Privacy Policy

1. Information We Collect

• Account & Workspace Profile: Username, email address, display name, and hashed password credentials.
• Connected Social Channels: OAuth 2.0 access/refresh tokens, channel IDs, page names, and avatar URLs explicitly authorized by you for Instagram, Facebook Pages, LinkedIn, and YouTube.
• Content & Media Assets: Post captions, scheduled timestamps, Brand Voice preferences, AI images, and videos uploaded to your Workspace Media Library.
• Engagement Metrics: Post impressions, likes, comments, shares, and click telemetry collected for your workspace analytics dashboard.

2. How We Protect & Isolate Your Data

All third-party Social OAuth tokens and BYOK AI Provider API keys are encrypted at rest using Fernet symmetric encryption before database storage. Developer MCP API keys (op_live_) are stored exclusively as one-way SHA-256 cryptographic hashes. Every API request is validated against strict multi-tenant JWT workspace membership checks so one tenant can never view or modify another tenant's resources.

3. Google / YouTube & Meta API Limited Use Disclosure

OmniPost AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Tokens obtained from Google/YouTube or Meta (Instagram/Facebook) are used solely to publish user-initiated or scheduled posts and retrieve analytics for that workspace. We never sell user data or use connected social account data to train foundational AI models.

4. AI Sub-Processors (BYOK & Built-In)

When you invoke AI captioning, image creation, or 7-Day Auto-Pilot, your prompt and Brand Voice configuration are transmitted securely to your selected AI provider (Google Gemini, OpenAI, Anthropic, or OpenRouter). We do not send your passwords or OAuth social tokens to any AI model provider.

5. Data Retention, Revocation & Deletion

You can delete media files directly inside the Media Library, revoke MCP API keys in the MCP & Agents dashboard, or disconnect social accounts at any time. To request full workspace deletion or Meta/Google data erasure confirmation, email privacy@omnipost.ai.