Draft — these texts have not been approved by a lawyer and are not a final compliance document. They will be reviewed against final data flows, retention periods and supplier agreements before launch.
Privacy policy
This policy explains the data CastPost processes when you use the service or connect Facebook, Instagram, Threads, TikTok or YouTube, how it is protected, and your choices.
Controller and contact
CastPost is operated by Sarikaya It-Firma, registered in Norway, organisation number 929019202. We are the controller for CastPost accounts, service security and support. Customers retain their authority and obligations for their audiences and content; roles and a data processing agreement must be established separately where we process on a customer’s behalf. Contact us at the privacy address below.
Data we process
We process your name, email, password hash, sessions and enabled passkey/two-factor authentication details; connected account identifiers, handles, avatars and available metrics; access and refresh tokens; selected media, captions, publishing and scheduling records; analysis reports and raw analysis data; support messages and security records. Engagement features also process sender identifiers and text in platform-provided comments, messages, replies and mentions. The scope depends on your permissions and the features you use.
Purposes, legal bases and authorisation
We use data to operate your account, connect accounts at your request, prepare/publish content and display selected reports, relying on performance of our service agreement. We rely on legitimate interests for security and abuse prevention, legal obligations for required disclosures, and consent where applicable to separate optional processing. Platform authorisation is granted on the platform’s OAuth screen; CastPost does not ask for your platform password. Connecting an account alone is not a publishing instruction: you choose when to publish or enable an automation.
Data protection: encryption in transit
The production CastPost website and supported social platform API connections use HTTPS/TLS. OAuth uses short-lived, user-bound state validation to protect account connections against forged requests. Your selected video and publishing information are sent to the relevant platform to perform the action you requested. Our SMTP service supports TLS; delivery security outside our service also depends on the recipient’s mail server.
Data protection: storage and credentials
Access and refresh tokens for Google/YouTube, Meta (Facebook and Instagram), Threads and TikTok are encrypted at rest on the server using AES-256-GCM. The encryption key is held in the server environment and is not sent to the browser. Sensitive session URLs for resumable YouTube uploads are also encrypted. CastPost passwords are stored as one-way scrypt hashes with individual salts. These measures do not mean that all data is end-to-end encrypted or that every database field is individually encrypted.
Data protection: access and abuse prevention
Session and ownership checks restrict access to account data; administrator actions require role checks. Session cookies are HttpOnly, Secure in production and protected by SameSite. Sensitive account operations require additional verification; supported sign-in options include two-factor authentication and passkeys. Rate limits and time-limited security/operational logs help investigate abuse. Share only necessary support information and never send passwords or tokens. No internet service can guarantee absolute security.
Facebook and Instagram data
Meta APIs read the identity/profile, posts, available engagement and performance metrics of Facebook Pages and Instagram professional accounts you authorise. Publishing, editing/deleting, comment replies, messaging and comment-to-message automations operate only when the feature is enabled and the necessary permission is granted. Message/comment records may contain sender identifiers, text, timestamps and processing status. Instagram competitor analysis uses only permitted Business Discovery fields; it does not provide unrestricted access to private accounts. Meta Privacy Policy: https://www.facebook.com/privacy/policy/ .
Threads data
We use your Threads account identifier, profile, posts and available metrics for account connection, the content library and reporting. Where authorised, we send posts and replies you initiate and read replies and mentions in the relevant screens. Features differ across platforms and are unavailable without the required permission or implementation. The Meta Privacy Policy and Threads supplementary privacy policy apply: https://www.facebook.com/privacy/policy/ and https://help.instagram.com/515230437301944 .
TikTok data and sharing choices
We use TikTok Login Kit, Display API and Content Posting API. user.info.basic, user.info.profile and user.info.stats cover profile identity, handle, avatar, biography and available profile counts; video.list covers public videos and available metrics. video.publish sends your selected video with the privacy/interaction settings you choose; video.upload transfers a draft to your TikTok inbox for you to finish and publish in TikTok. Display API does not list private videos or drafts. Review status and account restrictions may limit publishing. TikTok Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en .
YouTube and Google API Services
CastPost uses YouTube API Services. youtube.readonly is used to display channel identity/name/avatar, subscriber count, videos, titles/descriptions, privacy and processing status, available video statistics and accessible comments. youtube.upload sends your chosen video and publishing settings to YouTube, including thumbnail/scheduling where supported. These scopes do not guarantee comment moderation or Analytics access. Video bytes are transferred during upload; this flow does not retain a permanent original video copy. Google Privacy Policy: https://policies.google.com/privacy . By using YouTube features you agree to the YouTube Terms of Service: https://www.youtube.com/t/terms .
Google data: Limited Use and AI boundary
CastPost’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy . Google/YouTube API data is not used for advertising, data sales, credit decisions or training generalised AI/ML models, and is not sent to AI providers. Human access is limited to purposes such as support with your affirmative permission, necessary security investigation or legal obligations. Infrastructure providers perform necessary hosting/processing functions; data is not shared for independent marketing.
Optional AI features
AI runs only when you request content generation/improvement or AI-assisted account analysis. Your chosen prompt and relevant text/analysis evidence may be sent to the enabled provider (Anthropic Claude or Google Gemini), depending on service configuration. Images/video files and platform tokens are not sent to AI providers. Google/YouTube API data is excluded. Selected profile information, post text and metrics from other supported platforms may be processed for AI analysis. Avoid unnecessary private/sensitive details; provider retention terms apply and we do not make a blanket zero-retention guarantee.
Storage and service providers
The app and PostgreSQL database are hosted on Hetzner Online GmbH infrastructure in Helsinki, Finland. Profile images are stored in the database or Cloudflare R2 depending on configuration; when persistent media storage is enabled, uploaded media is stored in R2 and may be served through media.castpost.app. Not every upload is stored in R2; direct platform uploads follow a different flow. CastPost cannot delete legacy files uploaded by an earlier version to catbox.moe. The operator-managed Mailu service (mail.sinansarikaya.me) processes support and transactional email; support/privacy messages are forwarded to the operator’s central inbox. No payment provider or paid checkout is active yet.
International processing and recipients
Connected platforms, AI features and email forwarding may involve processing on their providers’ infrastructure; CastPost’s EEA hosting does not mean that all processing stays in the EEA. Where legally required, a transfer basis, processing agreement and appropriate safeguards must be established. Final subprocessor agreements, backup location/retention and transfer mechanisms outside the EEA remain open checks before general launch; we do not claim an unverified adequacy basis or certification.
Link tracking and device storage
Link profile visits and tracked clicks process time, source type, referring domain and device class. Click records do not store raw IP addresses, full browser details or tracking cookies; a daily keyed pseudonym distinguishes repeats. This does not imply that general server security logs never process IP addresses. Necessary/functional browser storage supports sessions, language, OAuth security and draft/interface preferences. We do not use advertising pixels or optional third-party trackers; see the Cookies page for details.
Retention schedule
Implemented periods: sessions 7 days; invitation links 7 days; administrator re-verification proofs 5 minutes; security/operational logs 90 days; webhook events 30 days. Account, content and reports remain until the relevant deletion action or account deletion; support messages remain until an administrator deletes them in an inbox capped at 1,000 records. Maximum periods for backups, link clicks and raw analysis data have not yet been approved (general launch blocker). Platform-specific deletion requests are handled separately; YouTube data deletion requests must be completed as soon as possible and within 7 calendar days.
Your rights, revocation and deletion
Account & Security provides JSON export and account deletion. Disconnect removes the token and related connection records; deleting all independent drafts, reports or publishing history requires account deletion or a request specifying that scope. On YouTube disconnection, we attempt Google revocation; local tokens are deleted even if this fails. You can also revoke Google access at https://security.google.com/settings/security/permissions . Remove authorisation in other platforms’ connected-app settings too. Send requests for access, correction, deletion, restriction, portability, objection or withdrawal of applicable consent to the address below; identity verification may be needed. You may complain to Datatilsynet: https://www.datatilsynet.no/ . Deleting CastPost does not delete content already published on a platform.
Children and policy changes
CastPost is not directed at children or designed for special-category data processing. Account users must have authority to enter the agreement and manage connected accounts. This page shows the policy version and review date. Material changes to data use are communicated in advance; processing requiring new permission or consent does not start before it is obtained. Describing an integration here does not mean its platform has approved our application.
Contact and privacy requests
Sarikaya It-Firma · Norway
Organisation number: 929019202
Grashaugveien 14B, 4034 Stavanger · Norway