Privacy Policy
Social Poster — a desktop app for cross‑platform content publishing
Last updated: August 2026
1. What Data We Collect
The Social Poster desktop application collects and stores the following data locally on your own server or computer:
| Data | Source | Purpose |
|---|---|---|
| Bot tokens (Telegram, Bale) | You enter them in the Settings page | Authenticate with each platform's API to publish on your behalf |
| LinkedIn access token, client ID, client secret, organization/member ID | OAuth 2.0 authorization flow via LinkedIn | Authenticate with LinkedIn's REST API to publish posts |
| Post text, media files (images, videos) | You compose them in the main page | Transmit to the platforms you select; media is stored temporarily in /tmp |
| Scheduled post metadata (time, platform list, status) | You create a scheduled post | Trigger publication at the chosen time via APScheduler |
2. How We Store Data
- Credentials (tokens, secrets) are encrypted with Fernet symmetric key before being written to the SQLite database. The encryption key lives in your
.envfile — we never send it anywhere. You generate this key yourself. - Post history and scheduled posts are stored unencrypted in the same local SQLite database.
- Uploaded media is kept in
/tmp/social_poster_uploadsand deleted after the post is sent.
Everything runs on your own infrastructure. No data is sent to our servers, and we have no access to your database, tokens, or posts.
3. How We Use Data
- Publish your content to Telegram, Bale, and/or LinkedIn when you click Send.
- Schedule content for future publication (APScheduler).
- Validate your credentials are correct before saving them.
- Display your post history in the application.
4. Data Sharing
We share data only with the platforms you explicitly select when composing a post. Those platforms receive:
- The text and/or media you wrote.
- Your identity token (so the platform knows who is posting).
No data is sold, rented, or shared with any third party beyond the platforms you choose. No analytics, tracking, or telemetry of any kind is built into the application.
5. Third‑Party Services
The app communicates with these external services through their public APIs:
- Telegram — api.telegram.org
- Bale — tapi.bale.ai
- LinkedIn — api.linkedin.com, api.linkedin.com/rest, linkedin.com/oauth
Each service has its own privacy policy and terms. Review them before using the app.
6. Data Retention
- Credentials: kept until you click "Disconnect" in Settings or delete the database file.
- Post history: kept indefinitely unless you delete the database.
- Scheduled posts: removed from the scheduler after execution; the record remains in history.
- Uploaded media: deleted immediately after posting.
7. Your Rights
Because you run this application on your own machine or server, you have full access to all your data at any time. You may:
- Access — open the database file or use the app's history page.
- Delete — disconnect a platform or delete the database file entirely.
- Export — copy your data from the database.
If you share the app with end users (e.g. you sell or distribute it), you are responsible for complying with applicable privacy laws (GDPR, CCPA, etc.) as the data controller.
8. Security
- Credentials are encrypted with Fernet before storage — even a direct read of the database file yields useless ciphertext without the key.
- The encryption key is configured in
.env, which should never be committed or shared. - OAuth 2.0 access tokens are stored with the same encryption.
- We recommend running the backend behind a local firewall or VPN since the API server is intended for local‑only use.
There is no 100% secure system. You assume the risk of running this software on your infrastructure.
9. Contact
For questions about this privacy policy, contact the app developer at:
Email: info@huberr.ir
Website: huberr.ir