SendFlow

Privacy policy

SendFlow is a service for writing, scheduling and publishing posts to social networks you connect. It is run by Emilis Čiupaila (“we”). This policy explains what we collect, why, who we share it with and how you control it. Questions go to [email protected].

What we collect

Your SendFlow account

  • Your name, email address, workspace name and time zone.
  • Your password, stored only as a salted scrypt hash. We cannot read it.
  • API keys you create, stored only as a hash, with the date each was last used.

Social accounts you connect

  • The account's identifier, name, handle and profile picture, as the platform returns them, so you can tell your accounts apart.
  • The access and refresh tokens the platform issues so we can publish for you. They are encrypted before they are stored. For Discord we store the webhook the platform creates in the channel you pick, also encrypted.
  • For Bluesky, you give us an app password. We use it once to sign in and keep only the resulting session. We never store the password.

We only ask platforms for the permissions needed to identify the account and publish to it. We do not read your feed, followers, messages or analytics.

What you publish

  • Post text, images and videos you upload, the accounts you target and when.
  • The result from each platform: the post's ID or link, or the error it returned.
  • Webhook endpoints you register, with their signing secrets encrypted.

Technical data

  • Server logs with your IP address, the request, a request ID and errors, used to keep the service secure and working.
  • One cookie, which keeps you signed in. We use no advertising or analytics cookies and no third-party trackers.

How we use it

  • To publish and schedule your posts on the accounts you connected, when you ask us to.
  • To show you what happened to each post, and to retry or report failures.
  • To keep tokens valid by refreshing them with the platform.
  • To send account email: address confirmation, password resets and security notices.
  • To prevent abuse, enforce rate limits and investigate problems.

We do not sell your data, use it for advertising, or use your content or platform data to train machine learning models. In the EU and UK, our legal basis is performing our contract with you, plus our legitimate interest in keeping the service secure.

Data from Google, YouTube, Meta and other platforms

Data we receive from a platform is used only to provide the publishing features you see in SendFlow, and is never transferred to anyone else except as needed to provide them, for security, or to comply with the law.

Who we share it with

  • The platforms you publish to. When you publish, the post and its media go to the platforms you picked, and their own privacy policies apply from then on.
  • Service providers that run SendFlow for us: hosting and database, file storage for uploaded media, and email delivery. They process data only on our instructions.
  • Authorities, only when the law requires it.

Media you attach is given a public link while it is published, because platforms such as Instagram and Threads fetch it from us rather than receiving it directly.

How long we keep it

  • Your account, posts and connected accounts stay until you delete them or ask us to.
  • Disconnecting an account deletes its tokens immediately. Your post history stays.
  • Deleting your account in Settings removes it and your workspace immediately. If you ask us by email instead, we remove it within 30 days. Backups and logs that contain it expire within a further 30 days.

Security

Traffic is encrypted with HTTPS. Platform tokens and webhook secrets are encrypted at rest, passwords and API keys are hashed, and every workspace's data is isolated from every other's. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Your rights and choices

You can see and correct your account details in Settings, disconnect any social account on the Accounts page, and delete your account and everything in it from Settings. Depending on where you live, including under the GDPR, you can also ask us for a copy of your data, to delete it, to restrict or object to how we use it, or to move it elsewhere. Email [email protected] from the address on your account. You can also complain to your local data protection authority.

To withdraw access on a platform's side as well, see Data deletion.

Children

SendFlow is not meant for anyone under 16, and we do not knowingly collect their data.

International transfers

Our providers may process data outside your country. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.

Changes

If we change this policy, we will update the date below, and tell you by email or in the app before significant changes take effect.

Last updated 2 November 2026.