Privacy Policy

1. Overview

Content Mill publishes posts to the social media accounts you connect. To do that we handle your account details, the posts and media you create, and billing information. We don’t sell your information, we don’t run advertising, and we don’t use your posts or media to train AI models.

2. What we collect

Account information

Your email address, an optional display name and profile photo, and a hashed password. If you sign in with Google, we receive your Google account ID, email address and name from Google. We also record when you joined, and whether you have confirmed your email address. To confirm an address or reset a password we email you a single-use link; we keep only a one-way hash of its token, and the link expires. We also email you a welcome, a few reminders to get started (connect an account, schedule a first post, when an account’s scheduled posts are about to run out or it has gone quiet) and a notice if a post fails to publish. You can turn the reminders off in Settings or from the link in each one, and we keep a record of which emails we’ve sent so we don’t repeat them.

Connected social accounts

For each account you connect: the platform, its account identifier, its display name and when you connected it. The access tokens for these accounts are held by the third-party publishing service we use, not stored by us. If you connect Bluesky, the app password you enter is passed to that service and is not stored by us.

Posts and media

The text of your posts and drafts, media you upload or link, an optional internal label, your schedule, the result on each platform (including any error message), and the link to each published post. For uploaded media we also record its size, dimensions and, for video, length. Uploaded media is stored at a public web address so that social platforms can fetch it; anyone with the link can view it.

Posts on your connected accounts

So you can browse an account’s posts in the app, we keep a copy of the posts that already exist on it, including ones you made outside Content Mill: the caption, the links to its photos and videos, the link to the post, and when it was published. We refresh this copy in the background every few hours, and when you press Refresh. When you open a post, we also ask the platform for its numbers (likes, comments and so on). We keep this copy until you delete your account.

Billing and usage

Your plan, subscription status and billing period, and a ledger of your credits (used, refunded and granted). Payment details are collected and processed by our payment processor, Polar; we don’t store your card number. We receive your subscription status and payment records from them.

AI assistant connections

If you connect an AI assistant, we record the connection (the assistant’s name and identifier, and hashed sign-in tokens) and a record of every call it makes: which tool, when, the details it sent (which can include the text of a post), and the outcome.

Technical data

Standard server logs, such as IP address, device and browser details and the pages or endpoints requested. A few things are kept only briefly, for up to ten minutes: post previews and one-time upload slots created by an assistant, and a cached check of whether a connected account is working.

3. How we use it

• To run the Service: sign you in, publish and schedule your posts, and show you the results.
• To charge for your plan, manage trials and track your credits.
• To let an AI assistant you connect act within what the Service allows, and to keep a record of what it did.
• To give support, keep the Service secure, prevent abuse and fix problems.
• To meet legal obligations.

4. Who we share it with

• The social platforms you choose. When you publish, the post and its media are sent to each platform you selected. What they do with it is covered by their own policies.
• Our publishing service. A third-party service connects to your social accounts and sends your posts on our behalf. It receives your post content and holds the access tokens for the accounts you connect. We can tell you which one on request.
• Our payment processor, Polar, which handles your payment details and subscription.
• An email delivery service that sends our confirmation and password-reset emails. It receives your email address and the message for the time it takes to deliver it.
• Google, if you sign in with it. Google’s sign-in script loads on the sign-in pages when that option is on.
• Hosting and storage providers that run our servers, database and file storage and deliver your uploaded media.
• AI assistants you connect (section 5).
• Legal and safety reasons: if the law requires it, or to protect the rights, safety or property of Content Mill, our users or others.

5. AI assistants

An AI assistant is connected only when you sign in and approve it. Once connected, it can see what Content Mill’s tools return to it: your connected accounts, credit balance, posts and results. That information then goes to the company that runs the assistant, under its own privacy policy, not ours. We don’t send your information to any AI provider on our own initiative.

We keep a record of the calls an assistant makes (section 2). To have an assistant’s access revoked, contact us (section 13).

6. Retention and deletion

We keep your information while your account is active. Deleting a post or disconnecting a social account hides it from you, but we may keep the record. Deleting your account in Settings deactivates it and signs you out; it doesn’t automatically erase your data. To have your data fully deleted, contact us. We may keep what we must keep for legal, accounting or security reasons.

Media you uploaded stays available at its public address until we remove it. Asking us to delete your data includes your uploaded media.

7. Security

We use reasonable technical and organizational measures to protect your information. Passwords and assistant sign-in tokens are stored as one-way hashes, and the access tokens for your social accounts are held by our publishing service rather than in our database. No system is completely secure, and we can’t guarantee absolute security. Keep your password private and connect only assistants you trust.

8. Your choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to or restrict some processing. You can change your display name and photo, or deactivate your account, in Settings. We don’t have self-service tools for the rest yet, so to exercise any of these rights, email [email protected]. We may need to verify that the request comes from you, and we will respond within a reasonable time.

9. Cookies and storage

We use two cookies that keep you signed in, and your browser’s local storage to remember your theme and whether the sidebar is collapsed. We use Google Analytics to understand how the website is used (pages visited, device and approximate location); it sets its own cookies and sends that usage data to Google. We don’t use advertising cookies. If Google sign-in is on, Google may set its own cookies on the sign-in pages.

10. Children

The Service isn’t directed at children. You must be at least 18, or the age of legal majority where you live, to use it, and we don’t knowingly collect information from children.

11. International transfers

We and our providers may process and store information in countries other than your own. Where the law requires it, we rely on appropriate safeguards for those transfers.

12. Changes

We may update this policy. When we make a material change we will update the date at the top and, where we reasonably can, tell you in the app or by email.

13. Contact

Questions or privacy requests: [email protected].