Privacy Policy

Last updated: 17 October 2026

This policy explains how PilotPost ("PilotPost", "we", "us") collects, uses and protects personal data when you use https://pilotpost.social and the PilotPost service (the "Service"). We act as the data controller for account data and as a processor for the content you publish through the Service. Contact us at support@pilotpost.social.

1. Data we collect

• Account data: your name, email address and a securely hashed password.
• Billing data: your subscription plan and status. Payments are processed by Whop; we never see or store your full card details.
• Connected social accounts: when you connect a social network, we receive and store the access tokens and basic profile information (account ID, name, profile picture, and for Pinterest your board list) needed to publish on your behalf. Tokens are encrypted at rest.
• Content you create: post text, titles, links, images and videos you upload, schedules, and the publishing results returned by each platform.
• WhatsApp and Bluesky credentials: if you connect these, the access token or app password and the recipient phone numbers you provide. These are encrypted at rest.
• Technical data: a session cookie that keeps you logged in, and standard server logs (IP address, browser type, time of request) kept for security and troubleshooting.

2. How we use your data

• To provide the Service: publishing and scheduling your posts to the accounts you choose. (Legal basis: performance of a contract.)
• To manage your subscription and access. (Contract.)
• To keep the Service secure, prevent abuse and fix problems. (Legitimate interests.)
• To send essential service emails, such as payment or account notices. (Contract.)
• To meet legal obligations, such as tax records. (Legal obligation.)

We do not sell your data, use it for advertising, or use your content to train AI models.

3. Data from social platforms

We only access the social media data you authorize, and only to provide the features you use: identifying your connected account and publishing the content you schedule. You can disconnect any account at any time from the Accounts page. You can also revoke our access directly in each platform's settings.

YouTube: PilotPost uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of data is governed by the Google Privacy Policy. You can revoke access at myaccount.google.com/permissions. PilotPost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Facebook, Instagram, Threads, WhatsApp), TikTok, LinkedIn, X, Pinterest, Bluesky and Snapchat: data received from these platforms is used only to provide the Service, and is handled in line with each platform's developer terms.

4. Who we share data with

• The social platforms you choose, which receive the content you publish to them.
• Whop, our payment provider, which processes subscriptions and payments.
• Hetzner Online GmbH (Germany/Finland, EU), which hosts our servers and database.
• Authorities, where required by law.

Media you attach to a post is stored at an unguessable web address so that the platforms can fetch it when publishing.

5. How long we keep data

We keep your data while your account exists. Disconnecting a social account deletes its stored tokens immediately. When you delete your account, we delete your account data, connected accounts, posts and media within 30 days. Billing records may be kept longer where the law requires.

6. Your rights

Under the GDPR and similar laws, you can ask to access, correct, export or delete your personal data, object to or restrict its processing, and withdraw consent. Email support@pilotpost.social and we will reply within 30 days. You can also complain to your local data protection authority. See Data deletion for how to delete your data.

7. Security

We use HTTPS everywhere, encrypt social access tokens at rest (AES-256), hash passwords, and restrict server access. No system is perfectly secure, but we work to protect your data and will notify you of any breach as the law requires.

8. Cookies

We use one essential cookie to keep you logged in. We don't use advertising or tracking cookies.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy and will show the new date above. For significant changes, we will notify you by email or in the app.