Privacy Policy

Last updated: June 3, 2026

This Privacy Policy explains what information Crossbones ("Crossbones", "we", "us") collects, how we use it, and the choices you have. Crossbones is a tool that lets you schedule and publish content to your connected social media accounts.

1. Information we collect

Category	What it includes	Why
Account & identity	Email address you sign in with; basic profile info from connected platforms (channel/page name, username, avatar, account ID).	To create your account and show which accounts you've connected.
Authorization tokens	OAuth access/refresh tokens issued by YouTube, Instagram, Facebook, and TikTok when you connect an account.	To publish content on your behalf to those accounts.
Content you create	Captions, images, videos, and the schedules you set.	To store, schedule, and publish your posts.
Usage & logs	Basic technical logs (timestamps, errors, IP) generated by our infrastructure.	To operate, secure, and debug the service.

We never collect or store your social media passwords. You authorize each account through its platform's own secure OAuth screen, and you can revoke that access at any time.

2. How we use your information

To publish and schedule the content you create, to the accounts you choose.
To authenticate you and keep your account secure.
To operate, maintain, debug, and improve the service.
To communicate with you about your account or important service changes.

We do not sell your personal information, and we do not use your content to train AI models or for advertising.

3. Google / YouTube API Services

Crossbones' use of information received from Google APIs (including the YouTube Data API) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only access your YouTube data to perform actions you explicitly request (e.g., uploading and scheduling videos to your channel).
We do not transfer or sell this data, and we do not use it for advertising or to train generalized AI/ML models.
Humans do not read your Google user data except where you give explicit consent, where required for security or to comply with law, or in aggregate/anonymized form for operations.

By using Crossbones with YouTube you also agree to the YouTube Terms of Service and the Google Privacy Policy. You can review and revoke Crossbones' access to your Google account at myaccount.google.com/permissions.

4. Meta (Instagram & Facebook) and TikTok

When you connect Instagram, Facebook, or TikTok, we receive and store the authorization tokens and basic profile details needed to publish on your behalf, in accordance with the Meta Platform Terms and the TikTok Developer Terms. You can revoke access from those platforms' app/connected-apps settings at any time.

5. How your data is stored & protected

Authorization tokens are encrypted at rest (AES-256-GCM) and are only decrypted server-side at the moment a post is published.
Your account data is stored in our database provider (Supabase) with row-level security so each user can access only their own data.
Your uploaded media is stored in object storage (Cloudflare R2).

6. Sub-processors we share data with

We share data only with infrastructure providers required to run the service: Supabase (database, authentication), Cloudflare (media storage, networking), and the social platforms you connect (to publish your content). We do not share your data with advertisers or data brokers.

7. Data retention & deletion

We keep your data while your account is active. You can disconnect any account (which deletes its stored tokens) or delete your Crossbones account at any time, which removes your posts, media, and tokens. To request deletion, email hello@crossbones.app.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. Contact us to exercise these rights.

9. Children

Crossbones is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the "Last updated" date above; significant changes will be communicated where appropriate.

11. Contact

Questions about privacy? Email hello@crossbones.app.