Privacy Policy
Effective: [EFFECTIVE DATE] · Last updated: 26 October 2026 · Applies to vaneapp.dev, post.vaneapp.dev, studio.vaneapp.dev and the Vane API
1. Who we are
Vane is a service that schedules and publishes your posts and videos to the social networks you connect. It is made of Vane Post (text and image posts), Vane Studio (video publishing), the Vane API with its connectors (Make, Zapier, ChatGPT, Claude, WordPress) and the AI features inside them. This policy covers all of them and our websites.
The controller of your personal data is [OPERATOR NAME], [OPERATOR ADDRESS] ([REGISTRATION / VAT NUMBER, if any]), referred to as “Vane”, “we” or “us”. You can reach us at the contact form.
2. The short version
- We collect what is needed to run your account and to publish what you schedule, and nothing for advertising.
- Your social network sign-ins are stored encrypted. API keys and sessions are stored only as hashes. Passwords are stored only as salted hashes.
- We ask each network for the smallest permission that lets us publish for you. We do not read your feed, messages, followers or connections.
- We do not sell your data, do not share it for advertising, and do not use your content to train AI models.
- You can disconnect any network, revoke any key, delete any post, and ask us to delete everything. See your rights and data deletion.
3. What we collect
Information you give us
- Account: email address, an optional name, your time zone and a salted hash of your password. We also email you one-time codes to confirm sign-up and new sign-ins. If you sign in with GitHub or Google, we receive your name, your verified email address and the provider’s id for your account, and nothing else (no repositories, contacts, files or mail).
- Content: the text, pictures, videos, thumbnails and drafts you write or upload, the time you chose to publish, and the results (sent, failed, the link to the published post). We also keep what you save on purpose: up to 5 unfinished drafts and your snippets (reusable texts; 5 on the Free Trial, up to 100 on paid plans).
- AI history: the last 10 answers of the post and week-plan generators, each with the idea you typed to get it. You can pin up to 4 of them and delete any of them.
- Email preferences: if you use the unsubscribe link in one of our emails, we keep your email address on a list so that we do not write to you again.
- Connected accounts: a sign-in token or app password for each network you connect, kept encrypted, plus the public name, handle or id of the account so you can tell them apart.
- API keys and webhooks: the name you give a key, its last four characters and a hash of it (never the key itself); the address of each webhook and its signing secret, kept encrypted.
- Billing: your plan and its status, payment references and amounts. Card numbers are entered on our payment provider’s page and never reach us. For on-chain payments we see the public wallet address and transaction id.
- Messages: what you write to us through the contact form or by email (your name, email address and message), and your email if you join the waitlist. The contact form also records your IP address to stop abuse.
Information collected automatically
- Security records: for sign-in and sign-up attempts, the time, result, email entered, IP address, approximate location (country, city), network (ASN) and browser details. We also keep short-lived counters per IP address to stop floods, scanning and password guessing, and we may block addresses that abuse the service.
- Usage: counters of posts, API calls and AI credits used against your plan, and a log of what the service did for you (for example “post sent to LinkedIn”).
- Website analytics (our own, no third parties): pages opened, time on page, referring site, campaign tag, device type, approximate location, and a salted hash of your IP address (not the address). It is switched off when your browser sends Do Not Track or Global Privacy Control. When you sign up we also keep where you first came from (referrer and landing page).
Information from the networks you connect
Only what the permission you grant allows. For example: LinkedIn gives us your name and member id; Threads your username and id; Bluesky your handle; Mastodon your account on your server; Telegram the channel or group where our bot is an administrator; YouTube the channel you upload to; and, when available, TikTok and Instagram the account you publish to. Each network also tells us whether a post was accepted, and its id or link.
4. How we use it, and why we may
If you are in the European Economic Area, the UK or Switzerland, the legal bases are in brackets.
- To run the service: create your account, publish at the times you chose, store your media, apply your plan’s limits, send you sign-in codes and service messages. (Contract.)
- To take payment and keep records: process subscriptions and usage charges, prevent fraud, meet tax and accounting duties. (Contract; legal obligation.)
- To keep content within our rules: text, pictures and a few frames of videos are checked automatically for obscene language, adult (18+) material and graphic violence before they are published, and what fails is refused. (Legitimate interests in keeping the service lawful and safe; contract.)
- To keep Vane safe: detect bots, abuse, password guessing and scanning, enforce our Terms, and investigate incidents. (Legitimate interests in securing the service and our users.)
- To improve Vane: understand, in aggregate, which pages and features are used. (Legitimate interests; you can opt out with Do Not Track or Global Privacy Control.)
- To answer you and give support. (Contract; legitimate interests.)
- To comply with the law and respond to valid legal requests. (Legal obligation.)
We do not make decisions about you that have legal effects by automated means, and we do not build advertising profiles.
5. Social networks and Google / YouTube data
Data we receive from a network is used only to provide the publishing features you asked for, to show you which account is connected, and to keep the connection working. We do not use it for advertising, we do not sell or rent it, we do not use it to train AI models, and humans at Vane do not read it except where you ask for support, where it is needed to investigate abuse or a security problem, or where the law requires it.
| Network | Permission we ask for | What it lets Vane do |
|---|---|---|
| openid, profile, w_member_social | Learn your name and member id; create posts on your own profile when you schedule them. | |
| Threads | threads_basic, threads_content_publish | Learn your username; publish the posts you schedule. |
| YouTube | upload videos to your channel | Upload and publish the videos you send to Vane Studio, with their titles, descriptions, tags and thumbnails. |
| TikTok, Instagram | content publishing (Business / Creator accounts for Instagram) | Publish the videos you send to Vane Studio. |
| Bluesky | an app password you create | Publish your posts. Use a dedicated app password and revoke it any time. |
| Mastodon | read account, write posts, upload media | Publish your posts and pictures on your server. |
| X, Telegram | an authorization or a bot you add | Publish to the account, channel or group you choose. |
You can withdraw access at any time: remove the channel in Vane (this wipes the saved sign-in and cancels posts still waiting for it), or remove Vane in the network’s own settings. For Threads, Meta then tells us and we delete that connection; for LinkedIn use Settings & Privacy → Data privacy → Permitted services; for Google use myaccount.google.com/permissions.
Google API Services. Vane’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. By using Vane Studio’s YouTube features you also agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.
6. AI features
When you use an AI feature (hashtags, clean-up, re-formatting, post and idea generation, tone, hooks, video scripts and metadata), the text you submit and your instruction are sent to the AI model running on our infrastructure provider, Cloudflare Workers AI, to produce the answer. The model is chosen by the language of your text: Cloudflare Workers AI runs open models from providers such as Meta and Google on its own infrastructure. We keep a count of the credits you use, and the last 10 post and week-plan answers with the idea behind them so that you can find them again (see section 3); we do not keep your prompts for any other purpose. We do not use your content to train or fine-tune models, and we do not send it to AI providers other than the ones listed in section 8. AI output can be wrong or unsuitable: you review it before anything is published.
7. API, webhooks and connectors
If you connect Make, Zapier, a custom GPT, Claude (MCP), the WordPress plugin or your own scripts with a Vane API key, those services send requests to Vane on your behalf and receive what the API returns (your channel list, post status, the posts they create). Their handling of data is governed by their own policies; revoke the key in Vane to cut the connection. If you add a webhook, Vane sends the events you chose (for example that a post was published or failed) to the address you gave, signed so you can verify them; you are responsible for that endpoint and for what it does with the data.
8. Who we share it with
We share personal data only with the providers below, who process it for us, with the networks you told us to publish to, and as described at the end of this section.
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting, database, file storage, content delivery, bot protection (Turnstile) and AI models (Workers AI) | Everything you store with us; request details such as your IP address; text you send to AI features |
| Resend | Sending our emails: sign-in codes, payment receipts, and delivering contact-form messages to us. Emails to you carry an unsubscribe link; sign-in codes are always sent because you need them to log in | Your email address and the message |
| GitHub, Google | Only if you choose “Sign in with GitHub / Google”: they confirm who you are | Your name, verified email address and account id, received from them; we send them nothing about you |
| Payment providers | Taking payment. At launch: monobank acquiring for cards, Apple Pay and Google Pay; and direct on-chain payments in stablecoins, checked through a blockchain node provider. We may add or replace providers (for example a merchant of record) and will update this list. | Order reference, plan and amount; for on-chain payments the public wallet address and transaction id. Card details stay with the card provider. |
| OpenAI | Only if enabled: an automatic check of pictures (and a few frames of videos) you upload or link, to refuse adult (18+) and graphically violent content. Otherwise the same check runs on Cloudflare Workers AI | The picture or the video frames, for the check only; no name, email or account id |
| proxycheck.io | Optional check of whether an address is a proxy or VPN at sign-in and sign-up | The IP address |
| The networks you connect | Publishing what you scheduled | Your content and the identifiers needed to post it |
We may also disclose data (a) to authorities when we are legally required to, or to protect rights, safety and the security of Vane and its users; (b) to professional advisers under confidentiality; and (c) to a successor if Vane is merged, sold or reorganized, in which case this policy continues to apply to your data unless you are told otherwise. We do not sell personal data and do not share it for cross-context behavioral advertising.
9. International transfers
Vane runs on a global network, and we and our providers process data in several countries, including Ukraine and the United States. When personal data leaves the EEA, the UK or Switzerland we rely on an adequacy decision or on standard contractual clauses (and, where a provider is certified, the EU–US Data Privacy Framework), together with the technical measures in section 11.
10. How long we keep it
| Data | Kept |
|---|---|
| Account and settings | Until you delete the account |
| Posts, drafts, media, videos, thumbnails | Until you delete them or the account is closed. Posts still waiting for a channel are cancelled when you remove it. |
| Connected-account sign-ins | Until you disconnect, revoke, or remove Vane in the network (then they are wiped) |
| API keys, webhooks | Until you revoke or delete them |
| Drafts and snippets | Drafts: the last 5, the oldest is removed when a sixth is saved. Snippets: until you delete them. Both go when you delete the account. |
| AI history | The last 10 answers; the oldest unpinned one is removed when a new one arrives. Pinned answers (up to 4) until you unpin or delete them. |
| Email unsubscribe list | Your email address, until you subscribe again or ask us to remove it. It stays after the account is deleted so that we respect your choice. |
| Sign-in sessions | Up to 30 days, or until you sign out |
| Email codes | They expire after 10 minutes and are removed soon after |
| Sign-in and sign-up attempt records | 90 days |
| Website analytics | 180 days |
| IP reputation lookups | 7 days |
| Webhook delivery records | 7 days |
| Unfinished video uploads | 24 hours |
| Billing and tax records | [BILLING RECORDS RETENTION, as required by tax law] |
| Backups | Removed on a rolling basis within 30 days |
| Contact-form messages | Until your question is answered, and for up to 12 months after that |
| Waitlist email | Until we have told you about the launch, or until you ask us to remove it |
Where the law requires us to keep something longer (for example for a legal claim or an audit), we keep only what is necessary and only for that purpose.
11. How we protect it
- Everything travels over HTTPS. Social network tokens and webhook secrets are encrypted at rest with AES-256-GCM.
- API keys are shown to you once and stored only as SHA-256 hashes; passwords are stored as salted hashes; sign-in sessions are stored as hashes and sent in a secure, HttpOnly cookie.
- The API is protected by bot detection, per-address and per-key rate limits, automatic blocking of abusive addresses, and signature checks on calls from payment providers and social networks.
- Database queries are parameterized, production secrets are kept in a secrets store and never logged, and access to administration is restricted and logged.
No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities where the law requires, without undue delay.
12. Cookies and similar storage
| Name | Purpose | Lifetime |
|---|---|---|
| vane_session (cookie) | Keeps you signed in across our sites. Strictly necessary; HttpOnly. | Up to 30 days |
| vane_oauth (cookie) | Protects “Sign in with GitHub / Google” from forged returns. Strictly necessary; HttpOnly; set only while you sign in. | 10 minutes |
| vane_age, vane_minor (cookies) | Age check at sign-up. vane_age lets a new GitHub / Google sign-up continue after you entered a date of birth that is old enough; vane_minor stops a repeat attempt after one that was not. Strictly necessary; HttpOnly; they never contain the date. | 30 minutes / 1 day |
| Cloudflare Turnstile | Bot check on sign-in and sign-up; strictly necessary for security. | Session / short |
| vane_vid, vane_sid (browser storage) | Anonymous browser and visit ids for our own analytics. Not used when Do Not Track or Global Privacy Control is on. | Browser id until cleared; visit id 30 minutes |
| vane:draft, vane:emoji and similar (browser storage) | Remembers an unsent draft, recent emoji and an interrupted video upload on your device. Never sent to us until you submit. | Until you clear it, the draft until you schedule or sign out |
We use no advertising or third-party tracking cookies.
13. Your rights and choices
Depending on where you live (including under the GDPR and the UK GDPR) you can ask us to: give you access to your data and a copy of it; correct it; delete it; restrict or object to some uses; and move it to another service. Where we rely on consent you can withdraw it at any time. You also have the right to complain to your data protection authority.
- Yourself, in the dashboard: remove channels, revoke API keys and webhooks, delete posts, videos and public links.
- By email: write to the contact form from the address of your account. To protect you we may ask you to confirm your identity. We answer within 30 days, and tell you if we need more time or cannot do what you ask and why.
- Delete everything: see Data deletion.
14. Notes for US residents
In the last 12 months we collected the categories described in section 3 (identifiers, account and commercial information, internet activity, approximate location, and content you provide) for the business purposes in section 4. We do not sell personal information and do not share it for cross-context behavioral advertising. Residents of states with privacy laws can ask us to tell them what we hold, to delete or correct it, and can appeal a refusal by writing to the contact form. We will not treat you differently for exercising these rights.
15. Children
Vane is not meant for anyone under 16, and we do not knowingly collect their data. When you create an account we ask for your date of birth and refuse the sign-up if you are under 16. We use the date only for that check and do not store it; we keep just a note that you confirmed you are old enough, and the day you did. If you think a child has given us personal data, write to the contact form and we will delete it.
16. Changes to this policy
When this policy changes in a way that matters, we will tell you in the dashboard or by email before the change takes effect. The date at the top shows the current version.
17. Contact
[OPERATOR NAME]
[OPERATOR ADDRESS]
Email: the contact form