Privacy Policy

Illumipost (illumipost.com) is a social media planning and publishing service operated by BoringHAUS ("we"). This policy explains what we collect, why, and the choices you have.

What we collect

• Your account: name, email address, and a password hash, or your Google profile if you sign in with Google.
• Connected social accounts: when you connect Bluesky, Mastodon, LinkedIn, X, Facebook, Instagram or Threads, we store the account's id, handle, display name and profile picture URL, and the access tokens the network gives us. Tokens are encrypted at rest and are never shown to anyone, including you.
• Your content: posts, drafts, schedules, images you upload, brand voice settings, and the results of AI features you use.
• Billing: your plan and subscription status. Card details are handled by Stripe; we never see or store them.
• Waitlist: if you join the launch waitlist, your email address, when you joined and which page you joined from. We use it only to tell you when Illumipost opens, and delete it on request.
• Technical data: logs needed to run and secure the service, such as request times and error codes. We don't use advertising trackers.

How we use it

• To publish the posts you schedule, to the accounts you chose, at the time you chose.
• To run the AI features you ask for: drafting, rewriting, hashtags and alt text.
• To send service emails: sign-in links, failed-post alerts, reconnect reminders and an optional weekly digest.
• To bill your subscription and apply plan limits.

We use data from connected networks, including Meta's Facebook, Instagram and Threads, only to provide these features to you. We don't sell personal data, use it for advertising, or share it with data brokers.

Who processes data for us

• Cloudflare: hosting, database, file storage and AI gateway.
• Anthropic: generates AI drafts and rewrites from the text you submit to AI features.
• Stripe: payments.
• Resend: email delivery.
• The social networks you connect, which receive the posts you publish.

How long we keep it

We keep your data while your account is open. Disconnecting a social account deletes its tokens immediately. Deleting your account deletes your workspaces, posts, media and connected accounts within 30 days, except records we must keep for tax or legal reasons.

Your choices and rights

• Disconnect any social account at any time from the Accounts page, or by removing Illumipost in that network's settings.
• Turn off the weekly digest from the link in any digest email.
• Ask us for a copy of your data, a correction or deletion by emailing privacy@illumipost.com. See also Data deletion.

Security

Access tokens are encrypted with AES-GCM, all traffic uses HTTPS, and each workspace's data is kept separate from every other workspace.

Changes and contact

If we change this policy we'll update the date above and, for significant changes, email you. Questions: privacy@illumipost.com.