Privacy Policy
PolyPost is a social media management tool for marketing teams, operated by Matchbox Studio LLC ("we", "us"). This policy explains what information PolyPost collects, how we use it, who we share it with, and the choices you have. It covers the PolyPost web application and the emails it sends.
Whose information this covers
PolyPost handles information about three groups of people:
- People with a PolyPost account — members of a workspace. For your account information, we decide how it's used, and this policy applies directly to you.
- People invited to a workspace — we store your email address and the role you were invited with so the invitation can be sent and accepted.
- People who interact with a customer's social accounts — for example, someone who comments on a company's Instagram post. When that company connects its account, PolyPost stores those comments so its team can read and reply to them. We process that information on the company's behalf and under its instructions; to ask about it, contact the company, or us at the address below.
Information we collect
Information you give us
- Account details: your name, email address, and password. Passwords are stored only as a one-way hash; we never see or store the password itself.
- Workspace details: your organization's name, industry, approximate team size, time zone, and logo, and each member's role (Admin, Editor, or Support).
- Content you create: posts and captions (including per-platform versions), images and video you upload, scheduled times, approval requests and notes, the accounts and places you tag in a post, who a post is assigned to and any note left for them, and replies you write to comments and messages.
- Invitations: the email address and role of anyone you invite.
Information from social platforms you connect
When someone in your workspace connects a social account, you choose which permissions to grant on that platform's own authorization screen. PolyPost uses them only to provide the features below, and stores:
- Account and page identity: names and identifiers of the accounts, Pages, organization pages, and channels you connect, and their follower counts over time.
- Access tokens: the credentials that let PolyPost act on your behalf. These are encrypted before they're stored.
- What you publish: the platform's identifier for each post PolyPost publishes, so we can show its status and results.
- Performance metrics: figures such as reach, views, clicks, and engagement for posts published through PolyPost, and daily figures for each connected account, such as followers gained and lost and profile views.
- Audience summaries: where a platform provides them, totals describing a connected account's audience by country, city, age range, and gender. These are aggregate counts supplied by the platform; they don't identify any individual follower.
- Comments, mentions, and messages sent to your connected accounts: the sender's public name and profile image address, the message text, and links to any photos or files attached to it.
| Platform | What PolyPost can do with the permissions you grant |
|---|---|
| List the Pages you manage; publish posts, videos, Reels and Stories to them; read and reply to comments on them and posts that mention them; read and reply to Messenger messages sent to them; read engagement; and receive updates about activity on them. | |
| Read basic information about your professional account; publish posts, Reels and Stories; read and reply to comments, direct messages, and posts or stories that mention the account; and read insights. | |
| Read your basic profile; publish posts as you; and, for organization pages you administer, publish and manage posts, read and reply to comments on them and posts that mention them, and read their statistics and follower counts. | |
| TikTok | Read basic profile information and your follower count, and upload and publish videos. |
| X | Read your basic profile, read and publish posts, and stay connected without asking you to sign in again. |
| YouTube | Upload videos, read channel information, read and manage comments, and read YouTube Analytics. |
Information collected automatically
- Server logs: your IP address, browser type, and the pages you request. We use these to keep PolyPost secure — for example, by limiting repeated sign-in attempts — and to fix problems.
- Cookies: PolyPost uses only the cookies it needs to work: one that keeps you signed in during a visit, and, if you tick "Remember me," one that keeps you signed in for up to two weeks. We don't use advertising cookies, analytics cookies, or third-party tracking scripts.
Billing information
If your organization subscribes to a paid plan, payment is handled by Stripe. Your card details go directly to Stripe and never reach our servers; we store only your plan, billing interval, and subscription status.
How we use information
- To provide PolyPost: publishing and scheduling posts, showing your unified inbox, sending your replies, and reporting on performance.
- To send the emails the service depends on: invitations, password resets, account confirmation, and the notifications and weekly digests you choose in Settings.
- To keep PolyPost secure and prevent abuse.
- To handle billing, answer support requests, and meet legal obligations.
We don't sell personal information. We don't use it for advertising. We don't use your content, or information from your connected platforms, to train artificial intelligence models.
How we share information
- Within your workspace: other members can see the workspace's content, according to their role.
- With social platforms, when you ask us to: publishing a post or sending a reply sends that content to the platform you chose.
- With service providers that run PolyPost on our behalf, under contracts that limit their use of it:
- Render — application hosting and databases
- Cloudflare — storage for uploaded images and video
- Resend — email delivery
- Stripe — payment processing, if you subscribe to a paid plan
- When required by law, or to protect the rights and safety of our users and the public.
- In a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your information.
Google and YouTube
PolyPost uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service, and Google's use of your information is governed by the Google Privacy Policy.
PolyPost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke PolyPost's access to your Google account at any time from Google's security settings page, in addition to disconnecting YouTube inside PolyPost.
How long we keep information
- Your account is kept for as long as it exists.
- Workspace content is kept until the workspace is deleted. Deleting a workspace permanently deletes its posts, uploaded media, connected accounts and their access tokens, inbox conversations, notifications, and pending invitations.
- Disconnecting a platform immediately deletes the access tokens for that account and its Pages. Posts and conversations already in the workspace stay until you delete them or the workspace.
- Activity records — a log of security-sensitive changes such as role changes, invitations, connected accounts, and plan changes — are kept for 2 years, then deleted automatically. They stay for that period even after a workspace is deleted, for security and legal purposes, and include the names of the people involved and what changed.
- Server logs and backups are kept for a limited period, then deleted automatically.
Your rights and choices
- Get a copy of your data: choose "Export my data" from the profile menu to download your information as a file.
- Disconnect a platform: any Admin or Editor can do this from Settings ▸ Connected accounts. You can also remove PolyPost's access from the platform's own settings.
- Delete a workspace: an Admin can do this from Settings ▸ Workspace.
- Delete your account, or correct your name or email: email us at avery@matchboxstudio.xyz. You can reset your password yourself from the sign-in page.
- Choose which emails you get: Settings ▸ Notifications.
Depending on where you live, you may have further rights, such as to access, correct, delete, or object to how we use your information. To use any of them, email avery@matchboxstudio.xyz. We'll respond within 30 days. See our data deletion instructions for step-by-step details.
Security
All traffic to PolyPost is encrypted in transit. Access tokens for your connected accounts are encrypted before they're stored, and passwords are stored only as a one-way hash. Access within a workspace is limited by role, repeated sign-in attempts are rate-limited, and security-sensitive changes are logged. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires it.
Where information is processed
PolyPost and its service providers process information in the United States. If you use PolyPost from elsewhere, your information will be transferred to and processed in the United States.
Children
PolyPost is a business tool and isn't intended for anyone under 16. We don't knowingly collect information from children.
Changes to this policy
If we change this policy, we'll update the effective date above. If a change is significant, we'll let workspace members know by email or in PolyPost before it takes effect.
Contact
Questions or requests about this policy or your information: avery@matchboxstudio.xyz. PolyPost is operated by Matchbox Studio LLC.