Privacy Policy
Introduction
Octopost ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website.
Information We Collect
We may collect information about you in a variety of ways. The information we may collect on the site includes:
- Personal Data: Name, email address and password (stored as a hash), plus a company name if you give one
- Social Media Data: Sign-in tokens or app passwords for the accounts you connect, encrypted in our database, and the posts and media you send through Octopost
- Referral Data: The site or link that first sent you to Octopost and the page you landed on (see Cookies below)
- Usage Data: Information about how you use our service
- Device Data: IP address, browser type, operating system
Use of Your Information
Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the site to:
- Create and manage your account
- Provide, operate, and maintain our service
- Process your transactions
- Send you promotional communications
- Improve and optimize our service
- Monitor and analyze trends and usage
- Enforce our Terms of Service
Who Else Handles Your Data
We share your data with these services so Octopost can run:
- Stripe handles checkout and billing. You enter your card details with Stripe, not with us. We keep your Stripe customer and subscription references, and each checkout carries your referral value.
- Resend delivers our email, such as address verification, password resets and post notifications. It receives your email address and the message.
- DigitalOcean hosts our server, where the database and your uploaded media are stored.
- The social networks you connect, such as X, Threads, Bluesky, LinkedIn and Mastodon, receive what you publish to them. Their own privacy policies apply to it there.
Each Kind of Data at a Glance
For each kind of data we keep: why we keep it, who else receives it, how long we keep it, and what you can do about it.
| Data | Why | Who else receives it | How long | Your controls |
|---|---|---|---|---|
| Account: name, email, password hash, optional company | Sign you in, send account and post emails | Resend (email delivery), DigitalOcean (hosting) | Until you delete your account | Edit in Settings; Delete account in Settings removes it |
| Connected social accounts: account name and ID, encrypted sign-in tokens or app passwords | Publish to the accounts you choose | Only the network the account belongs to | Until you disconnect the account or delete your Octopost account | Disconnect on the Accounts page, or revoke Octopost in the network's own settings |
| Posts and media: text, images and video you write or upload, schedules, results and links | Publish, schedule and queue them, and show you what happened | The networks you publish to (what you publish becomes public there) | Until you delete the post or your account | Delete any post in the dashboard or through an app you connected |
| Post statistics: likes, reposts, replies and views of your published posts | Show how a post did | Nobody (read from the network) | Read for 30 days after a post goes live, kept until the post is deleted | Deleting the post deletes them |
| Apps you connect: the app's name, its access grant and API keys you create | Let the apps and agents you allow act on your posts | The app you connected receives the results of what it asks for | Until you remove the app or key; expired or revoked grants are deleted after 30 days | Remove the connector in the app, or revoke keys on the API keys page |
| Billing references: Stripe customer and subscription IDs | Know whether your account is active | Stripe (card details stay with Stripe) | Until you delete your account; Stripe keeps its own records as the law requires | Manage or cancel on the billing page |
Referral cookie op_ref | Know which links bring customers | Stripe (included with a checkout) | 90 days in your browser; on your account until you delete it | Clear your cookies |
| Server logs: IP address, browser, pages requested | Security, abuse prevention and fixing errors | DigitalOcean (hosting) | 14 days; database backups are also kept 14 days | Email us to ask about your data |
We don't sell your data, we don't use it for advertising, and we don't use your posts to train AI models.
Apps and Agents You Connect
You can connect Octopost to an app or agent (for example a chat assistant or a coding tool) by signing in with Octopost or by giving it an API key. A connected app can do what the sign-in screen lists: publish, schedule and queue posts on the accounts you connected, edit and delete your Octopost posts, and see your connected accounts, posts, presets and queue settings. It never sees your password, your billing details or your social networks' logins. What you type into that app is handled under that app's own privacy policy; Octopost only receives the requests the app sends. You can remove a connected app at any time.
Children
Octopost is not directed to children under 13, and we don't knowingly collect personal data from them. If you believe a child under 13 has given us personal data, email hello@greatwork.company and we will delete it.
YouTube
Octopost uses YouTube API Services to publish to a YouTube channel you connect. By connecting one you agree to the YouTube Terms of Service and Google's data handling is covered by the Google Privacy Policy.
- What we read: your channel's name and ID, so you can see which channel is connected, and the processing status of videos you publish through Octopost.
- What we send: the videos, titles, descriptions and comments you choose to publish. Nothing posts without your action or an agent or schedule you set up.
- What we store: your channel's name and ID, your access and refresh tokens (encrypted), and the IDs and links of what you published. We don't sell this data, share it with anyone beyond the services listed above, or use it to train AI models.
- How to remove access: click Disconnect on the Accounts page, which deletes the stored tokens, or revoke Octopost in your Google security settings. To have the rest deleted, email hello@greatwork.company.
Cookies
We use cookies to keep you signed in, to protect the step where you connect a social account, and to remember an approver who signed in from an approval link.
We also set one first-party cookie called op_ref. It holds the site or link that first sent you to Octopost and the page you landed on, and it lasts 90 days. If you register, we copy that value to your account and include it in your checkout with Stripe, so we know which links bring customers.
Octopost doesn't load third-party analytics or advertising scripts.
Security of Your Information
We use administrative, technical, and physical security measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
Data Retention
We keep each kind of data for the time listed in the table above. When you delete your account, everything we store about you (account, connected accounts and their tokens, posts, uploaded media, statistics, keys and app connections) is deleted at once; copies in our backups are gone within 14 days. We keep data longer only when the law requires it.
Contact Us
If you have questions or comments about this Privacy Policy, please contact us at:
- Email: hello@greatwork.company
- Mailing address: Great Work LLC, 651 N Broad St, Suite 206, Middletown, DE 19709, USA
Last updated: November 2026