Privacy Policy

EzPost (ezpost.tech) is a social media publishing and scheduling product from Fabric AI Systems. This page explains what we collect, why, who else handles it, and how you can remove it.

What we collect

• Your account: name, email address and sign-in details (a password, or Sign in with Google).
• Connected social accounts: when you connect an account (for example YouTube, Instagram, Facebook, Threads, X, Bluesky or Mastodon), we store the access tokens the platform gives us, encrypted, plus the account name and profile picture. Where the platform shares it with your permission (for example X, Bluesky or LinkedIn), we also keep the email address the account signed in with, so you can see which login each account belongs to.
• Your content: posts, captions, schedules, and the images and videos you upload.
• Results: publish status and, where you turn them on, post statistics the platform shares with us.
• Billing: handled by Stripe. We never see or store full card numbers.
• Technical data: basic logs (time, page, error) needed to run and secure the service.

Grow X

Grow X keeps the X posts you paste (their link and text), your reply drafts and the profiles you add, visible only to you. Posts you haven’t saved a reply for are deleted after 7 days. Saved drafts stay until you remove them; their post’s text is cleared after 7 days and only the link is kept. Anything you remove can be undone for 24 hours and is then deleted. When you ask AI to craft a reply, the post’s text and anything you add (your perspective, a link) are sent to our AI provider to write it. EzPost never posts replies for you.

Link taps

When link taps are on, links in posts on X, LinkedIn, Facebook, Threads, Bluesky and Mastodon go out as short ezpost.tech links. When someone taps one, we send them straight on to the page and count the tap for the person who posted it. For each tap we keep the day, the country (worked out by our host from the connection) and a visitor code that lets us count each person once a day. The code is made with a random key that changes every day and is deleted once that day is over, so it can’t be traced back to anyone. We never store the tapper’s IP address or browser details. Link previews and search engine visits aren’t counted. Workspace owners can turn link taps off in Settings, and anyone can turn them off for a single post.

How we use it

We use your data only to run EzPost for you: to sign you in, publish the posts you choose at the time you choose, show you what happened, bill you, and keep the service safe. We do not sell your data. We do not use it for advertising. We do not use your social account data to train AI models.

Data from Google and YouTube

EzPost’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you connect YouTube we ask for permission to upload videos and view your channel, and we use that only to publish the videos you choose and show their status. EzPost uses YouTube API Services, so by connecting a channel you also agree to the YouTube Terms of Service and the Google Privacy Policy. We do not let people read your Google or YouTube data unless you ask us to, it is needed to investigate abuse or a security problem, or the law requires it. We do not transfer it to anyone except to provide the service you asked for. You can remove EzPost’s access at any time at myaccount.google.com/permissions.

Data from Meta (Instagram, Facebook, Threads)

When you connect these accounts we receive only the permissions you approve. We use them to publish your posts, read comments and basic statistics where you ask us to, and show you the result. You can remove EzPost from your Meta account settings at any time.

Who else handles your data

We use these services to run EzPost: Vercel (web hosting), Railway (background worker), Neon (database), Cloudflare R2 (media storage), Resend (email) and Stripe (payments). They process data only on our instructions. When you publish, your post goes to the social platform you chose.

How long we keep it

We keep your data while your account is open. When you disconnect an account, we delete its stored tokens and its sign-in email. When you ask us to delete your account, we delete your data as described on the data deletion page. Some billing records are kept for as long as the law requires.

Your choices and rights

You can ask to see, correct, export or delete your data at any time. Depending on where you live, you may have further rights under laws such as the GDPR or UK GDPR. Contact us and we will reply within 30 days.

How we protect your data

This applies to all data we hold, including sensitive data such as the access tokens for your connected social accounts and any data we receive from Google, YouTube and Meta.

• Encryption in transit: EzPost is served only over HTTPS (TLS); a plain HTTP request is redirected to HTTPS.
• Encryption of tokens at rest: platform access and refresh tokens are encrypted with AES-256-GCM before they are saved. The encryption key is kept in a separate secrets store, not in the database, so a copy of the database alone does not reveal your tokens. Our hosting providers also encrypt stored data (database and media) at rest.
• Tokens stay out of sight: tokens are never shown in the app, never returned by our API, MCP or command-line tools, and never written to our logs.
• Access control: every request is checked against your workspace on our servers, so one workspace cannot read another’s accounts, posts or media. Your media is stored in a private bucket. Inside EzPost only members of your workspace can open it, through signed links that expire after ten minutes; when you publish, the platform fetches the file through a signed link that expires within 24 hours.
• Passwords: passwords are stored only as salted scrypt hashes, never in readable form. Sign-in and password-reset codes are stored hashed and expire after a few minutes.
• Limited use and retention: we collect only the permissions the feature needs. When you disconnect an account, we delete its stored tokens. When you delete your account, we delete your data as described on the data deletion page.
• If something goes wrong: we will tell affected people, and the regulator where the law requires it.

No system is perfectly secure, so we also keep access to production systems limited to the people who run EzPost.

Children

EzPost is not for anyone under 16.

Changes and contact

If we change this policy in a way that matters, we will update the date above and tell account holders by email. Questions: admin@fabricaisystems.com. Fabric AI Systems, the company behind EzPost.