XPOST

Privacy Policy

Effective and last updated: 14 October 2026

This policy covers the XPOST website, iPhone app and publishing service. The data controller is Rewrite, CVR 43102990, Denmark. For privacy questions or requests, contact tobiasroy94@gmail.com.

1. Data we handle

• Your content: videos you choose to import, titles, captions, selected destinations, visibility settings and other posting choices. Drafts and imported files are stored on your iPhone; when you submit a video, it is also uploaded to our server.
• Connected accounts: account or channel identifiers, display names, authorization/access and refresh tokens, and publishing or processing results returned by Instagram, TikTok or YouTube. We do not receive your platform passwords.
• Device and service information: a randomly generated installation session, publishing request identifiers, video duration and dimensions, timestamps, and technical error information. The installation credential is held in your iPhone’s Keychain; the server stores a hash of it.
• Website and network information: IP address and ordinary connection information needed to deliver pages, secure the service and limit abusive requests. The website has no advertising trackers, analytics scripts, third-party fonts or non-essential cookies.
• Support: your email address and information you send when contacting us.

2. Why we use it

We use this information to connect accounts you authorize, upload and publish the content you confirm, track submission status, maintain drafts and publishing history, respond to requests, and protect and troubleshoot the service. We do not sell personal data or use your videos or connected-account data for advertising or to train general-purpose AI models.

Under the GDPR, our legal bases are performance of our agreement with you for the requested service and support (Article 6(1)(b)), our legitimate interests in service security and reliability (Article 6(1)(f)), and compliance with applicable legal obligations (Article 6(1)(c)). You choose which platform permissions to grant and may revoke them.

3. Who receives data

We send your video, caption and posting instructions to the platforms you select. Those platforms process the data under their own terms and privacy policies. Their account and privacy controls govern posts after publication. We use Hetzner for backend and website hosting and Google’s email service to receive and respond to support messages. Our hosting and support providers process relevant data to supply those services.

We may disclose information where legally required or necessary to protect legal rights and service security. We do not share your content with unrelated advertisers or data brokers.

Platform and support providers may process information outside the European Economic Area. Their privacy notices describe their processing and transfer arrangements. Where Rewrite arranges an international transfer requiring safeguards, applicable data-protection requirements apply; contact us for information about the arrangements relevant to your data.

4. Google and YouTube

XPOST uses YouTube API Services. If you connect YouTube, we use the permissions you grant to identify your channel, upload videos you confirm and check their status. We request youtube.upload and youtube.readonly. We do not use these permissions to read your Gmail or download your YouTube video library.

XPOST’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. See the Google Privacy Policy for Google’s practices.

You can revoke XPOST’s access through Google’s security permissions page, as well as by disconnecting YouTube in XPOST. Revoking access stops further authorized access; it does not remove videos already uploaded to YouTube.

5. Automatic file cleanup and retention

Connections use HTTPS. Platform authorization credentials and publishing job records are encrypted at rest on our backend. Uploaded video files are stored on the server and made available to the selected platform through temporary signed download links. Anyone holding a valid signed link can access its video until that link expires; the files are not listed on the public website.

You do not need to email us to remove a successfully published video’s working copies. Once every destination you selected confirms successful publication or processing, XPOST automatically deletes its server-held original video file and removes the download record. Cleanup normally runs within the next five-second worker cycle while the service is operating. A successful upload to only some destinations does not trigger early deletion.

• Failed or unconfirmed destinations: the original is retained for up to seven days from the server upload so you can retry the affected destination from Activity. Retrying does not extend this deadline. Destinations that already succeeded are not posted again.
• Unused uploads: a server upload that is not submitted as a publishing job, and files left by an interrupted upload, are automatically removed after 24 hours.
• Copies inside the app: after the app next synchronizes a server cleanup result, it removes the matching imported working copy. Submitted working copies also expire locally after seven days when the app next synchronizes. Unsubmitted local drafts stay until you delete them or remove the app.
• Your originals and published posts: automatic cleanup does not delete videos from your iPhone’s Photos library or from Instagram, TikTok or YouTube. It applies to XPOST’s active working storage, not copies in pre-existing device or server backups.

Minimal publishing records, such as the title, caption, destination, status, dates and platform post identifiers, remain available as publishing history; deleting a video file does not delete those records or connected-account credentials. Disconnecting removes the stored account credentials. Rights concerning these other records are explained below.

Support correspondence is kept for as long as necessary to resolve the enquiry and meet legal obligations. We limit retention and access to the purpose involved. No storage or transmission method can guarantee absolute security.

6. Account controls and your privacy rights

You can delete local drafts and disconnect accounts in XPOST’s Settings. You can also revoke access through the relevant platform’s account settings: Google, Instagram, or TikTok’s connected-app controls.

Automatic video cleanup works without a request. For access, correction, a copy or deletion of other server-held personal data, or to remove retained data sooner, email tobiasroy94@gmail.com with the subject “XPOST privacy request”. Identify the connected account or channel and explain your request. We may ask for reasonable information to verify that the data belongs to you. Do not send passwords or access tokens.

Deletion requests for YouTube API data are handled as soon as possible and within seven calendar days. Other privacy requests are handled within the applicable legal deadlines, normally one month. We may retain limited information where legally required and will explain any applicable exception. Deleting data held by XPOST does not delete content held by YouTube, Instagram or TikTok; use those platforms to delete published posts.

Where the GDPR applies, you may also have rights to restrict processing, object to processing based on legitimate interests, and data portability. You can complain to your local supervisory authority or Datatilsynet, the Danish Data Protection Agency. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

7. Children and changes

XPOST is intended for people aged 18 or over. If you believe a child has provided personal data through XPOST, contact us so we can investigate and remove it where appropriate.

We may update this policy as the service changes. We will publish the updated policy and date here and provide notice of material changes where required. New uses of connected-account data that require additional permission will require that permission before use.

8. Contact