Privacy Policy
Falcon Spido ("we", "our", "us") operates a social media content scheduling and publishing tool that lets users connect their own YouTube, Facebook, Instagram, X (Twitter), TikTok, and Telegram accounts to upload, schedule, and publish content they create. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have.
By creating an account or connecting a platform to Falcon Spido, you agree to the collection and use of information as described in this policy.
1. Information We Collect
1.1 Account information
- Your email address, used to log in and identify your account.
- Basic profile information returned by any platform you connect (e.g. your name and public profile picture), where that platform provides it as part of the connection process.
1.2 OAuth access tokens
When you click "Connect" for a platform (YouTube/Google, Facebook, Instagram, X, TikTok, or Telegram), you are redirected to that platform's own login page. You approve the specific permissions listed there. We never see or store your password for that platform — we only receive an OAuth access token (and, where the platform issues one, a refresh token) that lets our app act on your behalf, limited strictly to the permissions you approved.
These tokens are encrypted at rest using Fernet symmetric encryption before being stored in our database. They are decrypted only in memory, at the moment a request is made to the relevant platform's API on your behalf (e.g. publishing a video you uploaded).
1.3 Content you upload
- Video files, thumbnails, captions, titles, descriptions, and hashtags you provide for scheduling or publishing.
- These files are stored in our object storage bucket (Cloudflare R2 / S3-compatible storage) so they can be retrieved at the scheduled publish time.
1.4 Data we read from connected platforms
Strictly limited to what each connected platform's approved scopes allow:
- YouTube/Google — permission to upload videos to your channel, and your basic Google profile info.
- Facebook — the list of Facebook Pages you manage, and engagement data for those Pages, so you can choose where to post.
- Instagram — basic account information for the Instagram Business/Creator account connected to your Facebook Page.
- X (Twitter) — your basic profile and permission to read/post tweets on your behalf.
- TikTok — your basic account info and video list, as permitted by the scopes you approve.
- Telegram — the identity data provided by Telegram's Login Widget (name, username, profile photo) to verify it's really you.
We do not access private messages, contacts, or any data outside the scopes listed above.
1.5 Usage and technical data
- Log data such as IP address, browser type, and pages visited, for security and debugging purposes.
- Records of scheduled/published posts (status, timestamps, and the resulting post URL or error) so you can see a history of your activity.
2. How We Use Your Information
- To authenticate you and keep you logged in.
- To publish or schedule the content you create, to the platforms and accounts you explicitly connect and select.
- To show you a dashboard of your connected accounts and post history.
- To maintain, secure, and improve the service (e.g. diagnosing failed uploads).
- To communicate with you about your account or changes to this policy.
We do not sell your data. We do not use your data for advertising, and we do not share your connected-account tokens with any third party except the platform the token belongs to (i.e. your Google token is only ever sent to Google's API, your Facebook token only to Meta's API, and so on).
3. Where Your Data Is Stored
- Database: MongoDB (account records, connected-account metadata, encrypted tokens, post history).
- File storage: S3-compatible object storage (video files and thumbnails).
- Hosting: our application servers, reachable only over HTTPS.
4. Data Retention
We retain your account data and connected-account tokens for as long as your account is active. If you disconnect a platform, its token is deleted immediately. If you delete your account, all associated data — tokens, uploaded content records, and post history — is permanently deleted within 30 days. See our Data Deletion Instructions for how to request this.
5. Your Rights
- Access — you can view your connected accounts and post history at any time from your dashboard.
- Revoke — you can disconnect any platform at any time from within Falcon Spido, or directly from that platform's own security/app-permissions settings.
- Delete — you can request full account and data deletion at any time (see Data Deletion Instructions).
- Correction — you can update your account email by contacting us.
6. Third-Party Platforms
Your use of each connected platform (YouTube, Facebook, Instagram, X, TikTok, Telegram) is also governed by that platform's own privacy policy and terms of service. We are not responsible for how those platforms handle data once content is published to them.
7. Children's Privacy
Falcon Spido is not directed at children under 13 (or the minimum age required by your connected platforms, whichever is higher). We do not knowingly collect data from children.
8. Security
Access tokens are encrypted at rest. All traffic to and from Falcon Spido is served over HTTPS. Access to production data is restricted to the service itself; we do not manually browse user tokens or content.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and — where required — we will notify you directly.
10. Contact Us
Questions about this policy or your data can be sent to santomani5750@gmail.com.