Privacy Policy

This policy explains what data BetterPost (“we”, “us”) handles when you use our website, dashboard, REST API and MCP server. Questions: hello@betterpost.dev.

Sandbox service

BetterPost currently runs in sandbox mode. Posts you create through the API or MCP server are simulated: they are stored by us and shown on preview pages, and they are never sent to X, LinkedIn, Instagram or Facebook. Accounts you “connect” are simulated too, and no credentials of any real social network are collected.

Data we collect

• Account data: your email address and, if you sign in with Google or GitHub, your name and avatar from that provider. Google and GitHub are the sign-in providers we support. We do not receive your Google or GitHub password.
• Sign-in provider tokens: to complete a Google or GitHub sign-in, our authentication library holds the access and refresh tokens the provider returns. They are stored encrypted, and we do not use them to read or post to your Google or GitHub account.
• Session data: when you sign in we store your session together with the IP address and user agent (browser and device) of the sign-in.
• Content you send us: post text, media URLs and uploaded media, profile and account names, scheduling data and webhook configuration.
• API keys: stored only as a one-way hash. We cannot show a key again after it is created.
• Webhook secrets: stored encrypted.
• Request logs: for each API request, its method, path, status, timing and a redacted copy of the request and response. API keys, webhook secrets and password fields are redacted. Logs are kept for 7 days and then deleted.
• Usage and billing data: credit balance, charges and refunds.

OAuth tokens (future live mode)

When live publishing is available, connecting a real social account will store the access and refresh tokens the network issues to us. These tokens will be encrypted at rest, used only to publish and manage the posts you ask us to, and deleted when you disconnect the account.

How we use data

To operate the service, authenticate you, enforce credits and rate limits, send sign-in codes and notifications, keep the service secure and fix problems. We do not sell your data and we do not use your post content for advertising.

Service providers (subprocessors)

• Vercel: hosting and serverless compute.
• Neon: database (account, post and configuration data).
• Upstash: Redis, used for rate limiting and the scheduling index.
• Resend: sending email such as sign-in codes.
• Cloudflare R2: storage for uploaded media.

These providers process data only to provide their service to us.

Retention and deletion

Request logs are deleted after 7 days. Other data is kept while your account is active. To delete your account and its data, or to ask for a copy of it, email hello@betterpost.dev from the address on the account. We will act on verified requests within a reasonable time. Backups may retain data for a short additional period.

Cookies

We use a session cookie to keep you signed in. We do not use advertising cookies.

Your rights

Depending on where you live, you may have rights to access, correct, delete or export your data, or to object to certain processing. Email us to exercise them.

Children

The service is not intended for anyone under 16.

Changes

We may update this policy and will change the date above when we do.