Privacy Policy

SkedCast is a product of Alpha Exotic Tech LLC, a limited liability company organized in the State of Wyoming, USA, with a registered office at 30 N Gould St Ste R, Sheridan, WY 82801, United States. In this policy, “we”, “us”, and “our” refer to Alpha Exotic Tech LLC.

For any privacy question, to exercise your rights, or to reach our privacy team, email [email protected] or write to us at the address above.

EU and UK representative (GDPR / UK GDPR Art. 27)

Alpha Exotic Tech LLC has no establishment in the European Economic Area or the United Kingdom. Where Art. 27 requires a controller outside those territories to designate a representative within them, we designate one and name them here, with their address, so that data subjects and supervisory authorities have an addressee in their own territory.

No Art. 27 representative is designated at this time. Until one is named above, EU and UK data subjects and supervisory authorities should contact us directly at [email protected] or at the postal address above; we answer within the timeframes the GDPR and UK GDPR require.

SkedCast is a multi-tenant service used by agencies, brands, and creators to schedule and publish content. Our role under data-protection law depends on whose data is involved:

• As a data controller — for personal data about our own account-holders (our direct customers): identity, login, billing, and usage data. This policy describes how we handle that data.
• As a data processor — for the connected-account data, post content, media, and analytics that a customer processes through the service on behalf of their own clients, and for the contact details that visitors give through a sign-up form on a customer’s Link in Bio page (see “Visitors to a Link in Bio page” below). The customer is the controller; we process that data only on the customer’s documented instructions, under our Data Processing Addendum.

Where you are an end user of one of our customers, that customer’s own privacy notice governs their use of your data; this policy explains the processing we carry out on their behalf.

We collect the following categories of personal data. We practise data minimization: we request only the data and platform permissions the service needs, and we do not intentionally collect special-category (“sensitive”) personal data.

One free account per person. To keep the free plan fair and to secure sign-in, we record these signals for each account: a random identifier for each browser you use SkedCast from (the sk_did cookie, see Cookies), your email address reduced to the inbox it reaches (so name+tag@ and name@ match), the network you connect from, and your email domain when it belongs to a company (never for public providers such as Gmail or Outlook). When you create an account on a computer (not a phone or tablet), your browser also turns a few coarse facts about itself (screen size, time zone, language, operating system, number of processor cores, memory and touch support) into a one-way code, and only that code is sent; we read nothing else from your device, never on any other page, and not at all when your browser sends Do Not Track or Global Privacy Control. Each is stored only as a keyed one-way hash. When a new workspace’s owner matches another account on the same browser or the same inbox, or already owns a workspace, or created it from a device with the same code on the same network within 30 days of the other account, the new workspace’s free plan is turned off automatically; a shared network, domain or device code alone never does this. When more than five new accounts are opened in one day from one network or one company domain, the free plan of each further one is put on hold until a person reviews it, unless the account came through one of our affiliate partners in good standing; a nightly check applies the same rule to accounts that signed up at the same moment. Paying for a plan turns it back on, and you can ask a person to review the decision from the workspace’s settings. Our lawful basis is our legitimate interest in preventing fraud and abuse (Art. 6(1)(f)).

Spam protection. Our sign-up, password-reset and similar public forms use Cloudflare Turnstile to check that a person, not a script, is sending them; Cloudflare processes technical signals from your browser for this and does not use them for advertising. Links in posts you schedule are checked against public lists of malware and phishing sites; a short link is followed to see where it leads. The same legal basis applies (Art. 6(1)(f)).

We store OAuth tokens, never your platform passwords. Tokens are held in an encrypted vault — see Security and the OAuth-token section below.

SkedCast AI chats, support requests and screenshots. When you chat with SkedCast AI inside the app we store the conversation so you can come back to it, and we delete it when you delete the chat. A screenshot you attach is read by our AI provider to answer that message. We also keep a copy, encrypted with a key tied to your workspace and to that one file, for 24 hours. When your chat is handed to the SkedCast support team — because you asked for a person or a team member opened it as a case, our support team can open the screenshots you sent in that chat, one at a time, and each time one is opened it is recorded in our audit log; screenshots you send once it is with the team go straight onto the request. They are then kept 30 days from the moment they go to the team, and deleted. If your chat is never handed to the team, they are deleted after the 24 hours. A screenshot can show other people’s details, so leave out anything you would not want our support team to see. Deleting the chat or asking us to erase your data deletes your screenshots too, within an hour. If you leave the workspace, they are deleted within a day (when a support request about that chat is still open, within a day of it being closed). A data export lists them but does not contain the files. Our lawful basis is performance of the contract (Art. 6(1)(b)): answering your questions and helping you with the product.

We use personal data to provide, secure, and improve the service, to bill for it, to communicate with you, and to comply with law. Where the EU/UK GDPR applies, we rely on the following legal bases:

For connected-account data we process on a customer’s behalf, the customer (as controller) is responsible for establishing the legal basis for that processing.

When you connect a social account, you authorize SkedCast through the platform’s official OAuth flow to act on that account on your behalf. We request the minimum scopes needed to publish — typically the permission to create posts plus a read scope to identify the connected account — and nothing more. We never receive or store your platform password.

The OAuth access and refresh tokens we receive are stored encrypted with AES-256-GCM in our token vault, under a key derived separately for every workspace, are decrypted only by our backend to carry out your instructions, and are never logged, sold, or shared except with the originating platform to publish on your behalf. We do not use platform data for advertising, and we do not build profiles unrelated to providing the service.

You stay in control. You can disconnect any account at any time, which immediately erases the stored tokens for that account and, where the platform offers a revocation endpoint, asks the platform to revoke them as well; where it does not, remove SkedCast from that platform’s own connected-apps settings. You can also request deletion of your account and all platform-derived data (see our Data Deletion page).

SkedCast acts on a connected account only with your express, informed consent, captured through the platform’s OAuth consent screen and made clear in our connect experience. Publishing is an explicit, user-initiated action: we do not take actions on your account that you have not directed — either by doing them yourself or by setting up an inbox automation rule that labels, hides or replies for you (you can switch every rule, and every automatic AI reply, off at any time). Before you connect an account, we tell you what we will access, how we will use it, when we collect it, and how to withdraw consent or request deletion; where a platform’s token expires, we ask you to re-authorize. You can withdraw consent at any time by disconnecting the account.

We access only the account identifiers and the OAuth tokens needed to publish, and we use that access solely to schedule and publish the content you compose, at your direction. What we access, the purpose, and the retention/deletion behavior, per platform, is set out below and on our Platform API Data Use & Compliance page.

• Meta — Facebook, Instagram & Threads — we access your Page/professional-account identifiers and the OAuth access and refresh tokens needed to publish to the Facebook Pages, Instagram, and Threads you connect, solely to schedule and publish the content you compose to your connected Meta accounts, at your direction. tokens are held encrypted while the account is connected and are erased on disconnection or on a deletion request; for Facebook Pages we also ask Meta to revoke the login unless another Page still uses it, but Meta offers no endpoint to revoke an Instagram or Threads login, so for those you also remove SkedCast in your Instagram or Threads settings; the analytics we record for your Meta channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request; inbox messages from Meta (comments, messages and mentions) are kept for as long as your workspace exists, and deleted when it is erased, when you delete them, or on a deletion request; disconnecting or removing the channel does not delete your Meta analytics or inbox history: Meta’s terms let us keep your own account history, and it is erased when your workspace is erased; you can also remove SkedCast from your Meta account settings at any time; a data-deletion request from Meta, sent when you ask Meta to delete your data, deletes all the Meta data we hold — the tokens, the cached profile, the analytics and the inbox — through our data-deletion callback. On deletion: a data-deletion request from Meta, sent when you ask Meta to delete your data, is answered through the callback and instructions URL registered with Meta, and it deletes the tokens, the cached profile, the analytics and the inbox of the accounts concerned. The one exception is a workspace under a legal hold, whose data we are required to preserve: we record the request and complete it once the hold is lifted. Disconnecting an account erases its token at once but does not delete the analytics and inbox history that Meta’s terms let us keep for you, which follow the windows in our retention summary for Meta. Closing your workspace takes everything out of service at once, and erasing the remaining records is a manual step our team completes within 30 days of the closure or of a verified deletion request.
• Google — YouTube Data API — we access your YouTube channel identifiers and the OAuth tokens needed to upload and schedule videos to the channel you connect, solely to upload, schedule, and publish the videos you provide to your connected YouTube channel, at your direction. tokens are held encrypted while the channel is connected; disconnecting the channel in SkedCast erases the token immediately, and we ask Google to revoke it once we can confirm this is the last channel using that Google sign-in — for channels connected before we began recording that sign-in we cannot confirm it, so we skip the revoke rather than risk cutting off channels you never touched, and you can withdraw the grant yourself from your Google account permissions page; within 7 days of you disconnecting or removing the channel we delete the analytics we recorded, the inbox (comments, messages and the people who wrote them) and the cached channel profile (picture, sign-in email and name, follower totals); if Google ends our access without you disconnecting in SkedCast — you revoke it in your Google account settings (we detect it when a token refresh is rejected with an “invalid grant” answer), or YouTube deletes the destination — we delete the analytics we recorded, the inbox (comments, messages and the people who wrote them) and the cached channel profile (picture, sign-in email and name, follower totals) within 30 days after that, unless you reconnect the channel first; while a channel is connected, inbox messages from YouTube (comments, messages and mentions) are kept while the channel is connected, with no rolling deletion, and deleted when you or Google end our access as stated below, when you delete them, or on a deletion request, and the YouTube comments we hold are re-read from YouTube before they are 30 days old; the channel identifiers stay attached to the record of what we published for you, and closing your workspace takes that record out of service at once — erasing it is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs. On deletion: disconnecting the channel erases our copy of the token immediately, and we ask Google to revoke it once we can confirm no other channel under the same Google sign-in is still connected — where we cannot confirm that, we skip the revoke rather than cut off channels you never touched, and you can withdraw the grant yourself in your Google security settings. Within 7 days of you disconnecting or removing the channel we delete all the YouTube API data we hold for it: the analytics, the inbox and the cached channel profile. If you revoke SkedCast in your Google security settings instead, our access stops immediately, we notice when Google rejects our next token refresh and mark the channel as needing reconnection, and we delete the same data within 30 days after that unless you reconnect the channel first. The channel identifiers and the uploads you published through SkedCast are not YouTube API data in that sense: they stay attached to the record of what we published for you until you close your workspace or make a verified deletion request, and erasing them is then a manual step our team completes within 30 days, not one a job performs. To have the data removed now, disconnect the channel, close the workspace, or email us.
• Google — Business Profile APIs — we access the identifiers of the Business Profile locations you connect, and the OAuth tokens (scope `business.manage`) needed to publish posts to them, read their performance figures and search terms, and read and reply to their reviews, solely to publish the posts you compose to the locations you connect, to show you those locations’ results (profile views, website clicks, calls, direction requests, bookings, conversations and the searches that found them) and, in the inbox, to show you their reviews and send the replies you or your automation rules write — at your direction. tokens are held encrypted while the location is connected; disconnecting a location erases our copy of the token immediately, and we ask Google to revoke it once no other location under the same Google sign-in is still connected — otherwise we skip the revoke rather than cut off locations you never touched, and you can withdraw the grant yourself from your Google account permissions page; Google Business Profile analytics that have not been refreshed from Google Business Profile in the last 30 days are deleted automatically; Google Business Profile reviews and replies that have not been refreshed from Google Business Profile in the last 30 days are deleted automatically; within 30 days of you disconnecting or removing the channel we delete the analytics we recorded, the inbox (comments, messages and the people who wrote them) and the cached channel profile (picture, sign-in email and name, follower totals); if Google ends our access without you disconnecting in SkedCast — you revoke it in your Google account settings (we detect it when a token refresh is rejected with an “invalid grant” answer), or Google Business Profile deletes the destination — we delete the analytics we recorded, the inbox (comments, messages and the people who wrote them) and the cached channel profile (picture, sign-in email and name, follower totals) within 30 days after that, unless you reconnect the channel first; closing your workspace takes the rest out of service at once, and erasing it is a manual step our team completes within 30 days of the closure or of a verified deletion request. On deletion: disconnecting a location erases our copy of the token immediately, and we ask Google to revoke it once no other location under the same Google sign-in is still connected — where others remain, we skip the revoke rather than cut them off, and you can withdraw the grant yourself in your Google security settings. Within 30 days of you disconnecting the location, or of Google ending our access to it (including by deleting the location), we delete the figures, search terms, reviews and replies and the cached profile we hold for it, and anything Google has not refreshed in 30 days is deleted while it is connected. Your publishing record is kept until you close your workspace or make a verified deletion request; erasing it is then a manual step our team completes within 30 days.
• X (Twitter) — we access your X account identifier and the OAuth tokens needed to post on your behalf, solely to publish the posts you compose to your connected X account, at your direction. tokens are held encrypted while the account is connected, and on disconnection we erase the token and ask X to invalidate it through its revocation endpoint; the only X content we hold is the posts you composed in SkedCast and the performance figures we recorded for them, and the analytics we record for your X channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request, and disconnecting or removing the channel does not delete your X analytics: X’s terms let us keep your own account history, and it is erased when your workspace is erased; a daily sync covering posts from the last 30 days marks any post you have deleted on X as removed and stops retrieving it, freezing rather than updating the figures we already hold; we keep our own record that the post was published, and delete it on request. On deletion: the token is erased when you disconnect the account or when your workspace closes, and because X offers a revocation endpoint we ask X to invalidate it as well; the posts you composed here go out of service the moment your workspace closes, and erasing the stored records themselves is a manual step our team completes within 30 days of that closure or of a verified deletion request — no job erases them for you. SkedCast has no per-post delete control: you can cancel a post before it goes out, and removing one we have already stored is a request you make to us. We do read X on a schedule — we read the public counters of your recent posts daily — so it does notice when a post you published through SkedCast is no longer there, but noticing is all it does: we stamp that post as gone and keep the figures we last recorded as its final ones. Taking a post down on X therefore does not by itself erase our copy; tell us and we will remove it.
• TikTok — we access your basic TikTok creator info and the OAuth tokens needed to post content on your behalf, solely to publish the videos and photos you compose to your connected TikTok account, at your direction. tokens are held encrypted while the account is connected, and disconnecting the account erases the token immediately; the analytics we record for your TikTok channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request, and disconnecting or removing the channel does not delete your TikTok analytics: TikTok’s terms let us keep your own account history, and it is erased when your workspace is erased; the creator identifier we store stays attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request. On deletion: disconnecting the account erases our copy of the token immediately, and closing your workspace erases the tokens for every connected account at once; the creator identifier stays attached to the record of what we published for you, and that record goes out of service the moment your workspace closes — erasing it, and the rest of the TikTok Platform Data we hold, is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.
• LinkedIn — we access your member or organization identifier and the OAuth tokens needed to publish to your personal profile or to a Company Page you administer, solely to publish the content you compose to your connected LinkedIn profile or Page, for your benefit and at your direction. we store only the member data needed to provide the posting feature, within LinkedIn’s storage limits; disconnecting erases the stored credential immediately; LinkedIn analytics older than 1 year are deleted automatically, whether or not the channel is connected, including the day-by-day history behind the charts; the text of what other LinkedIn members wrote is removed 48 hours after we last read it (the item stays in your inbox, marked as expired, with a link back to LinkedIn), their name and picture 24 hours after, and the text of your organization’s own social activity 6 months after; the member or organization identifier stays attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request. On deletion: the stored credential is erased immediately when you disconnect the account or close your workspace, and the member or organization identifier stays attached to the record of what we published for you — erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request.
• Pinterest — we access your Pinterest business-account identifier and the OAuth tokens needed to create Pins and boards on your behalf, solely to publish the Pins you compose to the boards you choose on your connected Pinterest account, at your direction. tokens are held encrypted while the account is connected, and disconnecting the account erases the token immediately; the business-account identifier and the board references we store stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request; the only other Pinterest data we hold is the audience and per-Pin figures our analytics job records, and the analytics we record for your Pinterest channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request, including the day-by-day history behind the charts; disconnecting or removing the channel does not delete your Pinterest analytics: Pinterest’s terms let us keep your own account history, and it is erased when your workspace is erased. On deletion: disconnecting the account erases our copy of the token immediately, and closing your workspace erases the tokens for every connected account at once; the business-account identifier and the boards you pinned to stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request; the audience and per-Pin figures our analytics job recorded are the only other Pinterest data we hold, and the analytics we record for your Pinterest channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request, including the day-by-day history behind the charts, until a verified deletion request or the closure erases them by the same manual step.
• Bluesky (AT Protocol) — we access your handle/DID and the per-account credential or session needed to post on your behalf, solely to publish the posts you compose to your connected Bluesky account, at your direction. credentials are held encrypted while the account is connected, and disconnecting the account erases the stored credential immediately; the analytics we record for your Bluesky channels are kept for as long as your workspace exists, and deleted when it is erased or on a deletion request; inbox messages from Bluesky (comments, messages and mentions) are kept for as long as your workspace exists, and deleted when it is erased, when you delete them, or on a deletion request; disconnecting or removing the channel does not delete your Bluesky analytics or inbox history: Bluesky’s terms let us keep your own account history, and it is erased when your workspace is erased; the account identifiers we store — your handle and DID — stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request. On deletion: disconnecting the account erases our copy of the credential immediately, and closing your workspace erases the credentials for every connected account at once; the account identifiers — your handle and DID — stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.
• Telegram (Bot API) — we access the bot token you configure and the channel/chat identifiers needed to post where your bot is an administrator, solely to publish the messages you compose to the Telegram channels you choose, at your direction. the bot token is held encrypted while the integration is configured, and disconnecting it — or closing your workspace — erases the token immediately; what neither erases is the identifiers around it — the bot identifier on the connection, and the channel identifiers stored with each post you sent — which stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of your workspace closing or of a verified deletion request. On deletion: disconnecting the integration erases the stored bot token immediately, and closing your workspace erases it as well; what neither erases is the bot identifier on the connection or the channel identifiers stored with each post you sent — they stay attached to the record of what we published for you, and erasing that record is a manual step our team completes within 30 days of the closure or of a verified deletion request, not one a job performs.

Google API Services / YouTube — Limited Use

Where you connect a Google service (the YouTube Data API), SkedCast makes the affirmative commitment required by the Google API Services User Data Policy:

SkedCast’s use of information received from Google APIs (including the YouTube Data API and the Google Business Profile APIs) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

SkedCast uses YouTube API Services. Consistent with the Limited Use requirements, we limit our use of YouTube API data to the upload and scheduling features that are visible in SkedCast; we do not transfer it to third parties except as that policy permits (for example, to provide those features with your consent, for security, or to comply with law); we do not allow humans to read it except in the narrow cases that policy allows; we never use it to serve advertisements or to determine credit-worthiness; and we never use it to train generalized artificial-intelligence or machine-learning models. The Google Privacy Policy is available at policies.google.com/privacy, and the YouTube Terms of Service apply to your use of YouTube. You can review or revokeSkedCast’s access to your Google account at any time via the Google security-settings permissions page at myaccount.google.com/permissions. Disconnecting the channel erases our copy of the token immediately, and we ask Google to revoke it once we can confirm no other channel under the same Google sign-in is still connected — where we cannot confirm that, we skip the revoke rather than cut off channels you never touched, and you can withdraw the grant yourself in your Google security settings. Within 7 days of you disconnecting or removing the channel we delete all the YouTube API data we hold for it: the analytics, the inbox and the cached channel profile. If you revoke SkedCast in your Google security settings instead, our access stops immediately, we notice when Google rejects our next token refresh and mark the channel as needing reconnection, and we delete the same data within 30 days after that unless you reconnect the channel first. The channel identifiers and the uploads you published through SkedCast are not YouTube API data in that sense: they stay attached to the record of what we published for you until you close your workspace or make a verified deletion request, and erasing them is then a manual step our team completes within 30 days, not one a job performs. To have the data removed now, disconnect the channel, close the workspace, or email us.

Meta Platform Data

Where you connect a Meta account (Facebook, Instagram, or Threads), we handle Platform Data in line with the Meta Platform Terms and Developer Policies: we use it only to provide the features you authorize, we do not sell or license it, we do not use it for surveillance, we keep it only as long as the feature needs it, and we delete it on request or when you no longer have an account, through the mechanism described on our Data Deletion page — the data-deletion instructions / callback URL we provide to Meta.

X (Twitter) content

For X, we act only with your express consent, our handling is no less protective than the X Privacy Policy, and we do not redistribute or sell X content or match it to off-X data. The token is erased when you disconnect the account or when your workspace closes, and because X offers a revocation endpoint we ask X to invalidate it as well; the posts you composed here go out of service the moment your workspace closes, and erasing the stored records themselves is a manual step our team completes within 30 days of that closure or of a verified deletion request — no job erases them for you. SkedCast has no per-post delete control: you can cancel a post before it goes out, and removing one we have already stored is a request you make to us. We do read X on a schedule — we read the public counters of your recent posts daily — so it does notice when a post you published through SkedCast is no longer there, but noticing is all it does: we stamp that post as gone and keep the figures we last recorded as its final ones. Taking a post down on X therefore does not by itself erase our copy; tell us and we will remove it.

Messages from your audience (the inbox)

When you connect an account and use the inbox, SkedCast receives the comments, direct messages, mentions and reviews that people send to that account, through the platform’s official API. For each one we store the text, links to any attached media, the sender’s public profile details the platform provides (name, username, profile photo and, where available, follower count) and when it was sent. We process this on behalf of the workspace, which decides how it is used: the workspace is the controller and SkedCast is its processor.

We use it only to show the conversation to the workspace’s team, to let them reply and moderate, to run the automation rules and send the alerts the workspace sets up, and to have our AI provider suggest, draft, translate or summarise a reply — when a team member asks, or when a workspace’s automation rule is set to draft or send AI replies. Before any text reaches the AI provider we remove email addresses, phone numbers, payment card numbers and bank account numbers. An automated reply sent in a direct message on Facebook or Instagram says it is automated.

If you sent a message to a business that uses SkedCast and want your data deleted, ask that business: it can delete a single message or everything you sent it from SkedCast. This removes our copy; it does not remove what you posted on the platform itself.

Visitors to a Link in Bio page

A workspace can publish a Link in Bio page: a public page of links, posts and sign-up forms. When someone opens the page or taps a link on it, we add one to daily totals for the page, for each link, and for the source, country and device type. We set no cookie on the page, and we do not store the visitor’s IP address, browser details or the address of the page they came from. To count a visitor once a day, we turn their IP address into a code with a secret key and that day’s date; the code cannot be turned back into the address and is deleted within 26 hours. The daily totals hold no visitor’s details and are kept for 25 months.

A page can have a sign-up form. A visitor who signs up gives an email address or a phone number, and a name if they choose. We keep these with the exact sentence they agreed to and the time. An email address is kept as pending until the visitor confirms it with the button in the email we send; the link works for 48 hours, and an address that is never confirmed is deleted 7 days after its last link expired. A phone number is taken only when the visitor ticks a box that names how they will be contacted; we do not send it a code to check it. The workspace is the controller of this list and decides what to send these people; we are its processor. We keep the list so the workspace can see, export and delete it, and if the workspace connects its own Mailchimp account, we pass each confirmed email address, with the name if one was given, on to that account. A sign-up is deleted when the workspace deletes it or the page, and every sign-up is deleted when the workspace is closed. If you signed up on a page and want your details removed, ask the business that owns the page.

Anyone can report a page to us. We keep the reason they chose, what they wrote and a code made from their IP address with a secret key, so the same person cannot report the same page more than once; the IP address itself is not kept. We use reports only to review the page and keep them as the record of that review until the page is deleted.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We share personal data only with:

• Vetted sub-processors that process data on our behalf under a signed data-processing agreement — including Alpha Exotic Tech (Private) Limited, our intra-group engineering and support sub-processor. The current list is on our Sub-processors page.
• Payment providers that pay our partners and verify their identity (see §17), listed on the Sub-processors page.
• The social platforms you direct us to publish to, to carry out your instructions.
• Google LLC (Google Analytics 4), our website-analytics provider, which receives your IP address and a pseudonymous client id from our marketing pages — but only if you accept analytics cookies. Its tag is not loaded before you do, and never when your browser asserts Global Privacy Control. The exact cookies are listed by name in our Cookie Policy.
• Authorities or third parties where required to comply with law, enforce our terms, or protect rights, property, and safety; and a successor in a merger, acquisition, or asset sale, subject to this policy.

Alpha Exotic Tech LLC is based in the United States and works with sub-processors in multiple regions, including Alpha Exotic Tech (Private) Limited in Pakistan. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards — principally the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), and we rely on the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework where applicable — together with a transfer-impact assessment where required. These safeguards are incorporated into our Data Processing Addendum.

We keep personal data only as long as needed for the purposes above. Most of the windows below are enforced by automated deletion jobs; where a step is ours to run by hand instead, the entry says so. In summary:

• Account signals for one free account per person (the hashed browser identifier, inbox, network, company email domain and sign-up device code) — kept for the life of your account and deleted with it.
• Your posts and media — retained for the life of your account. You can delete a media file at any time, and the stored file itself is permanently removed from our storage when your plan’s recycle-bin window ends: 7 days on the Free plan, up to 365 days on the largest plan, counted from the day you deleted it. A published or scheduled post has no delete control: you can cancel one before it goes out, and removing one we have already stored is a request you make to us, which we complete by hand within 30 days.
• Connected-account credentials (OAuth tokens) — erased immediately when you disconnect an account, and revoked with the platform as well where the platform offers a revocation endpoint (see §7). As a safety net, any credentials and cached profile (picture, sign-in email and name, follower totals) belonging to an account that has remained disconnected for 18 months are automatically purged. What happens to the analytics and the inbox of a disconnected account depends on the platform: its own developer terms decide, and §7 states the rule for each one.
• The connected-account record itself — the channel, Page, or profile identifier is kept for as long as the posts we published to it are kept, because it is what says where each of those posts went. Disconnecting marks the record as disconnected and erases its credentials; the identifier is removed when the post history it annotates is removed — which no job does for you, so it is erased by hand after a workspace closure or a verified deletion request, within the 30 days our Data Deletion page commits to.
• Performance analytics — when you publish through SkedCast we keep performance snapshots of your content (impressions, likes, and similar figures) as part of your account’s historical reporting, including for content that is later removed from the platform. How long depends on the platform, because each platform’s developer terms decide it. For Meta (Facebook, Instagram and Threads), Bluesky, X, TikTok and Pinterest they are kept for as long as your workspace exists, and are deleted when it is erased or on a deletion request. LinkedIn analytics are deleted after 1 year on a rolling basis, and Google Business Profile figures that Google has not refreshed in 30 days are deleted. YouTube analytics are deleted within 7 days of you disconnecting the channel, or 30 days after you revoke access in your Google settings unless you reconnect first. Daily per-post snapshots are kept in full for 25 months, and after that only the last snapshot of each month is kept, for as long as the platform allows. The exact rule for each platform is in §7.
• Link in Bio pages — the daily view and click totals are kept for 25 months; a visitor’s daily counting code is deleted within 26 hours. A sign-up email address that is never confirmed is deleted 7 days after its last confirmation link expired; a confirmed sign-up is kept until the workspace deletes it or the page, or closes the workspace.
• Inbox messages — comments, direct messages, mentions and reviews, and the replies to them, are kept for as long as your workspace exists on Facebook, Instagram, Threads and Bluesky, and on YouTube while the channel is connected, with no rolling deletion (Google Business Profile reviews: 30 days unless refreshed from Google; LinkedIn: the shorter windows in §7). A disconnected account’s inbox is not cut off on its own clock: it follows the platform’s rule in §7, so Meta and Bluesky inboxes stay while a YouTube channel’s inbox is deleted within 7 days of you disconnecting it. A Meta data-deletion request deletes the inbox of the accounts concerned at once, and you can delete a conversation or a person’s data in the inbox at any time. YouTube comments are re-read from YouTube before they are 30 days old, and one removed on YouTube is emptied here too. Instagram story-mention media is never stored.
• Screenshots you send SkedCast AI — encrypted and held for 24 hours, then deleted. When your chat is handed to the SkedCast support team — because you asked for a person or a team member opened it as a case in that time, the screenshots you sent go to our support team with the request and are deleted 30 days after that (screenshots you add to an open request, 30 days after you send them). The deletion runs every hour, so a screenshot is gone within an hour of its time, and within an hour of you deleting the chat or asking us to erase your data (within a day of you leaving the workspace).
• Operational logs — webhook delivery logs and rate-limit records are kept for 90 days; email delivery logs and sign-in history (the email address entered, IP address and browser of each sign-in attempt) for 180 days; in-app notifications for 180 days after you read them.
• Data-export (DSAR) bundles — an export we prepare for you is kept for 30 days after your request is fulfilled, then deleted.

We also honor each connected platform’s own retention rules; the commitment we make for each one is stated per platform in §7 above and on our Platform API Data Use & Compliance page. Some records (such as billing and tax records) are retained for the period required by law, and audit logs are retained for a bounded period for security and accountability. Deletion requests are handled as described on our Data Deletion & Account Removal page.

We protect personal data with row-level tenant isolation, an AES-256-GCM envelope-encrypted token vault that derives a separate key for every workspace, encryption in transit (TLS 1.2+) and at rest, least-privilege role-based access, a separate MFA-protected operator surface, and append-only audit logging. Read more on our Security page. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify affected parties and authorities of incidents as required by law.

Depending on where you live, you may have the following rights over your personal data. We extend the core access and deletion rights to all users regardless of location.

• Access & portability — obtain a copy of the personal data we hold about you, in a portable, machine-readable format.
• Rectification & correction — have inaccurate or incomplete personal data corrected.
• Erasure / deletion — have your personal data deleted (the GDPR “right to be forgotten” and the CCPA right to delete), subject to limited legal exceptions.
• Restriction & objection — restrict or object to certain processing, including processing based on our legitimate interests.
• Opt out of sale or sharing — opt out of any “sale” or “sharing” of personal information — we do not sell or share personal information in this sense.
• Non-discrimination & complaint — exercise your rights without discriminatory treatment, and lodge a complaint with your data-protection supervisory authority.

EU / UK GDPR

You may submit a data-subject access request (DSAR) at any time, and you have the right to lodge a complaint with your supervisory authority. We verify your identity and respond within the timeframes the law requires, generally within one month (extendable for complex requests).

California (CCPA / CPRA)

California residents have the right to know, access, correct, and delete their personal information, and to opt out of any “sale” or “sharing”. We do not sell or share personal information and we do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA. You can exercise the opt-out through the “Do Not Sell or Share My Personal Information” control in the footer of every page, and we honor the Global Privacy Control (GPC) browser signal. Exercising your rights will never result in discriminatory treatment. You may use an authorized agent to submit a request.

To exercise any right, email [email protected]. Where you are an end user of one of our customers, we may direct your request to that customer as the controller and assist them in fulfilling it.

SkedCast is a business tool not directed to children. We do not knowingly collect personal data from anyone under 16.

Every account-creation surface states, immediately beside the control that creates the account, that by continuing you confirm you are at least 18 — the minimum age our Terms of Service require — and your acceptance is recorded with the version of the terms you accepted. We do not ask for a date of birth or verify age by document.

If you believe a child has provided us personal data through an account, contact [email protected] with the email address concerned and we will delete it.

We use a small number of essential cookies to run the service and, subject to your choices, analytics cookies from Google LLC (Google Analytics 4) to understand product usage, and our own measurement and partner-attribution cookie (see §16). Our Cookie Policy lists every cookie and storage key by name, with its provider, purpose, and duration, and explains how to opt out.

If you take part in the referral program, some personal data is processed that the rest of this policy does not describe. This section explains it. The program’s rules themselves are in the Referral Program Terms.

We never send invitations for you

We do not ask you for anyone else’s email address, and we never send an invitation on your behalf. You share your own link, in your own words, from your own account or mail client. This means we hold no personal data about a person you invite unless and until they choose to create an account themselves.

What the person who invited you learns

If you sign up through someone’s referral link, that person can see in their own account that a referral signed up and, later, that a first payment was made, because that is what their reward depends on. They are not shown your email address, in whole or in part, and they are never shown your name, your content, or the accounts you connect. You are told this on the referral page before you sign up, and the referral code stays visible and editable on the signup form so you can clear it.

In the other direction, the workspace name of the person who invited you is normally shown on their referral page so you can see who is inviting you. A referrer can turn that off, and the page then makes the offer without naming them.

Checking that a referral is genuine

A program that pays out has to be protected from people who set up second accounts to reward themselves. To check that a referral is genuine we record a small number of technical signals about the sign-up and the payment, and we hold them only as one-way fingerprints: the original values are not stored, and a fingerprint cannot be turned back into the value it came from. We do not publish which signals we use, because doing so would tell the people we are guarding against exactly what to avoid.

What we can tell you is what we do not do with them. They are never used to profile you, to advertise to you, to build a picture of your behaviour, or for any purpose beyond deciding whether a referral is genuine, and they are never sold or shared for anyone else’s marketing. Our legal basis is our legitimate interest in preventing fraud, which Art. 6(1)(f) GDPR and Recital 47 name explicitly. You may object to this processing, though we may then be unable to let you take part in the program.

Some referrals are refused automatically when these checks are clearly failed, and others are held for a member of our team to look at. If a referral of yours is refused, you can ask us to have a person review that decision by writing to [email protected], and you can contest the outcome. Being refused a referral reward does not affect your account, your subscription, or anything else you have paid for.

How long referral data is kept

Records of rewards are kept as long as our accounting obligations require, in the same way as invoices. Where a referral never turns into anything — the link was followed but no account or payment followed — the fingerprints of the address and browser it came from are erased 120 days later, once the offer could no longer have been used. The bare record that a referral was attributed stays, because that record is what stops the same one being counted twice.

There is one deliberate exception to erasure. Where a referral was refused for fraud, its fingerprints are kept on a fraud-prevention list even after the account itself is deleted, because a list that is erased on request stops nobody from simply starting again. That list holds no names, no addresses and no readable email addresses — only one-way fingerprints.

The referral cookie

Following a referral link sets one cookie, sk_ref, and only when you press the button on the referral page — never merely by opening it. It lasts 30 days, is read once when you sign up, and is listed with every other cookie in our Cookie Policy.

Free-trial offer links

Claiming a free-trial offer link sets one cookie, sk_offer, and only when you press the claim button on the offer page — never merely by opening it. It holds only the offer code, lasts 30 days, and is read when you sign up. We record which workspace claimed which offer and whether the trial started, so we can honour the offer and see how a campaign performed. If your account is deleted, that record is unlinked from it and no longer identifies you — only an anonymous count remains.

When you visit SkedCast’s website or application, and only if you agree to it in our cookie choices, we record the pages you view, the links you click on our own site, whether you sign up, start a trial or subscribe, and which partner link or code brought you here. We do this to understand which of our pages and partners bring customers, to credit and pay our partners correctly, and to detect fraud. We collect it through our own website; we do not use a third-party advertising tracker for it.

What we do not record

• Anything you type into a form field, including passwords and payment details.
• The content of your posts, your media or your connected accounts.
• Your activity on other websites.
• A device fingerprint.

We do not store your full IP address. We use it at the moment of the request to estimate your country and to recognise automated traffic, and we keep only a shortened form. A random identifier in a cookie (listed in our Cookie Policy) joins your visits together. The raw visit records are kept for 13 months and are then reduced to daily totals.

Your choices

The cookie banner gives you separate switches for Measurement and Partner attribution, and neither is on until you choose it. You can change your choice at any time from the Cookie preferences control in the footer. The choice you make on skedcast.com also applies to app.skedcast.com. If you decline, we do not set the identifier, and a partner can still be credited only where you type their code, follow their link within a single visit, or tell us you were referred. If your browser sends Global Privacy Control, we do not remember partner links for you.

Legal bases. Your consent for Measurement and Partner attribution; our legitimate interest in preventing fraud; and performance of our contract with a partner when we credit them.

If you were introduced by a partner

If you arrive through a partner’s link or code, we tell that partner that a signup or purchase happened, the plan family and the date. We never give an affiliate or influencer your name, your email address or your workspace name. A customer who referred you may see your workspace name only if you allow it.

If you used a partner link or code you may receive a discount on your first invoice, as the offer shown to you says. We record which link or code you used to apply it.

Reminder emails

If you start creating an account and do not verify your email, we send one reminder about 24 hours later. If you start a checkout and do not complete it, we send up to two reminders, about one hour and about 24 hours after you left, to the person who started it. These are service messages about something you began, and every email has an unsubscribe link. They stop when you finish, unsubscribe or close your account. We keep the record of these journeys for 13 months. We do not email anyone we have no relationship with, and we do not use browsing records to find email addresses.

This section applies if you apply to or take part in our affiliate or influencer programme. The programme’s rules are in the Partner Program Agreement and the Partner Payout Terms.

What we hold about you

• Your name, contact details, country, and the websites and channels you promote on.
• Your application and the version of the agreement you accepted.
• Your links, codes, clicks, and the customers credited to you, shown to you masked or in totals.
• Your earnings, statements and payouts.
• Tax form information. Where our payment provider collects it, we hold only its status; where we collect it, the tax identification number is stored encrypted.
• Your payout method, held by our payment provider as a token. We do not hold bank, card or wallet details.
• Sign-in and security records, including multi-factor authentication.
• The results of identity verification and sanctions screening.
• Fraud-check results about your traffic and your account.

Why, and on what legal basis

• To run the programme and pay you: performance of our contract with you.
• To meet tax, accounting and sanctions duties: legal obligation.
• To prevent fraud and protect the programme: our legitimate interest.

Who receives it

Our payment providers, listed on the Sub-processors page, receive what they need to verify you and pay you. We screen partners against the free public sanctions lists of the United States, the United Nations, the European Union and the United Kingdom; this uses published lists on our own systems and sends your details to no vendor. Tax authorities receive information where the law requires. We never sell partner data.

Automated checks and your right to a person

Automated fraud checks score clicks, signups, payments, partner accounts and payouts, using signals such as the same person on both sides of a referral, automated traffic or a payout account that matches a customer. They can hold or decline a commission or a payout. You can ask for a person who was not involved in the decision to review it, and we will give you the reason recorded. We use one-way fingerprints of identifiers where we can, we do not publish the signals, and we log which version of the rules made each decision. You may object to this processing, though we may then be unable to keep you in the programme.

How long we keep it

• Partner payout, tax and accounting records: 10 years, the longest period we are required to keep invoices in the places we operate.
• Visit and click records: 13 months. A click that supports a commission is kept for up to 24 months while it is needed to answer a dispute.
• Fraud-check results: 24 months after the case closes.
• A declined application: 12 months.
• Your personal fields are pseudonymised 90 days after your relationship ends and your last payout, except what tax and payout records still need.

Where the law lets us keep a record that supports a payment, deleting your account removes your identity from it but not the financial record itself.

We may update this policy from time to time; material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to you. For any privacy question or request, contact our privacy team at [email protected] or write to Alpha Exotic Tech LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.