Privacy Policy

Who we are

1Social is run by Sultan Kadyrkesh, a sole proprietor based in Kazakhstan (Astana, Abay Street 1), the data controller for the information described here. For anything about your data, message us on WhatsApp or X.

Information we collect

• — Account: your email, name and avatar. If you sign in with a password we store it hashed; if you use Google sign-in we receive your basic profile and the sign-in tokens Google issues.
• — Security: your IP address and browser (user-agent) for each session, plus a sign-in cookie, to keep your account secure.
• — Billing: your plan and the customer and subscription IDs from Polar. Your card details are handled entirely by Polar and never reach us.
• — Connected accounts: for each social account you connect, its platform, handle, display name and avatar — but not its login tokens (see below).
• — Your content: the posts you write, media you attach, when they’re scheduled, and the outcome and metrics (likes, impressions, and so on) each network reports back.
• — Support: the subject lines of the emails we send you, kept so we can help if something goes wrong.
• — Usage: which pages you visit, and a small set of events describing how you moved through sign-up. This is collected by third-party analytics on every page, including before you sign in — see “Analytics” below for exactly what and by whom.

Social account credentials — we never hold your tokens

Publishing runs through Outstand, our publishing provider. The OAuth tokens for your connected accounts stay with them; we scrub them from our webhooks and logs, and they never reach our database or any response our API sends. You can disconnect any account at any time.

Google user data (Google sign-in and YouTube)

If you sign in with Google, we receive only your basic profile (name, email and avatar) and use it to create and identify your 1Social account.

If you connect a YouTube channel, 1Social asks for two permissions: to upload videos (youtube.upload) and to view your YouTube account (youtube.readonly). We use them only to publish the videos you choose, with the title and description you write, when you publish or at the time you scheduled, and to show which channel is connected (its name, handle and avatar) and the status of what you published. We never upload, change or delete anything you did not ask for. We do not use this data for advertising, we do not sell it, and we do not use it to train AI models. The access tokens are held by Outstand, our publishing provider, and never stored in our database. You can disconnect the channel in 1Social, or revoke 1Social’s access at myaccount.google.com/permissions, at any time.

1Social’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your data, and why

We use your data to run the service (to perform our contract with you), to keep it secure and prevent abuse (our legitimate interest), to understand how the product is used so we can improve it (our legitimate interest), and to handle billing and meet tax obligations (legal obligation). We do not use it for advertising, we do not sell it, and we make no automated decisions about you that have a legal or similarly significant effect.

AI and agent actions

When you create or trigger a post through an AI agent such as ChatGPT or Claude, we process that content only to publish it and report the result. We do not use your content to train AI models.

Who we share your data with

We share only what each provider needs to do its job:

• — DigitalOcean — hosts our application and our database, in the United States.
• — Cloudflare (R2) — stores the images and video you upload. Uploaded media is served from a public URL, so anyone holding that link can open the file.
• — Polar — processes payments as our merchant of record.
• — Outstand — publishes your posts and holds the social login tokens.
• — The networks you connect — Bluesky, LinkedIn, X, Threads, Instagram, Facebook, TikTok and YouTube — receive the posts you publish to them and return metrics. Threads, Instagram and Facebook are Meta; YouTube is Google.
• — Google — for Google sign-in if you choose it, and Google Analytics on every page.
• — PostHog — product analytics, as described above.
• — Doppler — stores our application secrets.

We do not sell your data for money, and we run no advertising of our own. Google Analytics is the one place where data reaches a company that is also in the advertising business — see “Analytics” below if that matters to you.

Analytics

We use two analytics providers, on every page of this site — the marketing pages included, before you sign in or create an account.

• — PostHog (PostHog Inc., United States) records the pages you view and a small set of product events. Today those events describe the sign-up flow: which networks you picked, how often you said you post, what you said you use 1Social for, the monthly delivery estimate we showed you, that you reached the plan screen, which plan you selected, and whether you went on to checkout. If you are signed in we also send PostHog your user ID and your email address, so that activity can be tied to your account.
• — Google Analytics 4 (Google LLC, United States) records page views, along with the technical details a browser sends: approximate location derived from your IP address, device, operating system, browser and language.

Neither is used for advertising, and we do not sell or share this data for advertising. We do not send either provider the contents of your posts, your media, or your social account credentials. Both providers process this data in the United States. A browser tracker blocker will stop both; we do not currently act on Do Not Track or Global Privacy Control signals. If you would rather we deleted your analytics records, email us and we will.

Cookies

We set a sign-in (session) cookie and a small preference for light or dark mode. The two analytics providers above set their own cookies as well:

• — PostHog sets one cookie (named ph_…_posthog) to recognise a returning browser across visits.
• — Google Analytics sets _ga and _ga_… for the same purpose.

These are analytics cookies, not advertising cookies, and we do not currently ask for your consent before setting them. If you are in a place whose law requires that consent, use a tracker blocker or decline cookies in your browser until we ship a consent banner.

How long we keep it

We keep the record of what you published — deliveries and their outcomes — as a permanent history, so a disconnected account doesn’t erase what happened. Disconnected accounts are hidden rather than deleted, for the same reason. Sign-in sessions expire after 7 days. Billing records are kept as long as tax law requires. Images and video you upload are stored in our own storage and fetched from there by the networks when a post goes out. When you delete your account, all of this is erased at once — see below.

Where your data is processed

We are based in Kazakhstan. Your account, your posts and their delivery history are stored in the United States, on DigitalOcean. Analytics is processed in the United States by PostHog and Google. Uploaded media sits on Cloudflare’s global network. So if you are in the EU or UK, your data leaves that region; where required we rely on safeguards such as standard contractual clauses.

Your rights

If you are in the EU or UK, you can ask to access, correct, delete, or receive a copy of your data, or object to how we use it, and you can complain to your data-protection authority. That includes objecting to the analytics described above, which we rely on legitimate interest for. If you are in California, we do not sell your personal information for money; use of Google Analytics may count as “sharing” under California law depending on Google’s settings, and you can ask us to stop it for you. You can also ask to know, delete, or correct your information. Message us on WhatsApp or X to exercise any of these.

Deleting your data

You can delete your account yourself, under Usage → Delete account (or from the link at the bottom of the sign-up screens) — see how to delete your account. It happens immediately: your channels are disconnected from us and our publishing provider, and your posts, their delivery history, your uploaded media, your sign-in details and your agent connections are erased. Any subscription is cancelled on the spot. Two things remain. Posts already published stay on the networks until you remove them there. And Polar keeps the invoices tax law requires, with your name and email anonymised. Deleted data can linger in our database backups for up to 7 days before they rotate out. If you cannot sign in, message us on WhatsApp or X and we will do it for you.

Security

Passwords are stored hashed. Our database blocks direct access at the row level. Your social login tokens are kept off our systems entirely, with our publishing provider.

Children

1Social is not intended for anyone under 18, and we do not knowingly collect their data.

Changes and contact

If we change this policy, we’ll post the new version here and update the date above. Questions? Message us on WhatsApp or X.