to publish on your behalf. Google user data is not sold.

Authorization tokens are stored on the backend and are not included in the account-status response sent to the browser. Client secrets and access tokens are not placed in browser code. Access to this Google user data is limited to operating the product for the connected account. Disconnecting YouTube removes the stored connection record, including its tokens, from the service.

SocialRoster protects Google user data with security procedures that include encryption in transit (HTTPS/TLS) between the browser, backend, and Google/YouTube APIs, and encryption at rest for stored authorization tokens and connected-account records on the backend. Client secrets and access tokens are not placed in browser code. Access is limited to operating YouTube publishing for the connected account. Tokens and the connection record are deleted when YouTube is disconnected.

AI assistant connectors

You can choose to connect SocialRoster to an AI assistant that supports connectors, such as ChatGPT, Grok, or Muse. Nothing is shared with an assistant until you sign in on socialroster.dev and approve the connection on our consent screen. You can grant view-only access or also allow the assistant to manage posts for you.

With view access, the connector can read your connected social account names and connection status, your posts (titles, captions, hashtags, selected platforms, schedule, status, and publish results), and your plan and monthly post usage. With manage access, it can also create and edit drafts, attach videos you provide, schedule, reschedule, unschedule, delete, or publish posts. The assistant is instructed to ask you before deleting or publishing, and TikTok posts must still be reviewed and published inside SocialRoster.

The connector never gives an assistant your password, payment details, or the access tokens SocialRoster holds for TikTok, Instagram, Facebook, YouTube, or Google. Connector access tokens are encrypted, expire after about one hour, and their refresh tokens are rotated on every use. The connector does not keep its own copy of your content; it reads and writes the same workspace data described in this policy.

SocialRoster does not use your content or connector activity to train AI models, and does not sell it or use it for advertising. What the assistant provider does with the conversation and with information returned to it is governed by that provider's own terms and privacy policy.

For product analytics, we record which AI assistant a connection came from (for example ChatGPT, Grok, or Muse) and a few connector usage events: connecting the connector, your first post scheduled through it, starting a trial, and becoming a paid subscriber. These records contain no post content and are not shared with the assistant provider or anyone else.

To disconnect, remove or disconnect SocialRoster in the assistant's connector or app settings; the assistant then loses access. You can also ask us through the Support page to end every connector session on your account, and you can ask us to delete your account and data at any time.

Your controls

Use Accounts to disconnect a social integration. You can also revoke access in that platform's own account settings. Disconnecting removes the stored connection record, including its tokens, from the service. Disconnecting does not remove content already published on a social platform. Use that platform to delete published content.

Delete a synced post from the scheduler to remove it from the remote queue, together with its stored TikTok choices and provider results. The application attempts to remove its associated stored video and reports cleanup errors if that operation fails. Local Content Library deletion removes local media. Clearing the browser workspace is a separate action and does not, by itself, delete the remote queue or published posts.

For access, correction, or deletion requests that cannot be completed using these controls, use the Support page at socialroster.dev/support. Include enough information to identify your workspace and the request, but do not send passwords, access tokens, or payment-card details. We may need to verify your authority over the workspace before carrying out a request.

Retention and changes

Local information remains in your browser until it is removed by you, the browser, or the application controls. Backend records remain until removed through the applicable service controls or an approved request; backup and infrastructure retention may differ. Social platforms and payment providers control their own copies of information. This policy will be updated when the service's data practices change, with the effective date shown on the published page.