Privacy Policy

Service Operator

RostrumPost is operated by LOPEZ DE MIGUEL MARCO (Marco López de Miguel), a registered self-employed professional in Spain.

Information We Process

These are the categories of information RostrumPost accesses, collects, and stores:

• Account and workspace information. Your name, email address, the identifiers returned by your single sign-on provider, your workspace membership and role, workspace settings, and billing plan status.
• Prepared content. Post text, per-platform variants, titles, descriptions, hashtags, uploaded media files and their derivatives, schedules, approval decisions, and the audit log recording who prepared, approved, and published each item.
• Connected account information. For every social account you connect: the OAuth access token, refresh token, token expiry, the scopes you granted, the provider's account identifier, and the account handle, display name, and avatar reference used to show you which account is connected.
• Delivery records. The post or video identifier and URL a provider returns after a successful publication, the provider's response status, any error it reported, and audience or engagement counts the provider makes available for content you published through RostrumPost.
• Operational information. Request logs, security events, and diagnostic records needed to run, debug, and secure the service.

The provider-specific sections below state exactly which data each platform's API gives us and what we do with it.

How We Use Information

We use information to authenticate users, run preflight checks, prepare native social variants, schedule or publish approved posts, maintain audit logs, provide support, secure the service, and comply with provider platform rules. RostrumPost does not sell social provider data or use connected account data for advertising.

We do not use your content, your connected account information, or any provider API data to train machine learning models.

Who We Share Information With

Inside RostrumPost. Content, schedules, approvals, audit records, and the identity of connected accounts are visible to the members of your own workspace, according to each member's role. They are not visible to other customers or other workspaces. LOPEZ DE MIGUEL MARCO, as the sole operator of the service, can access production systems where necessary to run, support, and secure it.

Outside RostrumPost. Each external party below receives only what it needs to perform its function for us, acts on our instructions, and may not use the information for its own purposes.

In use today:

• Cloud hosting. The application and its database run on a dedicated server we rent from a hosting provider. Workspace records, provider API responses, statistics, and encrypted provider credentials are stored here.
• Media object storage. Uploaded images and videos are stored in a private Cloudflare R2 bucket. This service stores the source media you select so RostrumPost can preview it and deliver it to the social platform you approve. Provider OAuth credentials are not stored in the media bucket.
• Content delivery and DNS. The public marketing and legal pages at rostrumpost.com are served through a content delivery network, which sees ordinary web request data such as IP address and user agent. Media delivery may also involve Cloudflare through the R2 storage described above.
• The social platforms you connect. Each platform receives only the content and metadata you approved for publication to that platform, plus the OAuth token needed to deliver it.

Optional features may use transactional email delivery for login links and notifications, a payment processor for subscriptions, or an external AI model provider for drafting. These services receive only the information needed for the feature you use, such as the recipient address and message, subscription and billing details, or draft text you submit. Where a feature is off, no data is sent to that category of provider. In the current deployment, AI drafting runs from local templates on our own server and no post content is sent to any AI provider.

We may also disclose information where we are legally required to, to protect the security or rights of the service, or at your direction. We do not sell personal information, and we do not share it with data brokers or advertising networks.

Provider Connections

RostrumPost requests only the scopes needed for the connected workflow. Provider tokens are stored in a credential vault or deployment secret store, and are used only to refresh access, read the connected account identity, upload approved media, or publish content the user has prepared and authorized.

Google and YouTube API Data

RostrumPost uses YouTube API Services. The YouTube features of RostrumPost are built on the YouTube Data API. By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google's own handling of the data it receives is described in the Google Privacy Policy.

What YouTube API Data we access, collect, and store

• Channel identity, read through the youtube.readonly scope: the channel ID, channel title, and channel thumbnail of the channel you authorize.
• The video and metadata you publish, written through the youtube.upload scope: the video file you attached, and the title, description, tags, category, language, privacy status, and synthetic-media declaration you set in RostrumPost before confirming the upload.
• The result of that upload, returned by the API: the YouTube video ID, its watch URL, its upload and privacy status, and any error YouTube reported.
• Public statistics for videos you published through RostrumPost, read from the videos.list endpoint: view count, like count, comment count, and favourite count. We do not read comment text or viewer identities.
• OAuth credentials: the access token, refresh token, token expiry, and the list of scopes you granted.

RostrumPost does not read, edit, or delete videos on your channel that were not published through RostrumPost, and does not access your subscribers, your viewers, your messages, or any other channel data.

How we use, process, and share YouTube API Data

• To show you the connection. Channel identity is displayed inside RostrumPost so you can confirm the authorization belongs to the channel you intended, and so the app can refuse to publish to any other channel.
• To publish what you approved. The video and its metadata are sent to the YouTube Data API videos.insert endpoint only after a person in your workspace reviews the exact payload and confirms the upload. RostrumPost never uploads on its own initiative and never changes the visibility you chose.
• To report back. The returned video ID, URL, and statistics are stored so your workspace can see what was published and how it performed.
• Who sees it internally. YouTube API Data is visible to the members of your own workspace according to their role, and to LOPEZ DE MIGUEL MARCO as the operator, where access is necessary to run, support, or secure the service. It is never visible to other customers or workspaces.
• Who sees it externally. YouTube-derived channel identity, upload results, statistics, and OAuth credentials are held on the cloud hosting described under “Who We Share Information With”. The source media you upload is held in our private Cloudflare R2 media storage. These infrastructure providers support storage and delivery for RostrumPost. Approved media and metadata are sent to YouTube to carry out your upload. YouTube API Data is not sent to AI providers, advertising services, data brokers, or other customers.
• What we never do. We do not sell YouTube API Data, use it for advertising or ad targeting, use it to train machine learning models, combine it with data from other sources to build profiles, or transfer it to data brokers.

How to delete this data and revoke our access

You can do any of the following, at any time:

• Disconnect inside RostrumPost. Open Connections, find the YouTube channel, and choose Disconnect. RostrumPost calls Google's token revocation endpoint, then deletes the stored access token, refresh token, granted scopes, channel identity, and the YouTube video identifiers and statistics held for that channel.
• Revoke from your Google Account. Go to the Google security settings page at https://myaccount.google.com/connections?filters=3,4&hl=en, select RostrumPost, and remove its access. This immediately invalidates the tokens RostrumPost holds.
• Ask us. Email [email protected] and request deletion of your stored Google and YouTube API data. We confirm the request comes from the account holder before acting on it.

Revocation through RostrumPost takes effect immediately. A deletion request sent by email is completed as soon as possible and no later than seven days. If authorization is revoked directly in Google, RostrumPost deletes associated Authorized Data when the failed authorization is next detected, with the 30-day verification sweep as the outside limit. Deleting data from RostrumPost does not delete the video from YouTube itself — use YouTube Studio to remove content stored on YouTube.

TikTok OAuth and API Data

When a user connects TikTok, RostrumPost uses TikTok Login Kit and TikTok APIs to connect the creator account, confirm the account identity, and support the assisted TikTok publishing workflow shown in the product. The basic connection requests account identity access such as user.info.basic and may store TikTok identifiers such as the account open_id, display name, avatar metadata, granted scopes, OAuth access tokens, refresh tokens, and token expiry timestamps.

RostrumPost uses TikTok data only to show connection status, prepare TikTok-specific variants, run preflight checks, and, if TikTok approves additional Content Posting scopes for the app, upload or publish user-selected video content and metadata after explicit user review. RostrumPost does not sell TikTok data, use it for advertising, or access TikTok content outside the permissions granted by the connected user.

Users can disconnect TikTok in RostrumPost or revoke RostrumPost access from their TikTok account settings. After disconnect, RostrumPost stops using TikTok tokens for that account. Customers can request deletion of stored TikTok OAuth data, workspace content, media, and audit records by contacting [email protected], subject to security, legal, and abuse-prevention retention requirements.

Cookies and Device Storage

RostrumPost stores information on your device, and reads it back, in the three ways described below. All are first-party: no third party places, reads, or recognizes cookies or similar technology on your device through RostrumPost, and RostrumPost loads no third-party advertising, analytics, or tracking scripts.

Cookie. RostrumPost sets one cookie:

• rp_session — a strictly necessary authentication cookie set when you sign in. It holds an opaque session token, is marked HttpOnly, Secure, and SameSite=Lax, is scoped to the RostrumPost domain, and expires after 8 hours or when you sign out. It cannot be read by JavaScript and is not used to track you across other sites.

Browser local storage. The application and the public site keep a small number of preferences and operator settings in your browser's local storage. They are not used for tracking:

• rostrumpost_theme and rp-theme — your light or dark theme choice.
• rostrumpost_language — your interface language.
• rostrumpost_calendar_view and rostrumpost_job_filters — your calendar layout and filter selections.
• rostrumpost_api_key and rostrumpost_public_base_url — set only if you use the operator tools. The base URL selects the RostrumPost API you configured; the API key is sent to that API as the x-api-key request header to authenticate your requests. Neither value is sent to an advertising or analytics service.

Browser session storage. During onboarding, the application may temporarily store rp_onboarding_selection, containing the plan and billing interval you selected, so that choice survives a checkout redirect. The browser removes this value when the tab session ends, and RostrumPost clears it after onboarding consumes it.

You can clear all of this at any time through your browser's settings for site data. Clearing the session cookie signs you out; clearing local storage resets the preferences above. No provider API data, including YouTube API Data, is stored on your device by RostrumPost.

Retention and Deletion

Workspace content and logs are retained while an account is active or as needed for operational, security, legal, and audit purposes. Customers can disconnect provider accounts, revoke provider OAuth access, and request deletion by contacting us.

Google and YouTube API data is refreshed or deleted at least every 30 days. While a connection is active, RostrumPost re-reads the statistics of the videos you published through it roughly once an hour. Each successful read also confirms that your authorization still stands and that the video still exists on YouTube. A scheduled task deletes the stored YouTube API Data for any video that has gone 30 days without such a confirmation — its video identifier, watch URL, stored statistics and the channel details cached alongside them — and clears the cached channel ID, name and picture (including copies in the encrypted credential record) of any connection unconfirmed for the same period. OAuth access and refresh tokens remain only while the user's consent remains active.

Revoking access in Google invalidates RostrumPost's tokens immediately. When RostrumPost next detects that revocation it stops provider access; stored Authorized Data is then removed by the same deletion path, and the 30-day verification sweep is the outside limit if no earlier provider request detects it. A deletion request sent to us is handled as soon as possible and within seven days. Removing data from RostrumPost does not delete videos or other data held by YouTube; users must use YouTube itself to delete content stored on YouTube.

Security

RostrumPost uses scoped access, server-side session controls, credential encryption, audit logging, and deployment secret management. No Internet service can guarantee absolute security, but we design the workflow to minimize unnecessary provider access.

Contact

For privacy questions, provider review, or deletion requests, contact [email protected].