Last updated: 2 September 2026

1. Who we are

Upsocail (“we”, “us”) provides a social-media management workspace. This policy explains what personal data we collect when you use the app and how we use it.

2. Data we collect

• Account data: name, email, hashed password, MFA settings.
• Workspace content: boards, cards, posts, notes, and media you upload.
• Usage data: pages visited and actions taken, for reliability and product analytics.
• Third-party tokens: OAuth tokens for connected social accounts, stored encrypted.

3. Cookies and local storage

We use a single httpOnly refresh-token cookie to keep you signed in. Your access token is held in memory only and is never written to localStorage, sessionStorage, or a browser cookie. We store your cookie-banner choice in localStorage under upsocail_cookie_consent. If your browser sends a Global Privacy Control signal, we additionally store the date it was first honoured in upsocail_gpc_honored_at, and if you explicitly override that signal by clicking Accept, we record the override in upsocail_gpc_override_at.

4. How we use your data

• To operate the service and sync your content across devices.
• To authenticate you and protect against abuse.
• To send transactional email (password reset, security alerts).
• To publish content to connected social platforms on your instruction.

5. Sharing

We do not sell your data. We share it only with sub-processors necessary to run the service (hosting, email delivery, AI providers) under contract, and where required by law.

6. Retention

We keep account data for as long as your account is active, and for a limited period after closure to satisfy legal, tax, and audit obligations.

7. Your rights

You can access, correct, export, or delete your data at any time from Settings, or by emailing privacy@upsocail.com. You can withdraw cookie consent by clearing site data in your browser.

8. Global Privacy Control

We detect the Global Privacy Control signal (Sec-GPC / navigator.globalPrivacyControl) sent by your browser or extension. When it is present, we treat it as an opt-out of any non-essential cookies and of sale or sharing of personal information as defined by CCPA/CPRA. We record the date the signal was first honoured in upsocail_gpc_honored_at in your browser's localStorage. Strictly necessary cookies (the sign-in refresh cookie) are not affected.

9. Contact

Questions? Email privacy@upsocail.com.