YesPoster is operated by Webquiel, a sole proprietorship of Rahul Arun Gore (“we”). It lets you write a post once and publish it to your own X, LinkedIn and Instagram accounts. This policy explains what we hold, why we hold it, and how to make us delete it.
What we collect
- Account details. Your email address, name and profile image, supplied by Clerk when you sign up.
- Connected social accounts. For each platform you connect: the platform’s user id, your handle, display name and avatar, the granted permission scopes, and the OAuth access and refresh tokens needed to post on your behalf.
- Content you create. Post text, any per-platform variants, images and video you upload, and scheduled publish times.
- Publishing results. The identifier and link of each published post, and any error the platform returned.
We do not collect analytics or advertising data, and we do not use tracking cookies. We do not read your social feeds, follower lists, direct messages, or any content you did not create here.
Why we hold it
Solely to operate the service: to authenticate you, to publish the posts you ask us to publish, to publish scheduled posts at the time you chose, and to show you what succeeded or failed. We do not sell your data, share it for advertising, or use it to train machine learning models.
How access tokens are protected
OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database, and decrypted only in server-side code at the moment a post is published. They are never sent to your browser and never appear in logs.
Uploaded media is publicly reachable
Instagram and LinkedIn publish media by fetching it from a public HTTPS URL, so images and video you upload are stored in a public storage bucket under a randomly generated, unguessable file name. Anyone who has the exact URL can open the file. The URLs are not listed or indexed anywhere, but you should treat anything you upload as potentially public.
Who else processes your data
- Clerk — authentication and account management.
- Supabase — database and media storage.
- Vercel — application hosting.
- X, LinkedIn and Meta (Instagram) — receive the posts you choose to publish to them, and are governed by their own privacy policies. We are not affiliated with, endorsed by, or sponsored by any of them.
How long we keep it
Until you delete it. We do not impose a retention period of our own and we do not keep backups of deleted accounts.
Deleting your data
- One platform. Disconnect it on your dashboard. Its tokens, profile details and publishing history are deleted immediately.
- Everything. Delete your account from your profile menu. That removes every connected account, every post record and every file you uploaded.
- Instagram, via Meta. Removing YesPoster from your Instagram settings deletes the connection automatically. You can also submit a data deletion request through Meta, which we process on receipt and confirm with a tracking code.
- By email. Write to support@yesposter.com and we will action it.
Deleting content here does not delete posts already published to a platform. Those live on that platform and must be deleted there.
Your rights
You may ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Write to support@yesposter.com. Depending on where you live you may also have the right to complain to a data protection authority.
Cookies
We set two kinds of cookie, both strictly necessary: a session cookie from Clerk that keeps you signed in, and a short-lived encrypted cookie that protects the OAuth connection flow against cross-site request forgery. There are no advertising or analytics cookies.
Children
YesPoster is not intended for anyone under 16, and we do not knowingly collect data from children.
Changes
If we change this policy we will update the date at the top of this page. Material changes will be notified by email before they take effect.
Contact
Webquiel, a sole proprietorship of Rahul Arun Gore, support@yesposter.com.