Privacy Policy

• Account details: your name, email address and a one-way hash of your password. We never store your password itself.
• Your content profile: the role, audience, goals, topics, tone and writing sample you give us during onboarding or in settings.
• Content you create: drafts, scheduled posts, images you upload or generate, and a history of what you published.
• Connected platforms: an access token for each account you connect, which is what lets us publish on your behalf, alongside the profile details that platform gives us:
  • LinkedIn: your name, email address, profile picture and member ID.
  • Instagram: your professional account's ID, username, display name, account type (business or creator), the permissions you granted and how much of Instagram's daily publishing limit you have used. For posts you publish through Digital Persona, we also read their link, their like and comment counts and, if you allow post insights, their reach, views, shares and saves, so you can see how they did. We read nothing else from your Instagram account — not your followers, posts you made elsewhere, your messages or what people write in comments.
  • Facebook: your Facebook name and app-scoped ID, the names, categories and IDs of the Pages you choose to connect, your role on each (to know whether you can publish there), their access tokens and the permissions you granted. We use this only to publish, schedule and confirm posts to those Pages, and to add the first comment you write. For posts you publish through Digital Persona, we read their link and their reaction, comment and share counts. If a publish attempt fails on a network error, we compare it with your Page's latest few posts so it isn't published twice; we don't keep them. We never post to your personal profile, and we read nothing else — not your friends, your personal posts, your messages, what people write in comments or your Pages' followers.
• Your AI provider API key, if you choose to add one.
• Usage records: how many AI generations you have used, and technical data needed to keep the service secure, such as sign-in sessions, IP address and browser details used for rate limiting.
• Messages and waitlists: what you send through the contact form, and the email you leave to hear about new platforms.

We don't use advertising trackers or third-party analytics, and we don't sell your data.

• To run your account: sign-in, email verification and password resets.
• To generate drafts and images in your voice, based on your profile and the topics you choose.
• To publish, schedule and (only if you turn it on) auto-draft posts to the platforms you connect.
• To show you how your published posts did, and which topics and formats to do more of.
• To enforce free-generation limits and protect the service from abuse.
• To answer your messages and tell you when a platform you asked about launches.

Data we receive from Instagram and Facebook is used only to provide these features to you. We don't sell it, share it with advertisers or data brokers, use it for advertising, or use it to train AI models.

We rely on a small number of providers, each receiving only what it needs:

• Neon hosts our database, where your account and content are stored.
• Vercel hosts the application.
• Resend delivers account emails such as verification and password-reset links.
• Your chosen AI provider generates text — OpenAI, Anthropic, Google, Groq, OpenRouter, xAI, Mistral, DeepSeek or Cerebras. Your prompts, which include your profile details and topics, are sent to that provider, using either our key or yours. When you ask for an insights report, the results of your own posts go too: totals and averages by platform, format and weekday, and the first line, topic and score of your best posts. The lessons you choose to keep from a report are added to later prompts. Nothing about other people's accounts is sent.
• Cloudflare Workers AI generates AI images from a short description of your post, with Pollinations as a fallback when it is unavailable.
• Bing News is searched with your topics to find articles you can share.
• LinkedIn, Instagram and Facebook receive the posts you publish to them, and each platform's own privacy policy applies to them there. Publishing to Instagram means Meta downloads the images or video for that post from a temporary link on our servers; the link names one file, expires within hours, and gives access to nothing else. Publishing to Facebook uploads the post's photos or video to Meta directly.

• Passwords are stored only as salted one-way hashes, and repeated failed sign-ins are slowed down.
• Platform access tokens and AI provider API keys are encrypted at rest with AES-256-GCM.
• Your drafts, images and history are only visible to your account.
• Connections to the service are encrypted in transit (HTTPS).

We keep your data while your account is open. Autopilot drafts you don't approve in time are cancelled once their publishing time passes. Post results are read for about six weeks after a post is published, and kept with your publish history after that.

Contact messages and waitlist sign-ups are kept, unlinked from your account, until they are no longer needed; ask us to delete them any time. Encrypted database backups kept by our hosting provider expire on their own schedule.

You can delete your data yourself, in any of these ways:

• Disconnect a platform in Settings. This deletes the stored token and, where the platform offers a way to, revokes it there too. Instagram doesn't, so remove the app in Instagram as well.
• Remove Digital Persona in the platform's own settings: under “Apps and websites” in Instagram, or “Business integrations” in Facebook. The platform tells us, and we erase the connection straight away.
• Ask Instagram or Facebook to delete your data from the same place. We erase the connection and the results we read for your posts on that platform straight away, and the platform shows you a confirmation code and a status page.
• Delete your account (Settings → Account). This deletes your profile, drafts, images, queue, publish history, post results, stored tokens and API key from our database, and revokes platform access.

Posts already published stay on the platform until you remove them there. If you can't sign in any more, contact us and we will delete your data for you.

You can view and change your profile and settings at any time, remove your AI provider key, disconnect platforms and delete your account yourself. Depending on where you live, you may also have the right to request a copy of your data, correct it, restrict or object to how it is used, or complain to a data-protection authority.

To make a request, contact us from the email on your account.

Digital Persona is not intended for anyone under 16, and we don't knowingly collect their data.

If we change how we handle your data, we will update this page and its date. For significant changes, we will also tell you by email or in the app before they take effect.

Questions about privacy? Send us a message.