Privacy Policy

Who we are

1Social is run by Sultan Kadyrkesh, a sole proprietor based in Kazakhstan (Astana, Abay Street 1), the data controller for the information described here. For anything about your data, message us on WhatsApp or X.

Information we collect

• — Account: your email, name and avatar. If you sign in with a password we store it hashed; if you use Google sign-in we receive your basic profile and the sign-in tokens Google issues.
• — Security: your IP address and browser (user-agent) for each session, plus a sign-in cookie, to keep your account secure.
• — Billing: your plan and the customer and subscription IDs from Polar. Your card details are handled entirely by Polar and never reach us.
• — Connected accounts: for each social account you connect, its platform, handle, display name and avatar — but not its login tokens (see below).
• — Your content: the posts you write, media you attach, when they’re scheduled, and the outcome and metrics (likes, impressions, and so on) each network reports back.
• — Support: the subject lines of the emails we send you, kept so we can help if something goes wrong.
• — Usage: which pages you visit, and a small set of events describing how you moved through sign-up. This is collected by third-party analytics on every page, including before you sign in — see “Analytics” below for exactly what and by whom.

Social account credentials — we never hold your tokens

Publishing runs through Outstand, our publishing provider. The OAuth tokens for your connected accounts stay with them; we scrub them from our webhooks and logs, and they never reach our database or any response our API sends. You can disconnect any account at any time.

How we use your data, and why

We use your data to run the service (to perform our contract with you), to keep it secure and prevent abuse (our legitimate interest), to understand how the product is used so we can improve it (our legitimate interest), and to handle billing and meet tax obligations (legal obligation). We do not use it for advertising, we do not sell it, and we make no automated decisions about you that have a legal or similarly significant effect.

AI and agent actions

When you create or trigger a post through an AI agent such as ChatGPT or Claude, we process that content only to publish it and report the result. We do not use your content to train AI models.

Who we share your data with

We share only what each provider needs to do its job:

• — DigitalOcean — hosts our application and our database, in the United States.
• — Cloudflare (R2) — stores the images and video you upload. Uploaded media is served from a public URL, so anyone holding that link can open the file.
• — Polar — processes payments as our merchant of record.
• — Outstand — publishes your posts and holds the social login tokens.
• — The networks you connect — Bluesky, LinkedIn, X, Threads, Instagram, Facebook and TikTok — receive the posts you publish to them and return metrics. Threads, Instagram and Facebook are Meta.
• — Google — for Google sign-in if you choose it, and Google Analytics on every page.
• — PostHog — product analytics, as described above.
• — Doppler — stores our application secrets.

We do not sell your data for money, and we run no advertising of our own. Google Analytics is the one place where data reaches a company that is also in the advertising business — see “Analytics” below if that matters to you.

Analytics

We use two analytics providers, on every page of this site — the marketing pages included, before you sign in or create an account.

• — PostHog (PostHog Inc., United States) records the pages you view and a small set of product events. Today those events describe the sign-up flow: which networks you picked, how often you said you post, what you said you use 1Social for, the monthly delivery estimate we showed you, that you reached the plan screen, which plan you selected, and whether you went on to checkout. If you are signed in we also send PostHog your user ID and your email address, so that activity can be tied to your account.
• — Google Analytics 4 (Google LLC, United States) records page views, along with the technical details a browser sends: approximate location derived from your IP address, device, operating system, browser and language.

Neither is used for advertising, and we do not sell or share this data for advertising. We do not send either provider the contents of your posts, your media, or your social account credentials. Both providers process this data in the United States. A browser tracker blocker will stop both; we do not currently act on Do Not Track or Global Privacy Control signals. If you would rather we deleted your analytics records, email us and we will.

Cookies

We set a sign-in (session) cookie and a small preference for light or dark mode. The two analytics providers above set their own cookies as well:

• — PostHog sets one cookie (named ph_…_posthog) to recognise a returning browser across visits.
• — Google Analytics sets _ga and _ga_… for the same purpose.

These are analytics cookies, not advertising cookies, and we do not currently ask for your consent before setting them. If you are in a place whose law requires that consent, use a tracker blocker or decline cookies in your browser until we ship a consent banner.

How long we keep it

We keep the record of what you published — deliveries and their outcomes — as a permanent history, so a disconnected account doesn’t erase what happened. Disconnected accounts are hidden rather than deleted, for the same reason. Sign-in sessions expire after 7 days. Billing records are kept as long as tax law requires. Images and video you upload are stored in our own storage and fetched from there by the networks when a post goes out. When you ask us to delete your account, we delete your data.

Where your data is processed

We are based in Kazakhstan. Your account, your posts and their delivery history are stored in the United States, on DigitalOcean. Analytics is processed in the United States by PostHog and Google. Uploaded media sits on Cloudflare’s global network. So if you are in the EU or UK, your data leaves that region; where required we rely on safeguards such as standard contractual clauses.

Your rights

If you are in the EU or UK, you can ask to access, correct, delete, or receive a copy of your data, or object to how we use it, and you can complain to your data-protection authority. That includes objecting to the analytics described above, which we rely on legitimate interest for. If you are in California, we do not sell your personal information for money; use of Google Analytics may count as “sharing” under California law depending on Google’s settings, and you can ask us to stop it for you. You can also ask to know, delete, or correct your information. Message us on WhatsApp or X to exercise any of these.

Deleting your data

Message us on WhatsApp or X and we will delete your account and everything in it.

Security

Passwords are stored hashed. Our database blocks direct access at the row level. Your social login tokens are kept off our systems entirely, with our publishing provider.

Children

1Social is not intended for anyone under 18, and we do not knowingly collect their data.

Changes and contact

If we change this policy, we’ll post the new version here and update the date above. Questions? Message us on WhatsApp or X.