SchedulerPrivacy Policy

Scheduler Privacy Policy

1. Scope

Scheduler is a tool for scheduling posts to social media accounts you own or are authorised to manage. It collects nothing from visitors to this website — no analytics, no trackers, no advertising identifiers. This policy describes what the service stores on behalf of an account holder, and why.

2. What is stored

• Account credentials for this tool — a username and a scrypt hash of the password. The password itself is never stored.
• Connected platform tokens — OAuth access and refresh tokens for social accounts you connect, encrypted at rest. These are used solely to upload and schedule the content you submit.
• Scheduled post data — captions, hashtags, titles, target accounts, and scheduled times.
• Uploaded media — video files you upload, stored in S3-compatible object storage so a scheduled post can be delivered when the account holder's own computer is switched off.
• Operational logs — timestamps, request paths, and errors. Failed sign-in attempts record the attempted username. Logs do not contain passwords or tokens.

3. What is NOT collected

• No analytics, tracking pixels, advertising identifiers, or third-party trackers of any kind.
• No cookies except a single session cookie required to stay signed in.
• No data about the audiences, followers, or viewers of connected accounts.
• No personal data of any third party.

4. Platform data

When a social account is connected, the service requests only the permissions it needs to do its job. From TikTok that is: the account's own identifier and display name; its username, profile link and verified status; its own follower, following, like and video counts; a list of its own posts (metadata only — TikTok does not expose the video files); and permission to upload or publish content you have scheduled.

Everything retrieved is about the connected account itself. The service does not read your messages, your followers as individuals, the audiences or viewers of your posts, or anybody else's content.

5. Where data goes

• Railway — hosting, database, and object storage.
• The social platforms you connect — content you schedule is transmitted to them at your instruction.

Data is not sold, shared, rented, or disclosed to anyone else. There are no advertising or data-broker relationships.

6. Retention and deletion

Scheduled posts and uploaded media are retained until deleted by the account holder. Disconnecting a platform account deletes its stored tokens immediately. To request deletion of all data held about a connected account, contact the address below; tokens and associated posts will be removed.

7. Security

• All traffic is served over HTTPS with HSTS.
• Platform tokens are encrypted at rest.
• Passwords are hashed with scrypt and never stored in plaintext.
• Sessions use signed, HttpOnly cookies and are revoked when a password changes.
• Sign-in is rate-limited to resist brute-force attempts.

No system is perfectly secure, and no guarantee of absolute security is made.

8. Children

This service is not directed at children. Accounts are issued to adults who manage social media accounts of their own.

9. Changes

This policy is updated when the service changes. The date at the top reflects the current version.

10. Contact

Privacy questions or deletion requests: clopez@obsdeckmedia.com