Summary
- We collect what we need to schedule and publish your videos: your account details, the content you schedule and access to the channels you connect.
- We publish only what you schedule, to the channels you choose, at the time you choose.
- We do not sell your data, show you ads or use your content to train AI models.
- Channel access keys are stored encrypted. You can disconnect a channel or delete your account at any time.
Who we are
SocialCobalt is a scheduling service for video creators, available at socialcobalt.com and app.socialcobalt.com. SocialCobalt is the controller of the personal data described in this policy, as defined by Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD) and similar laws.
For any privacy question or request, including to reach our data protection contact (encarregado), write to [email protected]. We answer in English or Portuguese.
What we collect
Account details
Your name, email address, password (stored only as a one-way hash), time zone, profile picture if you add one, and your notification preferences. If you sign up with another provider, we receive your name, email and an account identifier from that provider.
Content you create
Posts, captions, titles, descriptions, tags, the videos and images you upload, scheduling times, comments left on preview links, saved sets and signatures, channel groups and webhooks you configure.
Connected channels
When you connect a channel, the network gives us access keys (tokens) and basic details about the account: its identifier, name, username and profile picture. The sections below describe what we access on each network.
Technical data
The IP address and browser type used to sign up and sign in, the time you were last active, and error records when a post fails. We use these to keep your account secure, prevent abuse and fix problems.
Billing
Payments are processed by Stripe. We receive your Stripe customer identifier, plan, billing status and invoices. We never see or store your full card number.
Messages
What you send us by email when you ask for help.
YouTube and Google data
SocialCobalt uses YouTube API Services. When you connect a YouTube channel, you sign in with Google and approve the access SocialCobalt asks for. With that access, SocialCobalt can:
- read your Google account's name, email address and profile picture, to identify the connected account;
- read your channel's details and your list of channels;
- upload videos and set their title, description, tags, privacy status and thumbnail, when you schedule them;
- read statistics about your own videos and channel, to show them in SocialCobalt.
By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
SocialCobalt's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you see in SocialCobalt. We do not use it for advertising, do not sell it, and do not let people read it unless you ask us to (for example, for support), it is needed for security, or the law requires it.
You can remove SocialCobalt's access at any time on the Google security settings page, or by disconnecting the channel in SocialCobalt.
TikTok data
When you connect a TikTok account, you approve access through TikTok's login. With that access, SocialCobalt can read your basic profile (display name, username, avatar) and public account statistics, read the list of your videos, and upload and publish videos to your account when you schedule them.
TikTok's own handling of your data is described in the TikTok Privacy Policy. You can remove SocialCobalt's access in the TikTok app under Settings and privacy, Security, Apps and services, or by disconnecting the channel in SocialCobalt.
Instagram data
When you connect an Instagram professional account, you approve access through Instagram's login. With that access, SocialCobalt can read your basic profile, publish photos, videos and Reels you schedule, read and reply to comments on your posts, and read insights about your posts and account.
Meta's handling of your data is described in the Instagram Privacy Policy. You can remove SocialCobalt's access in Instagram under Settings, Website permissions, Apps and websites, or by disconnecting the channel in SocialCobalt. To ask us to delete the data we received from Instagram, follow the steps on the data deletion page.
How we use your data
- To run your account and sign you in.
- To publish your content to the channels you choose, at the times you choose.
- To show your calendar, previews, comments and channel statistics.
- To notify you when a post goes out or fails, by email or in the app, according to your preferences.
- To charge for your plan and keep billing records.
- To keep the service secure, prevent abuse and fix errors.
- To answer your messages.
- To meet legal obligations.
We do not sell personal data, show advertising, build advertising profiles or use your content or channel data to train artificial intelligence models.
Legal bases
Under the LGPD (article 7) and similar laws, we rely on:
- performance of a contract, to provide the service you signed up for;
- legitimate interest, to keep the service secure and prevent abuse, always weighed against your rights;
- legal obligation, for billing and tax records and lawful requests;
- consent, when you connect a channel or choose optional emails. You can withdraw consent at any time.
International transfers
Our providers may store and process data outside Brazil, for example in the United States or the European Union. When they do, we rely on the safeguards allowed by the LGPD, such as standard contractual clauses, and choose providers that protect data at a level consistent with this policy.
How long we keep it
We keep your data while your account is open. When you delete your account:
- your subscription is cancelled and your connected channels are disconnected, with their access keys destroyed;
- your password, IP address, browser data, profile picture and bio are deleted;
- your posts, media and comments are removed from the app right away and permanently erased within 30 days;
- your email address, name and channel identifiers are replaced with one-way codes. We keep these codes only to prevent abuse, such as the same channel being used to open many trial accounts, and they do not reveal the original values.
Billing and tax records are kept for as long as tax law requires. Backups are overwritten within 30 days.
Security
We use encrypted connections (HTTPS) everywhere. Channel access keys and the data in our job queue are encrypted at rest with AES-256-GCM. API keys are stored as hashes, so the value in our database cannot be used to sign in. Passwords are stored as one-way hashes. Access to production systems is limited to the people who run the service.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as the law requires.
Your rights
You can ask us to:
- confirm whether we process your data and give you a copy of it;
- correct data that is incomplete or wrong;
- anonymize, block or delete data that is unnecessary or processed unlawfully;
- send your data to another service (portability);
- delete data processed on the basis of your consent;
- tell you who we share your data with;
- review a decision made only by automated means.
Most of this you can do yourself in Settings. For anything else, write to [email protected]. We answer within 15 days. If you are in Brazil, you can also complain to the national data protection authority (ANPD).
Children
SocialCobalt is for people 18 or older. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.
Changes
If we change this policy in a way that matters, we will email you and update the date at the top before the change takes effect.
Contact
SocialCobalt, [email protected].