Privacy policy

Last updated: 7 October 2026

This policy explains what information PublishArc (“we”, “us”) collects when you use this website and the PublishArc workspace, how we use it, and the choices you have. Questions: contact the site owner.

Information we collect

• Account details: your name, email address and a protected (hashed) version of your password. If you sign in with Google, we receive only your name, email address and whether Google has verified it.
• Sign-in history: when you sign in, how (password, Google or invitation link), your country and the type of device and browser. We do not store your IP address.
• Email preferences: whether you ticked “Email me tips and product news”. We only send product news if you did, and every such email lets you stop them.
• Access requests: the details you enter in the early-access form.
• Content you add: photos, videos, captions, schedules and settings you create or import from Google Drive.
• Connected accounts: when you connect Facebook, Instagram, Threads, YouTube, TikTok, Bluesky or Google Drive, we receive the access tokens those services issue and basic profile information such as the account name and picture. Tokens are encrypted before they are stored.
• Publishing results: post links and public counts such as views, likes and comments that the platforms return for posts published through PublishArc.
• Technical data: limited logs needed to run and secure the service, such as request times and error messages.

How we use it

• To keep your account secure and help you when something goes wrong (sign-in history).
• To publish your content to the accounts you choose, at the times you choose.
• To write captions with AI when you ask for it. The image or a still frame of the video, the file name and your brand voice settings are sent to the AI provider selected in your workspace (Cloudflare Workers AI by default, or Google Gemini if you add your own key).
• To show you results, send alerts you have configured, and keep the service secure.

We do not sell your information, and we do not use your content to train AI models.

Platform data

We access each social platform only with the permissions you grant and only to publish posts, read the results of those posts, and keep your connection working. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove PublishArc's access at any time in each platform's settings, or with “Disconnect” in PublishArc.

Where data is stored

PublishArc runs on Cloudflare. Workspace data is stored in a Cloudflare D1 database and media in Cloudflare R2 storage. Data may be processed in countries other than your own.

How long we keep it

We keep your data while your account is active. When you delete your workspace, its database records and media files are deleted immediately; copies may remain in backups for up to 30 days. Access requests that do not become accounts are deleted within 12 months.

Your choices and rights

• Download a copy of your workspace data in Settings → Your data.
• Disconnect any account in Brands & channels.
• Delete your workspace in Settings, or follow the data deletion instructions.
• Depending on where you live, you may have further rights to access, correct or delete your data, or to object to processing. Contact us to use them.

Security

Passwords are hashed, platform tokens and API keys are encrypted, and connections use HTTPS. No method is perfectly secure, so please use a strong, unique password.

Changes

We will update this page if our practices change and show the new date at the top.