Privacy Policy
What we collect
- Your email, on the account and in support.
- Access tokens for the networks you connect — through each platform's official flow, never a password typed into Fanout.
- Content (text, image, video) you send to publish or schedule.
- Subscription data, charges, and transaction identifiers from Stripe.
- Technical logs, audit events, and what we need for security and support.
How we use it
Only to run the product: publish what you sent to the networks you connected, at the time you set. We don't sell or share your data with third parties for advertising.
Where it's stored
In a database hosted on Supabase (US), restricted to server-side routes — network credentials never reach the browser.
How we protect your data
- Data and backups maintained by our infrastructure providers are protected with encryption at rest. Sensitive credentials, such as OAuth access and refresh tokens, receive an additional layer: they are encrypted by the application with AES-256-GCM before storage. Decryption keys remain only in the server-side environment and are kept separate from database records.
- Connections between your browser, Fanout, and integrated platforms use HTTPS/TLS. Access to production data is limited to authorized services and personnel based on operational need and the principle of least privilege.
- Tokens, authorization codes, and secrets are omitted or redacted from logs and audit events. We monitor credential failures and can rotate or revoke access when there is a risk, expiration, or account disconnection.
- We apply technical and organizational controls designed to prevent unauthorized access, use, alteration, loss, or disclosure. No method is infallible; we review these controls as the product and its risks evolve.
How long we keep it
- Account, workspaces, content, and media: while the account is active.
- Archived media: automatic deletion after 30 days.
- Network tokens: until you disconnect or the workspace is deleted.
- Technical logs: up to 180 days.
- Billing, consent, and audit records: up to 5 years after closure when law or fraud prevention requires it.
- Backups: technical cycle up to 90 days.
After a valid deletion request, active data is erased or anonymized within 30 days. We may keep only the minimum required by law, with restricted access.
Your rights
You can request confirmation of processing, access, correction, portability, information about sharing, objection, withdrawal of consent, and deletion where it applies. You can also disconnect networks in the product.
YouTube API Services
Fanout uses YouTube API Services to publish to YouTube. That use is also subject to the YouTube Terms of Service and Google Privacy Policy. You can revoke Fanout's access to your Google data at myaccount.google.com/permissions.
Data obtained from Google APIs
- When you connect a Google account, we access only the authorized data required for the selected feature, such as basic account identity, your YouTube channel, metadata and content submitted for publishing and, when enabled, Google Business Profile accounts, locations, reviews, and metrics.
- We use this data exclusively to authenticate your connection, display the destinations you administer, publish or schedule requested content, and show metrics, reviews, and operation status inside Fanout.
- We do not sell Google user data, use it for advertising, credit assessment, or surveillance, or use it to develop, improve, or train generalized artificial intelligence or machine learning models.
- We transfer Google data only to infrastructure providers needed to operate and protect Fanout, subject to confidentiality and security obligations, or when required by law. We do not permit humans to read this data except with your specific consent for a support request, to investigate abuse or a security incident, or to comply with law.
These practices also follow the Limited Use requirements in the Google API Services User Data Policy.
Data obtained from Meta APIs
- When you connect a Facebook, Instagram or Threads account, we access only the data you authorized and that the chosen feature needs: basic account identity, the Pages and professional accounts you administer, posts you published through Fanout, and — when you enable the Inbox — private messages, comments and mentions those accounts receive, along with the name, username and picture of whoever wrote them.
- We use this data solely to authenticate your connection, show the destinations you administer, publish or schedule the content you asked for, and let you read and answer inside Fanout the messages and comments your accounts receive. We only read and reply on accounts you explicitly connected, and we never publish anything without an action from you.
- We do not sell data obtained from Meta, do not use it for advertising, credit assessment or surveillance, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
- We transfer this data only to the infrastructure providers needed to operate and protect Fanout, under confidentiality and security obligations, or when required by law. We do not allow people to read messages and comments, except with your specific authorization for a support request, to investigate abuse or a security incident, or under legal obligation.
- Imported messages and comments are deleted when you disconnect the account or delete the workspace. You can disconnect any network at any time under Social networks, and revoke Fanout's access directly in your Meta account settings.
This use is also subject to the Meta Platform Terms.
Agents and API
When an AI agent uses Fanout through MCP or REST, we only receive what the tool sends (caption, media, time, accounts). We never receive your full conversation with the assistant.