Privacy Policy

Last updated 11 November 2026

Toucanpost lets you write a post once and publish it to the social accounts you connect, on a schedule, and read back how it did. This page says what data that takes, what we do with it, and how to get it back or have it deleted.

Who is responsible

Toucanpost is run by the operator of Toucanpost, which is the controller of the personal data described here. For anything about your data, write to the contact given in your account emails.

What we collect

• Your account: name, email address and a hash of your password (never the password itself). If you use them: your passkeys' public keys, and your authenticator secret, stored encrypted.
• Sign-in and security records: the IP address and browser of each sign-in, the devices you are signed in on, and a log of security-relevant actions (signing in, changing a password, connecting an account, creating an API key, team and billing changes).
• What you create: posts, drafts, schedules, images and videos you upload, replies you send, and workspace settings. Location and camera details embedded in images are removed when you upload them.
• Connected social accounts: the account's name, picture and identifier, and the access tokens the network issues so we can publish for you. Tokens are encrypted and never shown to anyone, you included.
• What the networks send back: for posts published through Toucanpost, their statistics (likes, comments, shares, views) and the comments left under them, with the commenter's public name, handle and, where the network provides it, follower count. Where you use them: posts that mention your account, and the latest message of each direct-message conversation with it, with the other person's name and handle.
• Billing: your plan, subscription status and a customer reference. Card details go straight to our payment provider, Stripe; we never receive them.
• Team: the email addresses of people you invite, and each member's role.

We set only the cookies needed to keep you signed in and to complete a sign-in. There are no advertising or analytics cookies and no third-party trackers.

What we use it for

• To provide the service: publishing, scheduling, statistics, the comment inbox, the API and team features.
• To keep accounts secure and to investigate misuse.
• To charge for paid plans and meet accounting obligations.
• To send messages the service needs: confirming your email, password resets, invitations, and notices about posts waiting for approval and a weekly summary, both of which you can turn off in Settings.

We do not sell personal data, do not use it for advertising, and do not use your content to train AI models. Where EU law applies, we rely on our contract with you for the first, third and fourth purposes, and on our legitimate interest in a secure service for the second.

Data from social networks

You decide which accounts to connect: Instagram, Facebook Pages, Threads, TikTok, YouTube, LinkedIn, X, Pinterest and Bluesky. Each network shows you the permissions we ask for before you agree. We use what a network gives us only to do what you ask in Toucanpost: publish your posts, show their statistics, and show and answer comments. We do not combine it with data from other sources, build profiles of the people who comment, or pass it to anyone except the providers listed below acting on our instructions.

Disconnecting an account on the Accounts page deletes its tokens from our systems at once. You can also withdraw access on the network's side at any time, in its settings for connected apps (for Google and YouTube: myaccount.google.com/permissions).

Toucanpost uses YouTube API Services to upload videos and read their statistics and comments. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

AI features

When you ask for an AI draft, a reworded post or a suggested reply, the text involved (your post, or the comment you are answering) is sent to our AI provider, Anthropic, to produce the suggestion. Nothing is sent unless you use one of these features, and nothing is published without your review. If your workspace uses its own Anthropic API key, those requests are made under your own agreement with Anthropic.

Who processes data for us

• Hosting, database and file storage providers, which hold the data on our behalf.
• Stripe, for payments.
• Our email delivery provider, for the messages described above.
• Anthropic, for AI features, only when you use them.
• Our error monitoring provider, which receives a technical report when something in the app fails: the error, where in our code it happened and on which page. Reports do not include your content, your address or who you are.
• The social networks you connect, to which we send the posts and replies you choose to publish.

Some of these providers are outside the European Economic Area. Where personal data is transferred there, it is covered by safeguards recognised under EU law, such as the standard contractual clauses. Ask us at the contact given in your account emails for the current list of providers.

How long we keep it

We keep your data for as long as your account exists. Entries in the activity log (sign-ins, team and settings changes) are deleted after one year. When you delete your account, it and every workspace you own are removed from our live systems immediately; copies in backups disappear as those backups expire. Invoices and payment records are kept for as long as tax law requires.

Your rights

You can see, correct, export and delete your data, object to how we use it, and withdraw any consent you gave. Most of this you can do yourself:

• A copy of your data: Security → Your data → Download my data gives you everything we hold about you in one file.
• Deletion: see the next section.
• Anything else: write to the contact given in your account emails. We answer within one month.

If you believe we have handled your data unlawfully, you may complain to the data protection authority where you live.

Deleting your data

You can delete everything yourself, at any time, without contacting us:

• Your whole account: sign in, open Security, and choose “Delete my account”. This removes your account, every workspace you own, its posts, uploads, comments, connected accounts and keys, and cancels any subscription. It takes effect immediately and cannot be undone.
• One connected social account: open Accounts and disconnect it. Its tokens are deleted at once. To also remove what was collected from it, delete the posts published to it, or the whole account as above.
• If you cannot sign in, or you are someone whose comment appears in a Toucanpost user's inbox and want it removed: write to the contact given in your account emails from the address concerned, or with the link to the comment, and we will delete it within 30 days.

Posts already published stay on the social networks until you delete them there.

Children

Toucanpost is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will tell account holders by email before the change takes effect. The date at the top shows the latest version.