1. Who we are

ViralPosts (“we”, “us”, “our”) is an AI-powered social media scheduling service operated at https://get-viral-posts.vercel.app. This policy explains what data we collect, why we collect it, and your rights over it.

2. Data we collect

Account data — your email address and hashed password (managed by Supabase Auth).
Profile data — optional display name and timezone you provide in Settings.
LinkedIn credentials — OAuth access tokens and refresh tokens. These are encrypted at rest with AES-256-GCM and never stored in plaintext. We never see your LinkedIn password.
Post content — captions, media uploads, and scheduling times you create inside ViralPosts.
Usage data — monthly post counts and AI caption/image counts, shown on your dashboard.
Log data — an audit log of key actions (post scheduled, published, failed) for operational reliability and debugging.
Product events — a small set of events (signed up, connected LinkedIn, created/published a post) tied to your account ID only, not your email or IP address, used to understand which features work.
Error reports — technical details of crashes and failed requests (stack trace, page, browser). We configure these not to include your IP address, cookies or post content.

3. How we use your data

To authenticate you and maintain your session.
To publish posts to LinkedIn on your behalf at the times you choose.
To generate AI captions and images in response to your prompts.
To send transactional emails: password resets via Supabase Auth, and a welcome email plus alerts when a scheduled post fails or a LinkedIn connection expires via Brevo. You can turn the alerts off in Settings. We do not send marketing emails without your explicit consent.
To monitor and improve service reliability.

We do not sell your data to third parties. We do not use your post content to train AI models.

4. Third-party services

We share data with the following processors only to the extent necessary to operate the service:

Supabase — database, file storage, and authentication. Data stored in US-east region.
Groq — AI caption generation. Your prompt and selected tone are sent to Groq; the response is returned and not retained by us.
Cloudflare Workers AI and Pollinations.ai — AI image generation. Your prompt is sent to one of them; the resulting image is stored in Supabase Storage under your account.
Apify — Content Brain. When you turn it on, your public LinkedIn posts are collected through Apify so we can learn your writing style.
Brevo — delivery of transactional emails (your email address and the email content).
Sentry — error monitoring (technical error reports, as described above).
PostHog — product analytics (account-ID-keyed events, as described above).
LinkedIn — posts are published via the LinkedIn API using your OAuth token. Governed by the LinkedIn Privacy Policy.
Vercel — hosting and edge functions. Governed by the Vercel Privacy Policy.

5. Cookies and local storage

We use a single session cookie set by Supabase Auth to keep you logged in. We do not use advertising or tracking cookies. The LinkedIn OAuth flow uses a short-lived CSRF state cookie that is deleted immediately after the OAuth callback completes.

6. Data retention

Your data is retained for as long as your account is active. Post content and logs are kept indefinitely unless you delete them. If you close your account from Settings, your profile, posts, connected accounts, and any LinkedIn posts collected for Content Brain are deleted immediately, including the copy held by Apify.

Deleting your account removes our copy of your LinkedIn access token, but does not revoke LinkedIn's own authorization grant — only you can do that, from linkedin.com/psettings/permitted-services.

7. Your rights

Depending on where you are located, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and associated data.
Export your post data.
Withdraw consent for LinkedIn access (by disconnecting your account in Settings).

To exercise these rights, email us at privacy@viralposts.io. We will respond within 30 days.

8. Security

LinkedIn access tokens are encrypted at rest using AES-256-GCM with a server-side key stored in environment variables. All traffic is served over HTTPS with HSTS enforced. We apply Row Level Security (RLS) in Supabase so that each user's data is isolated at the database level.

9. Children

ViralPosts is not directed at children under 16. If you believe a child has created an account, contact us at privacy@viralposts.io and we will delete the account promptly.

10. Changes to this policy

We may update this policy. Material changes will be notified by email or by a banner on the dashboard. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

Questions about this policy? Email privacy@viralposts.io.

Privacy Policy