Privacy Policy

Last updated: 2026-09-22

This policy describes how Voronin Anton Vladislavovich, Individual Entrepreneur (“we”, “the operator”) handles data in the self-hosted publishing tool available at https://mass-posting.ru (“the Service”).

1. What the Service is

The Service is a private, single-operator tool. It is not a consumer product: there is no public sign-up, no user accounts other than the operator’s own, and no way for a third party to create an account. The operator uses it to schedule and publish their own video content to social media accounts that the operator owns or is authorised to manage, and to read back performance statistics for those same posts.

2. What data we process

Data	Why	Source
OAuth access and refresh tokens	To publish on the connected account and read its statistics	Issued by the platform when the operator connects an account
Account identifiers and public profile details (channel ID, username, display name, avatar)	To show which account a post belongs to	Platform API
Video files, thumbnails, titles, descriptions and hashtags	The content being published	Uploaded by the operator
Aggregate post statistics (views, likes, comments, shares, saves, reach, watch time)	To compare which creative performed better	Platform API, for the operator’s own posts only
Operator login password hash and, if enabled, a TOTP secret	To protect access to the panel	Set by the operator

3. What we do not process

No personal data about viewers, followers, commenters or any other end user. The Service reads aggregate counts only, never individual-level audience data.
No data from accounts the operator has not personally connected.
No scraping. All platform data is obtained through official APIs with the operator’s authorisation.
No social media passwords. Authentication is by OAuth; credentials are entered on the platform’s own login page and are never seen by the Service.

4. Google user data — Limited Use

The Service’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through YouTube Data API and YouTube Analytics API is used solely to provide the publishing and reporting features described above; it is not transferred to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; and no human reads it except the operator themselves, or where required for security or legal reasons.

By using the YouTube integration the operator is also bound by the YouTube Terms of Service. Google account permissions can be revoked at any time via the Google security settings page.

5. Third parties

The Service shares data with the following processors, and no others:

The publishing platforms themselves (YouTube/Google, TikTok, Instagram/Meta) — receive the video file and its metadata, which is the point of the Service.
Anthropic — when the operator uses the caption-generation feature, the post topic and the account’s tone settings are sent to the Anthropic API to draft title and description text. No tokens, no viewer data and no video files are sent. This feature is optional and is disabled when no API key is configured.
The hosting provider of the server the operator runs the Service on.

We do not sell data, do not share it with advertisers, and do not use it to train any model.

6. Storage and security

OAuth tokens are encrypted at rest with AES-256-GCM. The key is held in the server environment, never in the database, so a database dump alone does not expose tokens.
All traffic to the panel is over HTTPS.
The panel is protected by a password and, when enabled, a TOTP second factor. There is no public registration.
Every publish action is written to an audit log.

7. Retention and deletion

Tokens are kept until the operator disconnects the account or the platform revokes them, and are deleted immediately on disconnect.
Post statistics are retained for as long as the operator keeps the corresponding post record, for historical comparison.
Uploaded video files and generated renditions are kept in the operator’s own object storage and can be deleted at any time from the panel.
See Data Deletion for how to request removal.

8. Your rights

Where the GDPR applies, the operator may request access to, correction of, export of, or erasure of data held by the Service, and may object to or restrict processing. Because the Service processes the operator’s own data on the operator’s own infrastructure, most of these are exercised directly in the panel. Requests can also be sent to antonworkmail8@gmail.com. A complaint may be lodged with the supervisory authority in Russia.

9. Children

The Service is not directed at children and is not usable by anyone other than the operator.

10. Changes

Material changes to this policy will be reflected on this page with an updated date above.

11. Contact

Voronin Anton Vladislavovich, Individual Entrepreneur
Arkhangelsk, Russia
antonworkmail8@gmail.com