Privacy Policy
Last revised: October 13, 2026
1. About MasterPost
MasterPost is a local social media management application operated by authorized users for accounts they own or have permission to manage. It supports Facebook Pages, standalone Instagram professional accounts and Threads profiles. Its YouTube video uploader is implemented locally, subject to Google authorization, account eligibility and live verification. X (Twitter) and TikTok remain connection-only. Local testing does not certify production readiness or platform approval. MasterPost is not offered as a public consumer service.
This policy applies to MasterPost, not the operator's separate shops, affiliate websites or the platforms themselves. The operator responsible for this local installation can be contacted at aringemas91@gmail.com.
2. Information processed
Depending on the features enabled, MasterPost may process:
- Meta account and Page identifiers, names, usernames and publishing-permission evidence;
- YouTube channel ID and channel title, when the YouTube connection is enabled;
- X account ID, display name and handle, when the X connection is enabled;
- access and refresh tokens, granted scopes, expiry information and authorization metadata;
- content prepared for publication, media URLs, publishing times, post identifiers and publishing status;
- public comments and related public profile identifiers when comment-management features are enabled; and
- technical logs used for security, troubleshooting, duplicate prevention and delivery verification.
The YouTube adapter uses YouTube API Services with youtube.readonly to identify the authorized channel and verify uploaded video status, and youtube.upload to upload operator-selected videos and optional thumbnails. It processes approved titles, descriptions, tags, category, audience, privacy, publication time, synthetic-media and paid-promotion choices, upload progress and returned video identifiers. It does not collect viewing history, manage subscriptions or moderate comments. Old read-only tokens are not upgraded without new consent. The X adapter requests tweet.read, users.read and offline.access, but currently reads only the authorized account's identity. It does not publish posts or collect direct messages, follower lists or timelines. Broader permission descriptions do not mean MasterPost uses every capability allowed.
MasterPost does not collect platform login passwords or payment-card details. Login and consent occur on the provider's official pages. No private-message permissions are requested. A TikTok connection-only adapter also exists, but is not enabled simply by this policy; it requires separate setup and consent.
3. How information is used
Information is used to connect the selected profile, verify the intended account, maintain its authorization, and operate the specific features authorized by the operator. Enabled Meta features can prepare and publish content, prevent duplicates and process supported public comments. The YouTube publisher uploads only explicitly configured, previewed videos for the selected channel, maintains resumable progress and prevents duplicate uploads. Connection consent alone does not enable a publication schedule. X currently has no publisher. New functions or expanded purposes require updated disclosures and any additional consent or review required by the provider.
4. Storage and service providers
Account credentials, connection records and operational logs are stored on the operator's computer, with separate profile files. Shared developer-client configuration is stored separately from account tokens. YouTube resumable-session locations are sensitive capabilities stored privately in the profile's upload-session file, not displayed or logged. Local credential and session files are plaintext; MasterPost does not claim to encrypt them at rest. They are excluded from Git. The operator must protect device access, file permissions and backups. Provider requests use HTTPS; authorized local desktop callbacks are restricted to the loopback interface. Selected video and thumbnail bytes and approved publication metadata are transmitted directly to YouTube when publication is authorized.
Cloudinary receives media selected for upload and may provide publicly accessible media URLs. Do not upload private labels, customer details or secrets. Provider APIs receive the data needed for the authorized request; Meta data is not supplied to Google or X merely because both accounts are connected. MasterPost does not send YouTube/X API data to Cloudinary for connection verification.
Accounts uses browser local storage for per-profile platform-card layout preferences. It does not store account tokens there or use advertising trackers in the local interface. Google, X and Meta may use their own cookies on their login pages. Public policy pages are available on BZLive/Bisnes Live and GitHub Pages. Those hosting services may process ordinary site access data under their own privacy terms. Published shop or affiliate links lead to separate websites governed by their own policies.
5. Sharing and sale of information
MasterPost does not sell or license provider API data, share it for unrelated advertising, create cross-platform advertising profiles from it, or use it to train general-purpose AI models. Data may be disclosed only for the authorized operation and where permitted by the provider's terms and applicable law. The operator limits access to authorized personnel and necessary service providers. Connecting multiple profiles does not permit sharing one account's protected data with another profile.
6. Retention and security
Data is kept only while needed for the disclosed, authorized purpose and within the relevant provider's retention rules. Tokens are not treated as permanently valid and may be revoked or expire. Expired authorization does not permit continued collection. Provider-specific requirements below override a longer general retention period:
- Meta: unnecessary data and data subject to a valid deletion request must be removed promptly or as soon as reasonably possible under the Meta Platform Terms. A shorter required deadline is not postponed by this policy.
- YouTube: applicable stored channel metadata must be refreshed or deleted within 30 calendar days. Following consent revocation or a deletion request, relevant API data must be deleted as soon as possible and within seven calendar days; authorization must be rechecked and data removed when it can no longer be legitimately refreshed.
- X: stored API content must reflect its current state. Applicable update/deletion requests from X or the account owner must be completed as soon as reasonably possible and within 24 hours, subject to X's stated requirements.
Deletion covers relevant local data, credentials, logs and operator-controlled backup copies. Any legally required retention must be limited, documented and permitted by the applicable provider terms; retained data is not reused for publishing. No universal 30-day grace period applies. Some controls remain operator-managed; this policy does not claim that missing revocation, freshness or deletion automation is already implemented. No storage or transmission method is completely secure.
7. Your choices and deletion requests
You may request access, correction or deletion through the Data Deletion Instructions. You do not need a public MasterPost account to make a request. The operator must stop affected jobs when access is withdrawn. Removing a platform card only changes layout; it does not revoke authorization or delete data.
For YouTube, you can revoke MasterPost's access through Google's security permissions page. For X, use Connected apps. For Meta, use the relevant Facebook, Instagram or Threads app/website permission settings. Provider-side revocation and deletion of local records are separate operations: revocation does not remove MasterPost's obligation to delete applicable stored data. An email is a way to report or request action, not an extra prerequisite after a provider-side revocation has been detected.
8. Children's privacy
MasterPost is not intended for children and does not knowingly collect personal information from children.
9. Changes to this policy
This policy may be updated when MasterPost's functionality or legal obligations change. The revision date shown above will be updated when material revisions are made.
10. Contact
For privacy questions or requests concerning MasterPost, contact aringemas91@gmail.com.
Security vulnerabilities can be reported through the same address. Do not include passwords or tokens.
11. Provider policies
MasterPost does not override a provider's rules or claim official endorsement. Relevant notices include the Meta Privacy Policy, Google Privacy Policy and X Privacy Policy. These apply alongside the providers' API terms and MasterPost's Terms of Service.