Privacy Policy

Who we are

1Social is run by Sultan Kadyrkesh, a sole proprietor based in Kazakhstan (Astana, Abay Street 1), the data controller for the information described here. For anything about your data, email support@1social.dev.

Information we collect

• — Account: your email, name and avatar. If you sign in with a password we store it hashed; if you use Google sign-in we receive your basic profile and the sign-in tokens Google issues.
• — Security: your IP address and browser (user-agent) for each session, plus a sign-in cookie, to keep your account secure.
• — Billing: your plan and the customer and subscription IDs from Polar. Your card details are handled entirely by Polar and never reach us.
• — Connected accounts: for each social account you connect, its platform, handle, display name and avatar — but not its login tokens (see below).
• — Your content: the posts you write, media you attach, when they’re scheduled, and the outcome and metrics (likes, impressions, and so on) each network reports back.
• — Support: the subject lines of the emails we send you, kept so we can help if something goes wrong.

Social account credentials — we never hold your tokens

Publishing runs through Post for Me, our publishing provider. The OAuth tokens for your connected accounts stay with them; we scrub them from our webhooks and logs, and they never reach our database or any response our API sends. You can disconnect any account at any time.

How we use your data, and why

We use your data to run the service (to perform our contract with you), to keep it secure and prevent abuse (our legitimate interest), and to handle billing and meet tax obligations (legal obligation). We do not use it for advertising, and we do not profile you.

AI and agent actions

When you create or trigger a post through an AI agent such as ChatGPT or Claude, we process that content only to publish it and report the result. We do not use your content to train AI models.

Who we share your data with

We share only what each provider needs to do its job:

• — Supabase — hosts our database.
• — Polar — processes payments as our merchant of record.
• — Post for Me — publishes your posts and holds the social login tokens.
• — The networks (Bluesky, LinkedIn, X, Threads) — receive the posts you publish and return metrics.
• — Google — only if you choose Google sign-in.
• — Our email provider — sends you transactional email.
• — Doppler — stores our application secrets.

We do not sell your data, and we do not share it for advertising.

Cookies

1Social uses only a sign-in (session) cookie and a small preference for light or dark mode. There are no analytics, advertising, or third-party tracking cookies — so there is nothing to consent to beyond signing in.

How long we keep it

We keep the record of what you published — deliveries and their outcomes — as a permanent history, so a disconnected account doesn’t erase what happened. Disconnected accounts are hidden rather than deleted, for the same reason. Sign-in sessions expire after 7 days. Billing records are kept as long as tax law requires. Media handled by Post for Me is deleted by them within about 24 hours if it isn’t used. When you ask us to delete your account, we delete your data.

Where your data is processed

Your data may be processed outside your country by the providers listed above, under appropriate safeguards such as standard contractual clauses.

Your rights

If you are in the EU or UK, you can ask to access, correct, delete, or receive a copy of your data, or object to how we use it, and you can complain to your data-protection authority. If you are in California, we do not sell or share your personal information, and you can ask to know, delete, or correct it. Email support@1social.dev to exercise any of these.

Deleting your data

Email support@1social.dev and we will delete your account and everything in it.

Security

Passwords are stored hashed. Our database blocks direct access at the row level. Your social login tokens are kept off our systems entirely, with our publishing provider.

Children

1Social is not intended for anyone under 18, and we do not knowingly collect their data.

Changes and contact

If we change this policy, we’ll post the new version here and update the date above. Questions? Email support@1social.dev.