PubSpree lets you upload videos and photos once and publish them to your own social media accounts. This policy explains what information we handle to do that, why, who we share it with, and the choices you have. We have written it to match how the service actually works.
1. Who we are
PubSpree is operated by Wycliffe Rono, Westlands, Nairobi, KE ("we", "us", "our"). We are the data controller for the personal information described in this policy. You can reach us at ronowyclef@gmail.com.
2. What this policy covers
This policy applies to the PubSpree website and web application at https://pubspree.com (the "Service"). It does not apply to the social media platforms you connect, such as Facebook, Instagram, TikTok, YouTube, X or LinkedIn. Each of those platforms handles your information under its own privacy policy, which we link to below.
3. Information we collect
Information you give us
- Account details: your name, email address, password and timezone. We store your password only as a one-way hash, so we cannot see it.
- Content: the videos and photos you upload, plus the captions, titles, tags, per-platform options (for example YouTube visibility or TikTok privacy settings) and schedule times you enter.
- Messages: anything you send us when you contact support.
Information collected automatically
- Activity in the Service: events such as signing in, connecting or disconnecting an account, uploading or deleting media, creating, scheduling or cancelling posts, and the result of each publish attempt, and the pages of the app you visit. We use these to run the Service, help you when something fails, and understand how the Service is used.
- Device type: whether you use a desktop, tablet or phone. We work this out from your browser's user-agent string, but we don't store the string itself.
- IP address: we record activity events with a keyed hash of your IP address. Without our secret key, the hash cannot be turned back into the address. For sign-in attempts we keep the full IP address for up to 24 hours to block password-guessing attacks.
- Timestamps: when you last signed in and were last active.
- Technical logs: error and background-job logs that may include account or post identifiers, used to keep the Service working.
We do not use third-party analytics, advertising networks, tracking pixels or fingerprinting.
4. Information from connected platforms
When you connect a social media account, you sign in on that platform's own page and approve the permissions PubSpree asks for. We never see your password for those platforms. The platform then gives us:
- Identity details: the account's ID, display name, username or handle, and profile picture link, so you can recognise the account in PubSpree.
- Access tokens and refresh tokens: these let us publish on your behalf. We store them encrypted.
- Details needed to publish: the Facebook Pages you manage and choose to connect, and the information TikTok requires us to show before posting (your TikTok nickname, available privacy options, interaction settings and maximum video length).
- Publishing results: the ID and link of each post we publish, its processing status, and any error message the platform returns.
We only request the permissions needed to publish content you choose and to show which account you connected. We do not read your private messages, contacts, followers, feeds or other people's content.
6. How we use information
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account | Account details, activity | Performing our contract with you |
| Publish and schedule posts to the accounts you select | Content, tokens, platform details | Performing our contract with you; done at your request |
| Show publishing status and help you fix failures | Publishing results, activity, logs | Performing our contract with you |
| Send service emails such as password resets | Email address | Performing our contract with you |
| Keep the Service secure and prevent abuse | IP addresses, sign-in attempts, activity, logs | Our legitimate interest in protecting users and the Service; legal obligations |
| Understand usage and improve the Service | Activity and device type, analysed in aggregate | Our legitimate interest in improving the Service |
| Meet legal requirements and enforce our Terms | Any relevant information | Legal obligations; legitimate interests |
We do not sell your personal information, use it for advertising, or use your content or platform data to train artificial-intelligence models.
7. Google and YouTube data
PubSpree uses the YouTube API Services to upload videos to the YouTube channel you connect. By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
We request the youtube.upload permission to upload the videos you choose, and youtube.readonly to show the name and picture of the channel you connected. We use this data only to provide those features. We store your channel ID, name, picture link and encrypted tokens as described in this policy, and we never share them with third parties except as needed to provide the Service.
PubSpree's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke PubSpree's access to your Google account at any time on the Google security settings page, or by disconnecting YouTube on the Accounts page in PubSpree. Disconnecting deletes the stored tokens immediately. If you revoke access on Google's side, the tokens stop working and the account is marked as needing reconnection. Disconnect it in PubSpree to delete them too.
8. Meta, TikTok, X and LinkedIn
When you connect one of these platforms, we use its official API only to publish the content you choose and to identify the account you connected. Each platform's own policy applies to what you post there:
- Facebook and Instagram (Meta): Meta Privacy Policy. We publish to the Facebook Pages and Instagram professional accounts you authorise.
- TikTok: TikTok Privacy Policy. Before you post, we show the creator details and options TikTok requires, and we only post after you confirm.
- X: X Privacy Policy.
- LinkedIn: LinkedIn Privacy Policy.
10. How we protect information
- Platform access tokens and other secrets are encrypted at rest with AES-256-GCM.
- Passwords are stored only as salted one-way hashes.
- Private media is delivered through signed links that expire, and stored with random, unguessable names.
- The Service is designed to run over HTTPS. Forms are protected against cross-site request forgery, and sign-in attempts are rate-limited.
- Access to administrative functions is limited and logged.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
11. How long we keep information
| Information | How long |
|---|---|
| Account details | Until you delete your account |
| Media you upload | Automatically deleted 30 days after upload (unless a post that still needs it is waiting to publish), or earlier if you delete it |
| Shared library media (uploaded by administrators) | Until an administrator removes it |
| Post history and publishing results | Until you remove the post from your history or delete your account |
| Platform tokens and account details | Until you disconnect the account, access is revoked, or you delete your account |
| Activity events | 365 days |
| Sign-in attempts (including IP address) | 24 hours |
| Password-reset links | Expire after use or within hours; deleted within a day of expiry |
| Temporary copies made while publishing | Deleted within hours once publishing finishes |
Content you have published stays on the platforms you posted it to. Deleting it from PubSpree does not remove it from those platforms. Delete it directly on each platform.
12. Your rights and choices
Depending on where you live, including under Kenya's Data Protection Act, 2019 and the EU/UK GDPR, you have the right to:
- Access the personal information we hold about you and get a copy of it.
- Correct inaccurate information. You can update your name and timezone yourself under Settings.
- Delete your information. See Deleting your data.
- Object to or restrict processing based on our legitimate interests.
- Data portability: receive your information in a structured, machine-readable format.
- Withdraw consent where we rely on it, for example by disconnecting a platform.
- Complain to a data protection authority. In Kenya this is the Office of the Data Protection Commissioner; elsewhere, your local authority.
To use any of these rights, contact us at ronowyclef@gmail.com. We may need to verify your identity, and we will respond within the time the law requires.
13. Deleting your data
You can delete your data yourself at any time:
- Delete your whole account: sign in, open Settings, and choose Delete account. This permanently removes your profile, connected accounts and their tokens, uploaded media, post history and activity linked to you.
- Disconnect a single platform: on the Accounts page, choose Disconnect. We delete that account's tokens, and any of its posts that are still queued are cancelled.
- Revoke access from the platform's side:
- Facebook: Settings & privacy → Settings → Apps and websites
- Instagram: Settings → Apps and websites
- Google / YouTube: myaccount.google.com/permissions
- TikTok: Settings and privacy → Security → Apps and services permissions
- X: Settings → Security and account access → Apps and sessions
- LinkedIn: Settings → Data privacy → Permitted services
- Ask us: if you can't sign in, email ronowyclef@gmail.com from the address on your account with the subject "Data deletion request". We will confirm when the deletion is complete, normally within 30 days.
Backups and logs that still contain deleted data are overwritten as part of our normal cycle and are not used in the meantime. We may keep a minimal record where the law requires it, for example of a deletion request.
14. International transfers
Our service providers and the platforms you connect may process information in countries other than yours, including outside Kenya. When we transfer personal information, we use providers that offer appropriate safeguards, such as contractual data-protection commitments, as applicable law requires.
15. Children
The Service is not intended for anyone under 18, and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
16. Changes to this policy
We may update this policy as the Service or the law changes. We will change the "Last updated" date above. If the changes are significant, we will notify you through the Service or by email before they take effect.
17. Contact us
Questions or requests about this policy or your data: ronowyclef@gmail.com
Postal address: Wycliffe Rono, Westlands, Nairobi, KE.
See also our Terms of Service.