Privacy Policy

How Logical Dottech handles data in the wptaskify social publishing service.

What this service does

wptaskify lets you connect your own social media accounts and publish content to them. You choose what to post and when. We act only on your instruction; we never post anything on our own.

Supported platforms: Facebook Pages, Instagram, YouTube, Pinterest, LinkedIn, Telegram, Bluesky, Mastodon and Discord.

What we collect

When you connect an account, we store only what is needed to publish on your behalf:

Data	Why we need it
Account ID and username	To show you which account is connected and let you choose between several.
Display name and profile picture	So you can recognise the account in the interface.
Access token (encrypted)	To publish the content you ask us to publish. Without it we cannot post at all.
Follower and post counts	Shown back to you as basic account information.
A record of what you published	So you can see your posting history, and so a retried request never posts twice.
Media you upload	Some platforms fetch media by URL, so a file has to be hosted for the post to work.

What we do NOT collect

Your social media password. We never see it — access is granted through the platform's own login screen.
Your private messages, direct messages or contacts.
Your friends, followers or connections as personal data.
Payment card details.

How we use it

Only to run the service:

Publish or schedule the content you submit, to the accounts you selected.
Show you your connected accounts and posting history.
Show you performance figures for your own accounts where the platform provides them.
Reply to comments on your own posts, if you use that feature.

We do not sell your data, share it with advertisers, or use it to train any model.

How we protect your data

Access tokens are the most sensitive thing we hold, because they authorise publishing on your behalf. They are protected as follows:

Encryption

At rest: every access token and refresh token is encrypted with AES-256-GCM before it is written to the database. The 256-bit master key is stored in the server environment, never in the database, so a database dump alone cannot reveal any token.
In transit: all traffic uses TLS 1.2 or higher. Requests to social platforms are made over HTTPS only.

Access control

Every request must carry an API key, which is stored only as a SHA-256 hash — the key itself is never stored.
Every account and post is scoped to the user who connected it. One user cannot read, publish to, or delete another user's accounts, even if they know the internal identifier.
Tokens are never returned by our API and never displayed in any interface.

Infrastructure

Data is hosted on Railway, on managed infrastructure with encrypted volumes. The database accepts only authenticated, credentialed connections, and even with those credentials the stored tokens remain encrypted — the decryption key lives in the application environment, not the database.
Administrative access is limited to the service owner and protected by two-factor authentication.
Secrets are held as environment variables, never committed to source control.

Minimisation

We request the narrowest permissions each platform offers for publishing. For YouTube we request only youtube.upload — enough to upload and schedule your videos, and nothing more.
We do not read your private messages, contacts, or any content you did not ask us to publish.
Tokens are deleted immediately when you disconnect an account.

If something goes wrong

If we become aware of a breach affecting your data, we will notify affected users by email without undue delay and revoke the affected tokens, which forces a reconnection and invalidates anything that may have been exposed.

How long we keep it

Connected accounts — until you disconnect them. Disconnecting deletes the stored tokens immediately.
Posting history — kept while your account is active so you can see what was published, and deleted when you close your account.
Uploaded media — kept only as long as the platforms need to fetch it.

Google user data — Limited Use

wptaskify's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for YouTube we request a single permission, youtube.upload, which lets us upload and schedule videos you explicitly submit. We do not request access to your comments, subscriptions, watch history, or any other YouTube data.

We use this access only to deliver the publishing feature you asked for. We do not use Google user data for advertising, we do not sell or transfer it to data brokers or advertisers, and we do not use it to develop, improve or train any AI or machine-learning model.

This service also uses the YouTube Terms of Service, and Google's Privacy Policy applies to data Google holds. You can revoke this app's access at any time at myaccount.google.com/permissions.

Third parties

When you publish, your content is sent to the platform you chose. Their own privacy policies then apply to it:

We use Railway for hosting. We do not use advertising or analytics trackers.

Your rights

You can at any time:

Disconnect any account — removes its stored token immediately.
Request a copy of the data we hold about you.
Request deletion of everything — see Data deletion.
Revoke access from the platform's own side, for example in Facebook Settings → Business Integrations, which immediately stops us posting.

Email logicaldottech@gmail.com and we will respond within 30 days.

Children

This service is not intended for anyone under 13, and we do not knowingly collect their data.

Changes

If this policy changes materially we will update this page and the date below. Continuing to use the service means you accept the updated policy.

Contact

Logical Dottech

Email: logicaldottech@gmail.com