Privacy Policy

Last updated: 18 October 2026

This policy explains how PilotPost collects, uses and protects personal data when you use https://pilotpost.social and the PilotPost service (the "Service"). We act as the data controller for account data and as a processor for the content you publish through the Service. Contact us at support@pilotpost.social.

1. Data we collect

  • Account data: your name, email address and a securely hashed password.
  • Billing data: your subscription plan and status. Payments are processed by Whop; we never see or store your full card details.
  • Connected social accounts: when you connect a social network, we receive and store the access tokens and basic profile information (account ID, name, profile picture, and for Pinterest your board list) needed to publish on your behalf. Tokens are encrypted at rest.
  • Content you create: post text, titles, links, images and videos you upload, schedules, and the publishing results returned by each platform.
  • WhatsApp, Telegram and Bluesky credentials: if you connect these, the access token, bot token or app password, and the recipient phone numbers or channel you provide. These are encrypted at rest.
  • Technical data: a session cookie that keeps you logged in, a cookie that remembers your language, and standard server logs (IP address, browser type, time of request) kept for security and troubleshooting.

2. How we use your data

  • To provide the Service: publishing and scheduling your posts to the accounts you choose. (Legal basis: performance of a contract.)
  • To manage your subscription and access. (Contract.)
  • To keep the Service secure, prevent abuse and fix problems. (Legitimate interests.)
  • To send essential service emails, such as payment or account notices. (Contract.)
  • To meet legal obligations, such as tax records. (Legal obligation.)

We do not sell your data, use it for advertising, or use your content to train AI models.

3. Data from social platforms

We only access the social media data you authorize, and only to provide the features you use: identifying your connected account and publishing the content you schedule. You can disconnect any account at any time from the Accounts page. You can also revoke our access directly in each platform's settings.

YouTube: PilotPost uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of data is governed by the Google Privacy Policy. You can revoke access at myaccount.google.com/permissions. PilotPost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Facebook, Instagram, Threads, WhatsApp), TikTok, LinkedIn, X, Pinterest, Telegram and Bluesky: data received from these platforms is used only to provide the Service, and is handled in line with each platform's developer terms.

4. Who we share data with

  • The social platforms you choose, which receive the content you publish to them.
  • Whop, our payment provider, which processes subscriptions and payments.
  • Google, if you choose "Continue with Google": we receive only your name, email address and a Google account ID, and never your Google password.
  • Google, for website analytics and ad measurement, only if you accept cookies.
  • Whop, for visit and sign-up tracking, only if you accept cookies.
  • Meta Platforms Ireland, for ad measurement through the Meta Pixel, only if you accept cookies.
  • OpenAI, for measuring our OpenAI Ads, only if you accept cookies. When you subscribe, we may also tell OpenAI that an order happened (an order number and time, no personal details).
  • Anthropic, the AI provider behind our free tools (caption, post, hashtag and name generators, and sentiment analysis): the text you type into a free tool is sent to Anthropic to produce the result. We don't store it, and Anthropic doesn't use it to train its models.
  • SocialAPI.ai, our posting provider, which connects to Facebook, Instagram, Threads, LinkedIn, TikTok, YouTube and Pinterest on your behalf and holds the access you grant to those networks.
  • Hetzner Online GmbH (Germany/Finland, EU), which hosts our servers and database.
  • Authorities, where required by law.

Media you attach to a post is stored at an unguessable web address so that the platforms can fetch it when publishing.

Some of these providers process data outside the EU, for example in the United States. Where that happens, we rely on the safeguards they offer under the GDPR, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The full list is on our subprocessors page.

5. How long we keep data

We keep your data while your account exists. Disconnecting a social account deletes its stored tokens immediately. When you delete your account, we delete your account data, connected accounts, posts and media within 30 days. Billing records may be kept longer where the law requires.

6. Your rights

Under the GDPR and similar laws, you can ask to access, correct, export or delete your personal data, object to or restrict its processing, and withdraw consent. Email support@pilotpost.social and we will reply within 30 days. You can also complain to your local data protection authority. See Data deletion for how to delete your data.

7. Security

We use HTTPS everywhere, encrypt social access tokens at rest (AES-256), hash passwords, and restrict server access. No system is perfectly secure, but we work to protect your data and will notify you of any breach as the law requires.

8. Cookies

We use one essential cookie to keep you logged in and one to remember your language. With your permission, we also use Google Tag Manager and Google Analytics cookies to understand how visitors use our website, Google advertising cookies, the Meta Pixel and the OpenAI Ads pixel to measure and improve our own ads, and Whop's tracking to measure visits and sign-ups that come from our Whop store and affiliates. These are only set if you click "Accept" in our cookie banner, and you can change your choice at any time with "Cookie settings" in the footer. Google's use of this data is described in the Google partner sites policy.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy and will show the new date above. For significant changes, we will notify you by email or in the app.

Privacy Policy