Privacy Policy
Last updated 15 October 2026. This page says what Slidepost stores and who else sees it. It is a product draft, not a law-firm opinion.
Who this is
Slidepost (slidepost.app) runs the studio. Privacy questions go to privacy@slidepost.app.
What we store
- Account: first name, last name, email, a password hash (never the password itself), the time you accepted the Terms and this policy.
- Session: an HttpOnly cookie that keeps you signed in.
- Studio: brand kit, app context, screenshots you upload, workspace, library, queue, and schedule.
- Billing: plan and credit use. Card numbers are handled by Stripe, not stored by Slidepost.
- Publishing: scheduler keys and account ids you paste, only to send the posts you arm.
- Instagram (when you connect it): your Instagram account id, username, and an access token from Instagram Login. See Instagram below.
- TikTok (when you connect it): your TikTok open id, display name, and the access and refresh tokens from TikTok Login. See TikTok below.
- Pinterest (when you connect it): your Pinterest username, the board you post to, and the access and refresh tokens from Pinterest Login. See Pinterest below.
- Product telemetry: errors and feature events go to our own server. PostHog analytics, including a session replay of the studio UI with inputs masked, starts only if you accept the analytics card.
When you click Connect Instagram, you log in on Instagram and allow Slidepost two permissions: instagram_business_basic (read your account id and username, so we can show which account is connected) and instagram_business_content_publish (post the carousels you schedule or post now). We use the token only to publish the images and caption you chose, at the time you chose. We do not read your followers, messages, or other posts, and we do not post anything you did not schedule.
To remove it, open Connections in Slidepost and click Disconnect: the token is deleted from our servers right away. You can also remove Slidepost under Instagram → Settings → Apps and websites. How to delete everything is on Data deletion.
TikTok
When you click Connect TikTok, you log in on TikTok and allow Slidepost two permissions: user.info.basic (read your open id and display name, so we can show which account is connected) and video.publish (post the carousels you schedule or post now to your account). For each post you choose who can see it, whether comments are allowed, and whether it promotes a brand, before anything is sent. We use the tokens only to publish the images and caption you chose, at the time you chose. We do not read your videos, followers, messages, or watch history, and we do not post anything you did not schedule. The tokens are kept on our servers only and are never sent to your browser.
To remove it, open Connections in Slidepost and click Disconnect: the tokens are deleted from our servers right away and nothing more is posted. You can also remove Slidepost in TikTok under Settings and privacy → Security and permissions → Apps and services. How to delete everything is on Data deletion.
When you click Connect Pinterest, you log in on Pinterest and allow Slidepost four permissions: user_accounts:read (read your username, so we can show which account is connected), boards:read (list your boards so you can choose where Pins go), boards:write (create a board called Slidepost if you have not picked one) and pins:write (create the Pins you schedule or post now). We use the tokens only to publish the images and caption you chose, at the time you chose. We do not read your existing Pins, followers, or messages, and we do not post anything you did not schedule. The tokens are kept on our servers only and are never sent to your browser.
To remove it, open Connections in Slidepost and click Disconnect: the tokens are deleted from our servers right away and nothing more is posted. You can also remove Slidepost in Pinterest under Settings → Apps. How to delete everything is on Data deletion.
Why
We use this data to create and keep your account, render carousels, bill the plan you choose, publish when you ask, and see what in the product breaks. The legal bases are the contract (running the account you asked for) and, for optional analytics, legitimate interest in operating the product. We do not sell personal data.
Who else processes it
- Supabase — account identity and, when enabled, profile and workspace storage.
- Stripe — checkout and the billing portal.
- Google Gemini — prompts that include your brand context when you generate ideas or slides.
- OpenAI — cover illustrations on storytelling posts, when that route is used.
- Unsplash — stock photos for slides that need a photo.
- PostHog — product analytics, when a key is set.
- Meta (Instagram) — images and captions you publish through Instagram Login.
- TikTok — images and captions you publish through TikTok Login. TikTok downloads the slide images from our media host.
- Pinterest — images and captions you publish through Pinterest Login. Pinterest downloads the slide images from our media host.
- The scheduler you connect (Postqued, Ayrshare, Buffer, or a custom URL) — images and captions you choose to publish.
How long
Account and studio data stay until you delete the account or ask us to delete them. Server logs and telemetry follow the retention of the host and PostHog. Payment records follow Stripe’s and tax rules.
Your rights
You can ask for a copy of your account data, a correction, or deletion. Email privacy@slidepost.app from the address on the account. If you are in the EEA or UK you can also complain to your local data authority.
Cookies
The session cookie is required to stay signed in. It is not an advertising cookie. PostHog sets its cookie and local storage entry only after you accept the analytics card, and removes them if you decline later.
Your choice is stored in this browser.