Privacy Policy

Who this is about

Steerpost is software that schedules and publishes social posts. Anyone can run their own copy. This policy describes what that software does with your data. The person or organization that runs this copy is its operator (named under Contact below).

The operator decides what happens to your data and answers for it. Steerpost does not run a central service that collects your data.

What is stored

• Account: your email address, your display name and, if you set one, a salted hash of your password (Argon2id). The password itself is never stored.
• Sign-in with Google or GitHub, if you use it: which provider, your account id there, the email address it reports and whether it verified it, when you connected it and when you last signed in with it. The provider's access token is used only during that sign-in and is never stored.
• Terms: the version of these texts you accepted and when.
• Connected networks: the access tokens or credentials that LinkedIn, Telegram, Discord, Mastodon and Bluesky give Steerpost. They are encrypted at rest and never shown in the interface, logs or audit log.
• Content: your posts, their schedule and status, and the media you upload.
• Audit log: what was done, by you or by an AI agent using one of your API keys, and when. It holds no post text and no secrets.
• Approval requests: when an AI agent asks to publish, retry, delete or schedule soon, a copy of the post title and text it wants to act on is kept so you can review it. Decided and expired requests are deleted after a retention period (30 days by default).
• Sessions: a hash of each session, the browser user-agent string (up to 256 characters) and the IP address it came from. API keys: a hash of each key and when it was last used. Key secrets are shown once and stored only as hashes.
• IP addresses: used to rate-limit requests and kept in sessions and the audit log for security.

Where it is stored

On the operator's server: a PostgreSQL database and Redis for queues. Media goes to S3-compatible object storage that the operator chooses (for example MinIO on the same server, or a cloud provider). Ask the operator where this copy runs.

What leaves the server

Steerpost calls the APIs of the networks you connect, only on your behalf: LinkedIn, Telegram, Discord, Mastodon and Bluesky. It sends the post text and media you chose to publish and reads back the status and ids it needs. Those networks have their own privacy policies, which apply to what they receive.

If you choose "Continue with Google" or "Continue with GitHub", your browser goes to that provider to sign in, and Steerpost asks it only for your account id, name and email address (Google: openid email profile; GitHub: user:email). Steerpost never sees your password there and cannot post anything with it. The provider's own privacy policy applies to that sign-in.

If the operator turned on email, a mail server also receives your address to send verification and password-reset messages.

There are no advertising or analytics trackers, and no third-party scripts, in the web app. It sets two cookies, a session cookie and a CSRF cookie, which are needed to sign in. Signing in with Google or GitHub adds one or two short-lived cookies that tie the provider's answer to your browser (socialos_oauth, and socialos_oauth_ticket while a new account is being created); they expire after 10 minutes.

How long it is kept

• Posts, media and connected networks: until you delete them or the account (an account you delete is purged after the grace period).
• Sessions: until they expire (7 days by default) or you sign out.
• An unfinished sign-up with Google or GitHub (the provider's account id, your email and name, kept until you accept the Terms): deleted when you finish it, otherwise within about an hour.
• Audit log: kept with the account and deleted with it. There is no automatic expiry yet.
• Backups: whatever the operator keeps. Ask them how long.

Export and deletion

Export: in Settings, under "Your data", you can download a ZIP of everything you have in Steerpost: your profile, posts, connected accounts (without credentials), the Google or GitHub accounts you sign in with, API key names, approvals, the audit log and your media files. The file is deleted from storage after a few days.

Deletion: in Settings, under "Your data", you can delete your whole account. You confirm with your password (or, if you never set one, by having signed in within the last 10 minutes) and by typing your email. Your sessions and API keys are signed out at once and scheduled posts are set back to drafts. After a grace period (7 days unless the operator changed it) your posts, media files, connected networks and their stored credentials, linked Google or GitHub accounts, API keys, approvals and audit log are deleted. Until then you can sign in and cancel. A record that an account was deleted, with counts only and no personal data, is kept. You can also delete single posts and media and disconnect a network at any time.

Backups and server logs are not touched by this; they expire on the operator's schedule.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your data and to complain to a regulator. Use the contact address below. The operator is the controller of your data.

Changes

The version above changes when the meaning of this text changes. New accounts accept the current version when they register. Existing accounts are not blocked by a new version.

Contact

Operator: the operator of this Steerpost instance (name not set; the operator sets OPERATOR_NAME)

Contact: not set; the operator sets OPERATOR_CONTACT