Privacy policy

Pub Flow (“we”, “us”) operates the Pub Flow scheduling service at pub-flow.com. The operating entity is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For any privacy question, or to exercise your rights, email support@pub-flow.com.

• Account details. Your name and email address, handled through our authentication provider Clerk when you sign up or sign in.
• Workspace data. Your workspace name, timezone, and the posts, schedules, captions, and hashtag sets you create.
• Connected account tokens. When you connect a social account (LinkedIn, Instagram, X, Bluesky, a Facebook Page via the Meta Graph API, TikTok, or YouTube via the Google / YouTube Data API), we store the OAuth access and refresh tokens needed to publish on your behalf.
• Media you upload. Images and video you add to posts, stored in Cloudflare R2.
• Billing data. Subscription and payment status, handled by our billing provider Polar. We never see or store full card numbers.

We use your data only to run the service: to authenticate you, to publish the posts you schedule to the accounts you connect, to enforce your plan limits, and to bill your subscription. We do not sell your data, and we do not use the content of your posts or your connected-account data for advertising.

Your social account tokens are encrypted at the application layer before they are written to our database, and are only decrypted server-side at the moment we publish a post for you. This is the most sensitive data we hold, and it is never exposed to your browser after you connect.

We rely on a small set of subprocessors to deliver the service:

• Clerk — authentication and account management.
• Convex — our application backend and database.
• Cloudflare R2 — storage for the media you upload.
• Polar — subscription billing and payments.
• The social platforms you connect — we send the content you schedule to LinkedIn, Instagram, X, Bluesky, Meta (Facebook Pages), TikTok, and YouTube (via the Google / YouTube Data API) so it can be published. Their own privacy policies govern what they do with it.
• OpenAI — only if you use AI caption suggestions, the prompt you provide is sent to generate a draft.

When you connect a YouTube channel, Pub Flow accesses your Google account through the Google / YouTube Data API solely to upload the videos you schedule to your channel on your behalf. Pub Flow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google or YouTube data for advertising, we do not sell it, we do not transfer it to others except as needed to provide the service you requested or as required by law, and we do not use it to train generalized AI or machine-learning models. Our use of the YouTube Data API also complies with the YouTube API Services Terms of Service, and by connecting YouTube you also agree to the YouTube Terms of Service. You can revoke Pub Flow’s access to your Google account at any time from your Google account permissions page, or by disconnecting the account in Pub Flow.

We keep your data for as long as your account is active. You can disconnect any social account at any time, which removes its stored tokens, and you can request full deletion of your account and data whenever you like. See our data deletion instructions for exactly how to do this and what gets removed.

We use only the cookies required to keep you signed in and to run the service securely (set by Clerk). We do not use third-party advertising or tracking cookies.

We may update this policy as the product evolves. When we make a material change we will update the date at the top of this page.

Questions about your privacy? Email support@pub-flow.com and we’ll help.