Privacy

Obsidian UG (haftungsbeschränkt), Leopoldstr. 2-8, 32051 Herford, Germany. Write to [email protected] with any question about your data. The imprint has the company's register details.

Your account. Your email, the name you give, a hash of your password (Argon2id; the password itself is never stored), your sign-in sessions and the time you last signed in.

Your brands and posts. The names of your brands, the posts you write with their times and their versions per account, the pictures and videos you upload (with their size and length), and what each platform answered: the link to the live post, or its error.

Your connected accounts. The name, handle and picture of each account you connect, and the key the platform gives us for posting (a Mastodon access key, a Telegram bot token, a Discord webhook address). Keys are encrypted with AES-256-GCM before they are stored and are never shown to anyone, you included.

The waitlist. Your email, if you leave it there, for one email when more platforms open.

Visits. Our server writes a log line for each request: the IP address, the time, the address asked for, the referring page and the browser.

Your account, brands, posts, files and connected accounts exist to run the service you signed up for: Art. 6(1)(b) GDPR.

The request logs and the limits on sign-in tries keep the service safe from abuse: Art. 6(1)(f) GDPR, our legitimate interest in a secure service.

The waitlist email rests on your consent: Art. 6(1)(a) GDPR. You can take it back any time by writing to us.

The platforms you connect receive the posts and files you schedule to them, at the time you choose. From then on their own privacy policies apply.

Our hosting company runs the server for us. Cloudflare passes every request on to our server and protects it from attacks.

Nobody else. We do not sell data, show ads or use tracking.

Our server stands in the United States. Cloudflare handles requests in its network around the world.

Your account, brands, posts, files and connected accounts: until you delete them or your account.

The key of a connected account: deleted the moment you disconnect it.

Sign-in sessions: 30 days, or until you log out.

Request logs: 30 days.

The waitlist email: until we have sent that one email, or until you ask us to remove it.

One cookie, set when you sign in: it keeps you signed in for 30 days and is only sent to the scheduler. The app also remembers in your browser which brand you opened last. No analytics, no advertising, no tracking pixels.

You may ask what we hold about you, have it corrected, deleted, limited or handed to you in a portable form, and object to its use (Art. 15 to 21 GDPR). You may complain to a data protection authority; ours is the LDI NRW in Düsseldorf.

You can delete your account yourself in the app under Settings. That removes your brands, connections, posts and uploaded files at once. For anything else, write to [email protected].