Privacy policy

What Nightpost does

Nightpost is a scheduling tool. You upload finished video clips and captions, connect your own social accounts, and choose when each clip is published to TikTok, Instagram, YouTube or Facebook. A background worker then publishes the clips at the chosen time using each platform's official API. Optionally, Claude (an AI model from Anthropic) can be used to adapt captions, read an imported plan, or check a post before it goes out.

Data we collect

• Account: your email address, display name and timezone, provided when you sign in with a magic link or Google.
• Connected platform accounts: the account or channel ID, display name, avatar, granted scopes, and the OAuth access and refresh tokens the platform issues. Tokens are encrypted at rest (AES-256-GCM) and are never shown in the app or written to logs.
• Media: the video files you upload, their technical metadata (duration, resolution, codec, size, checksum) and a generated thumbnail.
• Posts: captions, titles, descriptions, tags, first comments, privacy settings, schedule times, and the status and public URL of each published post.
• API keys: if you create keys for the MCP server, we store a hash of each key, its scopes and when it was last used. The key itself is shown once and not stored.
• Usage and audit records: actions such as connecting an account, creating a key, scheduling or deleting a post, with timestamps, your user ID and the IP address of the request, kept for security and support.
• Billing: if you subscribe, Stripe processes payment. We store your Stripe customer ID and subscription status, never card numbers.
• Waitlist: an email address, if you join it.

How we use platform data

Data received from TikTok, Meta (Facebook and Instagram) and Google (YouTube) is used only to show you your connected accounts, to upload and publish the posts you schedule, and to report their status back to you. We do not sell it, use it for advertising, or share it with other users. Use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

AI features

Three optional features send text to Anthropic's Claude API: the caption adapter, the plan importer, and the pre-post check. Only the caption, title, file names, the plan text you paste, your time zone and the platform rules are sent; never your tokens or media files. Anthropic's API does not use this data to train models. Each workspace has a monthly AI budget, and the scheduler works without these features if they are off or unavailable.

Where data is stored and who processes it

• Supabase (database, authentication, file storage), Tokyo region (AWS ap-northeast-1).
• Vercel (web application hosting and the publishing worker).
• Stripe (payments), Anthropic (AI features), and the platforms you connect: TikTok, Meta, Google.
• Transactional email is sent through Supabase's email service or Resend.

Retention

Media files and posts stay until you delete them or your account. Audit records are kept for 12 months. Platform tokens are deleted the moment you disconnect an account. When you delete your account, all rows, files and tokens are removed within 24 hours, and backups expire within 30 days.

Your rights

You can export your data and delete your account from Settings at any time. See the data deletion page for the exact steps, including deletion requested through Facebook or TikTok. For any request, contact retrostudios.official01@gmail.com. Under Japan's Act on the Protection of Personal Information and, where applicable, the GDPR, you may also request access, correction or restriction.

Cookies

Nightpost uses only the cookies needed to keep you signed in (set by Supabase Auth) and a CSRF token. There are no advertising or third-party analytics cookies.

Changes

We will update the date at the top of this page when the policy changes and email account holders about material changes.