Privacy policy
The short version
- Turboyap publishes and schedules posts to social accounts you connect, and reports on how those posts do.
- To do that we store your OAuth tokens (encrypted at rest), the ids and handles of your connected profiles, the media and captions you upload, your schedules, and metrics for the posts we published.
- We use data from a platform only to publish and report on your own posts. We do not sell your data, we do not use platform data for advertising, and we do not use your content or platform data to train AI models.
- Disconnecting an account deletes its tokens. Deleting a workspace deletes its data within 30 days. You can ask us to delete your data at any time by emailing [email protected]. See data deletion for step-by-step instructions.
Who we are
Turboyap is operated by [LEGAL ENTITY NAME] ("Turboyap", "we", "us"). We are the controller of the personal data described in this policy, except where we process content on behalf of a business customer, in which case that customer is the controller and we are its processor.
[LEGAL ENTITY NAME][STREET ADDRESS]
[CITY, STATE ZIP]
[COUNTRY]
Email: [email protected]
Information we collect
Information you give us
- Account and workspace details: your name, email address, workspace name, and team members you invite.
- Billing details: plan, billing contact and invoices. Card details are collected and stored by Stripe; we never see or store full card numbers.
- Content: images and other media you upload, captions, titles, hashtags, mentions, post settings (for example TikTok privacy level or inbox mode), schedules, drafts, and approval or rejection decisions with any reason you give.
- API keys: we store only a hash of each key and its prefix, never the key itself.
- Messages: emails and support requests you send us.
Information created when you use Turboyap
- Post results: for each post and each account it goes to, the publish status, the platform's post id and URL, timestamps, and any error the platform returned.
- Per-post metrics: for posts Turboyap published, the engagement numbers the platform makes available to the account owner, such as views, likes, comments and shares.
- Audit log: a record of every create, edit, approval, rejection, cancellation and publish, including whether a human or an agent did it, which API key was used, and the name of the MCP client when an agent reports one.
- Technical data: IP address, user agent, request timestamps and error reports from the API and dashboard, used for security, debugging and rate limiting.
Our website
turboyap.com is a static site. It sets no cookies and runs no analytics or advertising scripts. Our hosting provider processes standard request logs (such as IP address and user agent) to deliver the site and protect it from abuse.
Data from platforms you connect
When you connect a social account, you sign in on the platform's own authorization screen and choose to grant Turboyap specific permissions. We receive an OAuth access token (and a refresh token where the platform issues one) and basic profile information. We request only the permissions needed to publish your posts and report on them. Two platforms connect differently: for Bluesky you give us your handle and an app password you create in Bluesky, and for Telegram you add Turboyap's bot to your channel or group as an administrator. We store every token, app password and webhook encrypted.
| Platform | Permissions we request | What we access and store | Why |
|---|---|---|---|
| TikTok | user.info.basic, video.upload, video.publish | Your TikTok open id, display name and avatar URL; the status and id of posts Turboyap sends | Show which account is connected; send photo posts to your TikTok inbox or publish them directly; report publish status |
instagram_business_basic, instagram_business_content_publish | Your Instagram professional account id, username and name; the id and permalink of posts Turboyap publishes | Show which account is connected; publish images and carousels; link to the live post and report on it | |
| Bluesky (beta) | No OAuth permissions: your handle and an app password you create in Bluesky's settings, which you can revoke there at any time | Your Bluesky account id (DID), handle, display name and hosting provider; the app password and session tokens, encrypted; the id and link of posts Turboyap publishes | Show which account is connected; renew the session when it expires; publish text, image and link-card posts; link to the live post |
| Telegram (beta) | No permissions from your Telegram account: you add Turboyap's bot to your channel or group as an administrator with permission to post | The channel or group's chat id, type, title and public @username; the id and link of messages Turboyap posts | Show which channel is connected; post your messages, photos and albums; link to them |
| Discord (beta) | webhook.incoming | The id and token of the webhook Discord creates for the channel you pick, its name, and the server and channel ids; the id and link of messages Turboyap posts. We don't store the OAuth access token. | Post to the channel you chose; delete the webhook when you disconnect; link to the messages |
| Facebook, Threads, LinkedIn, X, YouTube, Pinterest (coming soon) | Only the permissions needed to identify the account or channel, publish on your behalf, and read metrics for posts Turboyap published | Account, page, channel or server id, handle and name; post ids, URLs and metrics for posts Turboyap published | The same as above. We will list the exact permissions here before each platform opens for connection. |
We do not read your private messages, followers or contacts, and we do not access content you posted outside Turboyap except where a platform requires it to show the connected account.
How we use information
- To publish, schedule, preview (dry run), retry and cancel the posts you or your agents create, and to transform media so each platform accepts it (for example converting to JPEG, resizing, padding or cropping).
- To run the approval queue and the autonomy dial: holding agent-created posts for human review when an account is set to review, and logging every action.
- To show you post status, links to live posts, and per-post metrics.
- To keep the service secure, prevent abuse and duplicate posts, enforce rate limits, and debug problems.
- To provide support, send service and billing emails, and process payments.
- To comply with the law and with the terms of the platforms we connect to.
We use data we receive from a platform's API only to publish and report on your own posts and to show you your connected accounts. We do not combine it with data from other sources to build profiles of people.
What we never do
- We do not sell, rent or trade your personal data or your content.
- We do not use data from TikTok, Meta, Google, YouTube, LinkedIn, X or any other platform for advertising, ad targeting, retargeting, or to build advertising profiles, and we do not share it with ad networks or data brokers.
- We do not use your content or any platform data to train, fine-tune or improve AI or machine-learning models, ours or anyone else's.
- We do not use platform data for surveillance, to determine credit-worthiness or eligibility for lending, insurance, housing or employment, or for any purpose unrelated to the features you use.
- We do not let people at Turboyap read your content or platform data, except when you ask us to (for example in a support request), when it is needed for security or to investigate abuse, or when the law requires it.
AI agents you connect
Turboyap lets AI agents (such as Claude Code, Cursor or your own code) create posts through our API and MCP server using an agent API key you issue. We treat content your agent sends us the same way as content you create. Agent keys cannot approve posts or change autonomy settings. The AI provider that runs your agent (for example Anthropic, OpenAI or Cursor) is not our subprocessor; what it does with your prompts and data is governed by your agreement with it and its privacy policy.
Who we share information with
- The platforms you publish to. When you schedule a post, we send its media, caption and settings to the platform you chose, under that platform's terms and privacy policy.
- People in your workspace. Members of your workspace can see its connected accounts, posts, schedules, metrics and audit log.
- Service providers (subprocessors). Companies that host and run Turboyap for us, bound by contracts that limit their use of your data to providing their service to us:
| Provider | Purpose |
|---|---|
| Cloudflare | Website hosting, content delivery, and media file storage |
| Neon | Primary database (accounts, posts, schedules, audit log) |
| Railway | Application servers for the API and publishing worker |
| Sentry | Error monitoring |
| PostHog | Product analytics on the Turboyap dashboard |
| Stripe | Billing and payment processing |
| Resend | Transactional email |
- Legal and safety. When required by law, subpoena or court order, or to protect the rights, safety and security of our users, the public or Turboyap.
- Business transfers. If Turboyap is involved in a merger, acquisition or sale of assets, data may transfer as part of that deal. We will tell you before that happens and, for data received from Google APIs or where the law or a platform's terms require it, ask for your consent first.
Google and YouTube API Services
YouTube publishing is coming soon. When you connect a YouTube channel, Turboyap uses YouTube API Services to upload and publish videos you schedule and to read the channel name, id and statistics for videos Turboyap published.
- By connecting YouTube you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
- Limited Use: Turboyap's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- You can revoke Turboyap's access to your Google account at any time from the Google security settings page at security.google.com/settings/security/permissions, in addition to disconnecting the channel in Turboyap or using our deletion process.
- If you disconnect YouTube in Turboyap, we revoke the token immediately and delete the YouTube data we stored about you within 7 days. If you revoke access through Google's security settings, we delete it within 30 days. We do not keep YouTube API data for more than 30 days without refreshing it or confirming we are still authorized to keep it.
- Questions or complaints about how we handle YouTube or Google data go to [email protected].
Platform-specific commitments
- Meta (Instagram, Facebook, Threads): we process Platform Data only as the Meta Platform Terms allow. You can remove Turboyap from your Meta account and request deletion of the data we hold by following our data deletion instructions.
- TikTok: we use TikTok data only to provide the features you use, as the TikTok Developer Terms of Service require. TikTok's own handling of your data is described in the TikTok Privacy Policy.
- LinkedIn (coming soon): we store LinkedIn content only as long as needed to provide the service, and we delete content collected through LinkedIn's APIs, including tokens, when you ask us to or close your account.
- X (coming soon): we post to X only with your express consent and show you exactly what will be published before it goes out. If content Turboyap stored is deleted or changed on X, or you ask us to remove it, we delete or update our copy within 24 hours.
Cookies and similar technology
The marketing website sets no cookies. The Turboyap dashboard uses cookies and local storage that are needed to keep you signed in and remember your settings, and PostHog product analytics to understand which features are used. We do not use advertising cookies, and no third party serves ads through Turboyap.
How long we keep data
- Tokens: kept while an account is connected. Disconnecting an account deletes its tokens immediately.
- Workspace data (connected account details, media, posts, schedules, metrics and audit log): kept while your workspace exists so posts can be published, retried and reported on. Deleting a workspace deletes its data, including from backups, within 30 days.
- Deletion requests: you can ask us to delete a connected account's data or your whole workspace at any time by emailing [email protected]. We confirm when it is done.
- Records we must keep: invoices and payment records are kept as long as tax and accounting law requires. Security logs are kept for up to 90 days.
Deleting data in Turboyap does not delete posts that are already live on a platform. Delete those on the platform itself.
Security
- OAuth tokens are encrypted at rest with AES-256-GCM and are never returned by our API.
- API keys are stored only as hashes. Agent keys and human keys have separate permissions.
- All traffic to turboyap.com and api.turboyap.com is encrypted in transit with TLS.
- Access to production systems is limited to people who need it, and every write to your workspace is recorded in the audit log.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and the platforms concerned as the law and their terms require.
Your rights and choices
Depending on where you live (for example under the GDPR, the UK GDPR, or US state laws such as the CCPA), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To use any of these rights, email [email protected]. We will verify that the request comes from you and respond within 30 days. You will not be treated differently for using your rights.
We do not sell personal information or share it for cross-context behavioral advertising. If you are in the EU or UK, you can also complain to your local data protection authority. Our legal bases for processing are performing our contract with you, our legitimate interest in running a secure service, compliance with law, and your consent where we ask for it.
International transfers
We and our service providers process data in the United States and other countries. Where data protection law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses for transfers.
Children
Turboyap is a business tool for people 18 and older. We do not knowingly collect data from children. If you believe a child has given us data, email [email protected] and we will delete it.
Changes to this policy
We will update the effective date above whenever this policy changes. If a change is material, we will tell you by email or in the dashboard before it takes effect, and where we start using data from a platform in a new way, we will ask for your consent first.
Contact us
Privacy questions, complaints and requests: [email protected]. Everything else: [email protected]. By mail: [LEGAL ENTITY NAME], [STREET ADDRESS], [CITY, STATE ZIP], [COUNTRY].
See also our terms of service and data deletion instructions.