Platform API Data Use & Compliance

For every platform you connect, SkedCast follows the same core commitments: we act only with your authorization and through the platform’s official OAuth flow; we use the access we obtain solely to schedule and publish the content you compose, at your direction; we store OAuth tokens (never your passwords) encrypted in our token vault; we do not sell platform data, use it for advertising, or use it for surveillance; we retain it only as long as the feature needs it; and we erase it on disconnection or on a deletion request, revoking it with the platform as well wherever the platform gives us a way to (§6). See our Privacy Policy, Data Deletion page, and Security page for the full detail.

SkedCast uses YouTube API Services. Where you connect a Google service (the YouTube Data API), SkedCast makes the affirmative commitment required by the Google API Services User Data Policy:

SkedCast’s use of information received from Google APIs (including the YouTube Data API and the Google Business Profile APIs) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, we limit our use of YouTube API data to the upload and scheduling features that are prominent in SkedCast; we do not transfer it to third parties except as that policy permits (to provide those features with your consent, for security, or to comply with law); we do not let humans read it except in the narrow cases the policy allows; we never use it to serve advertisements or to determine credit-worthiness; and we never use it to train generalized AI or ML models.

The Google Privacy Policy governs Google’s handling of your data. By using SkedCast with YouTube you also agree to the YouTube Terms of Service — By using SkedCast you agree to be bound by the YouTube Terms of Service. You can review or revokeSkedCast’s access at any time at myaccount.google.com/permissions. Disconnecting the channel erases our copy of the token immediately, and we ask Google to revoke it once we can confirm no other channel under the same Google sign-in is still connected — where we cannot confirm that, we skip the revoke rather than cut off channels you never touched, and you can withdraw the grant yourself in your Google security settings. Within 7 days of you disconnecting or removing the channel we delete all the YouTube API data we hold for it: the analytics, the inbox and the cached channel profile. If you revoke SkedCast in your Google security settings instead, our access stops immediately, we notice when Google rejects our next token refresh and mark the channel as needing reconnection, and we delete the same data within 30 days after that unless you reconnect the channel first. The channel identifiers and the uploads you published through SkedCast are not YouTube API data in that sense: they stay attached to the record of what we published for you until you close your workspace or make a verified deletion request, and erasing them is then a manual step our team completes within 30 days, not one a job performs. To have the data removed now, disconnect the channel, close the workspace, or email us.

Our composer implements TikTok’s required posting experience: it calls TikTok before composing to determine eligibility, shows your creator nickname and avatar, presents a privacy selector with no default value, reflects the interaction (Comment/Duet/Stitch) settings, and surfaces the commercial-content and music-usage disclosures. We never add promotional watermarks to your content or strip attribution. The two consent statements presented in the composer before publishing are, verbatim:

By posting, you agree to TikTok’s Music Usage Confirmation.

By posting, you agree to TikTok’s Branded Content Policy and Music Usage Confirmation.

For each platform we integrate with, the following sets out what we access, the purpose, how we comply with that platform’s developer policy, the retention and deletion behavior, and a link to the platform’s own developer terms.

Each platform imposes its own storage and deletion rules. What we do — and therefore what we commit to — for each is below:

• Meta — Facebook, Instagram & Threads — a data-deletion request from Meta, sent when you ask Meta to delete your data, is answered through the callback and instructions URL registered with Meta, and it deletes the tokens, the cached profile, the analytics and the inbox of the accounts concerned. The one exception is a workspace under a legal hold, whose data we are required to preserve: we record the request and complete it once the hold is lifted. Disconnecting an account erases its token at once but does not delete the analytics and inbox history that Meta’s terms let us keep for you, which follow the windows in our retention summary for Meta. Closing your workspace takes everything out of service at once, and erasing the remaining records is a manual step our team completes within 30 days of the closure or of a verified deletion request.
• Google — YouTube Data API — disconnecting the channel erases our copy of the token immediately, and we ask Google to revoke it once we can confirm no other channel under the same Google sign-in is still connected — where we cannot confirm that, we skip the revoke rather than cut off channels you never touched, and you can withdraw the grant yourself in your Google security settings. Within 7 days of you disconnecting or removing the channel we delete all the YouTube API data we hold for it: the analytics, the inbox and the cached channel profile. If you revoke SkedCast in your Google security settings instead, our access stops immediately, we notice when Google rejects our next token refresh and mark the channel as needing reconnection, and we delete the same data within 30 days after that unless you reconnect the channel first. The channel identifiers and the uploads you published through SkedCast are not YouTube API data in that sense: they stay attached to the record of what we published for you until you close your workspace or make a verified deletion request, and erasing them is then a manual step our team completes within 30 days, not one a job performs. To have the data removed now, disconnect the channel, close the workspace, or email us.
• Google — Business Profile APIs — disconnecting a location erases our copy of the token immediately, and we ask Google to revoke it once no other location under the same Google sign-in is still connected — where others remain, we skip the revoke rather than cut them off, and you can withdraw the grant yourself in your Google security settings. Within 30 days of you disconnecting the location, or of Google ending our access to it (including by deleting the location), we delete the figures, search terms, reviews and replies and the cached profile we hold for it, and anything Google has not refreshed in 30 days is deleted while it is connected. Your publishing record is kept until you close your workspace or make a verified deletion request; erasing it is then a manual step our team completes within 30 days.
• X (Twitter) — the token is erased when you disconnect the account or when your workspace closes, and because X offers a revocation endpoint we ask X to invalidate it as well; the posts you composed here go out of service the moment your workspace closes, and erasing the stored records themselves is a manual step our team completes within 30 days of that closure or of a verified deletion request — no job erases them for you. SkedCast has no per-post delete control: you can cancel a post before it goes out, and removing one we have already stored is a request you make to us. We do read X on a schedule — we read the public counters of your recent posts daily — so it does notice when a post you published through SkedCast is no longer there, but noticing is all it does: we stamp that post as gone and keep the figures we last recorded as its final ones. Taking a post down on X therefore does not by itself erase our copy; tell us and we will remove it.
• TikTok — disconnecting the account erases our copy of the token immediately, and closing your workspace erases the tokens for every connected account at once; the creator identifier stays attached to the record of what we published for you, and that record goes out of service the moment your workspace closes — erasing it, and the rest of the TikTok Platform Data we hold, is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.
• LinkedIn — the stored credential is erased immediately when you disconnect the account or close your workspace, and the member or organization identifier stays attached to the record of what we published for you — erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request.
• Pinterest — disconnecting the account erases our copy of the token immediately, and closing your workspace erases the tokens for every connected account at once; the business-account identifier and the boards you pinned to stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request; the audience and per-Pin figures our analytics job recorded are the only other Pinterest data we hold, and the analytics we record for your Pinterest channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request, including the day-by-day history behind the charts, until a verified deletion request or the closure erases them by the same manual step.
• Bluesky (AT Protocol) — disconnecting the account erases our copy of the credential immediately, and closing your workspace erases the credentials for every connected account at once; the account identifiers — your handle and DID — stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.
• Telegram (Bot API) — disconnecting the integration erases the stored bot token immediately, and closing your workspace erases it as well; what neither erases is the bot identifier on the connection or the channel identifiers stored with each post you sent — they stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.

You can disconnect any account at any time, which erases the stored tokens for that account and, where the platform offers a revocation endpoint (TikTok, YouTube, X, Pinterest, Bluesky), asks the platform to revoke them as well. The Meta family and LinkedIn expose no revocation endpoint to us; for those, remove SkedCast from the platform’s own connected-apps settings if you want the authorization itself withdrawn. You can also request deletion of your account and all platform-derived data. We complete verified deletion requests within 30 days, as described on our Data Deletion & Account Removal page — the same page we provide to the platforms as our data-deletion instructions and as the Meta data-deletion callback URL.

This page works together with:

• Our Privacy Policy (including “Data from the platforms you connect”).
• Our Terms of Service (the “Connected third-party platforms” section, including the YouTube binding statement).
• Our Acceptable Use Policy (per-platform compliance, rate limits, and AI-content disclosure).
• Our Data Deletion page and Security page.

For any question about how SkedCast uses platform data, contact [email protected].