Privacy Policy
This policy explains what personal data OmniPosts collects, why, how long we keep it, who we share it with, and your rights. It is written to be read, not skimmed past.
1. Who we are
OmniPosts is operated by Moodsboard Technologies Private Limited (CIN U72900BR2020PTC049578), Tower Chowk, Saraiyaganj, Block Musahari, Saraiyaganj, Muzaffarpur, Bihar, India - 842001 ("we", "us"). We are the controller of your account data under the EU/UK GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). For content you publish on behalf of others, see our Data Processing Agreement.
Contact: join@omniposts.dev. Grievance Officer: how to reach them.
2. What we collect
| Data | What it is | Why |
|---|---|---|
| Account data | Name, email, hashed password, organisation name, the time you accepted our terms | To give you an account and contact you about it |
| Waitlist | The email address you give on the pricing page, and which beta plan you asked for. No account is created and there is no password | To tell you when your plan opens. Used for nothing else |
| Channel credentials | OAuth access and refresh tokens (LinkedIn, Mastodon), Bluesky app passwords, Telegram bot tokens, Nostr private keys | To publish to your channels when you ask. Encrypted with AES-256-GCM; never logged; never shown back to you |
| Channel profile | Your display name, handle and avatar on each connected channel | To show you which account you are posting to |
| Your content | Drafts, posts, per-channel edits, images and videos with alt text, schedules | To save, schedule and publish what you write |
| Publishing record | When each post was sent, to which channel, the result, the link to the published post, and any error | To show you what happened and report on your publishing |
| Platform engagement counts | Numbers such as likes, reposts and replies on your own posts, where the platform shares them | To show you how your posts did |
| Developer data | API keys (stored hashed), webhook URLs, webhook delivery logs | To run the API you use |
| Technical data | IP address, browser type, security and audit logs | To keep the service secure and working |
Other people's data. Your posts may name or show other people, and platforms may return data about people who interact with your posts. We do not display or store the profiles of people who comment on or react to your posts; we store only counts. LinkedIn members' profile data is never stored.
We do not use advertising cookies or third-party trackers. We use one essential cookie to keep you signed in.
3. How each platform's data is used
- Bluesky — you give us an app password (not your main password). We use it to publish your posts and read public counts on your own posts.
- Mastodon — you sign in on your own instance and grant us permission to post. We publish your posts and read counts on your own posts from your home instance.
- Telegram — you connect a channel through a bot you add as an admin of your channel, and give us that bot's token. We use it only to send posts to the channels you choose.
- Nostr — no longer offered for new connections. If you connected Nostr earlier, we keep the private key you gave us, encrypted, only until you disconnect the channel or delete your account; we no longer use it to publish.
- LinkedIn (personal profiles) — you sign in with LinkedIn and grant the
w_member_socialpermission plus your basic profile (openid profile email). We use it only to publish posts you write to your own profile. We do not read your feed, connections or other members' data. - Instagram, Facebook, Threads, TikTok, TikTok for Business, YouTube, X and LinkedIn Pages — coming soon. Before we switch any of them on, we will update this policy with exactly what data we request and why.
Platform data is used only to provide OmniPosts to you. We do not sell it, share it for advertising, or use it — or any of your content — to train artificial-intelligence models.
4. Legal basis
- Contract (GDPR Art 6(1)(b)) — to run your account, store credentials and publish what you ask.
- Consent — when you connect a channel and when you accept these terms. We record what you agreed to and when. Under the DPDP Act, we process your personal data on the basis of your consent, given by a clear affirmative action.
- Legal obligation — to keep records the law requires.
- Legitimate interests — only for security logging and preventing abuse; never for storing your credentials.
5. How long we keep it
| Data | Kept for |
|---|---|
| Waitlist address | Until you ask us to remove it (email join@omniposts.dev); we do not need it once we have told you your plan has opened |
| Channel credentials | Until you disconnect the channel or delete your account — then deleted immediately |
| Raw data fetched from platforms | At most 30 days (our own limit), then deleted automatically; deleted immediately on disconnect |
| Engagement figures we derive (numbers tied to our record of your post) | For the life of your account, unless a platform sets a shorter limit |
| Your content and publishing record | For the life of your account; deleted within 30 days of account deletion |
| LinkedIn Page reporting data (when LinkedIn Pages is available) | At most 1 year |
| LinkedIn members' social activity data | At most 48 hours |
| Other LinkedIn members' profile data | Never stored |
| Webhook delivery logs | Deleted within 30 days of account deletion |
| Security audit logs | 12 months; never contain platform data |
| Consent records | As long as the law requires us to prove consent |
| Backups | Rotated every 30 days; never contain raw platform data |
Where a platform's own terms set a shorter limit than ours, the shorter limit applies.
6. Disconnecting and deleting
Disconnecting a channel deletes its credentials and that channel's raw platform data immediately. Your record of what you published stays until you delete it. Bluesky app passwords and Nostr keys cannot be revoked by us on the platform, which is why we delete them the moment you disconnect.
Deleting your account (Settings → Delete account) deletes credentials immediately and everything else within 30 days. See Data deletion.
7. Who we share it with
- The platforms you connect — only what you ask us to publish, and the requests needed to publish it.
- Our subprocessors (hosting and email), listed on the Subprocessors page, under written data protection terms.
- Authorities, only when the law requires it.
We never sell personal data.
8. Where it is stored
Our servers are in the European Union. If a transfer outside the EEA is ever needed, we will use a lawful mechanism such as the EU Standard Contractual Clauses and update this policy.
9. Security
Credentials are encrypted at rest with AES-256-GCM, access to production is restricted and logged, and all traffic uses TLS. See Security.
10. Your rights
You can:
- access your data and get a copy (Settings → Export, a JSON file of everything we hold for your organisation);
- correct or update it;
- erase it (Settings → Delete account);
- take it elsewhere (data portability);
- withdraw consent at any time — as easily as you gave it — by disconnecting a channel or deleting your account; this does not affect processing already done;
- object to or restrict processing (GDPR);
- nominate another person to exercise your rights if you die or become unable to (DPDP Act);
- have your grievance heard by our Grievance Officer, and complain to the Data Protection Board of India or your local data protection authority in the EU/EEA or UK.
Most of these you can do yourself in Settings. For anything else, email join@omniposts.dev. We respond within 30 days. On request, we will provide this notice in English or any language listed in the Eighth Schedule to the Constitution of India.
11. Children
OmniPosts is for adults. You must be at least 18 years old to use it. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.
12. Data breaches
If a breach affects your personal data, we notify the relevant supervisory authority within 72 hours where GDPR requires, the Data Protection Board of India as the DPDP Act requires, and you without undue delay.
13. Changes
If we change this policy in a way that matters, we tell you by email and in the app before the change takes effect, and ask for your consent again where the law requires it. The effective date at the top always shows the current version.