Privacy Policy

Effective October 28, 2026

SocAils is run by Naylor Holdings LLC, Maumelle, Arkansas, USA ("we"). SocAils is a tool for writing, scheduling and publishing posts to social-media accounts you own or manage. This page says what we store, what we do with it, who else touches it, and how to get rid of it.

What we store

  • Your email address and a hashed password. We never store the password itself.
  • Your time zone, taken from your browser, so posts go out at your local time.
  • When you signed up, when you last signed in and used SocAils, how many times you have signed in, and the IP address of your last sign-in, to protect your account.
  • Access tokens for the social accounts you connect (YouTube, Facebook, Instagram, Threads, TikTok, Bluesky, Mastodon, LinkedIn), and for a Bluesky account added with an app password, that app password (never your main password). They are used only to publish and reply on your behalf and to read the results and comments of your own posts.
  • Videos you upload, plus their cover frames, captions, drafts, product links and your brand-voice notes. To keep storage small, SocAils keeps a compressed working copy of each video (about 1080p) and removes the video itself 7 days after its last scheduled post goes out (on the Free plan, the night after it goes out). Captions, cover frames and your post history stay until you delete them.
  • Your posting schedule and a log of what SocAils posted, where, and when.
  • If you send a campaign for review: the reviewer's email address you type, so we can email them the link, and the name, decision and comment they send back.
  • Basic per-post numbers (views, likes, comments) and the comments on posts SocAils made, so you can read and reply to them from the Inbox.
  • If you connect Dropbox or Google Drive: the files in the one folder you point SocAils at, and nothing else.
  • Billing status (plan, renewal date, a Stripe customer id). We never see or store card numbers.
  • If you start a free trial on the website: a fingerprint of your card, supplied by Stripe (not the card number), so each card gets one free trial.
  • If you subscribe in the iPhone or Android app: the App Store or Google Play transaction id and receipt, so your subscription keeps renewing on your account and cannot be used on a second account.
  • If you turn on notifications in the iPhone or Android app: that phone's notification token and which notifications you want.
  • Your answer when SocAils asks to use AI, and when you gave it.
  • One cookie that keeps you signed in. The SocAils app uses no advertising or analytics cookies and no third-party scripts.

What we do with it

  • Publish and schedule the posts you create. SocAils never posts to an account unless you press Post or schedule it yourself.
  • Write caption drafts and suggested Inbox replies with AI, learn your brand voice and style, and guess how a post might do. SocAils asks before it sends anything to an AI company for the first time, and you can turn AI off at any time in Settings → AI; while it is off, nothing is sent. What is sent to Anthropic's API, depending on what you ask for:
    • Caption drafts: frames from your video, or your photo, its file name, your title and notes, what is said in the video or clip, your brand details (name, brand voice and rules, writing samples, website and shop links, featured link, and your product list with its links), the style notes SocAils has learned, and which of your past posts did well (their opening lines, hashtags and posting times, worked out from your posts' statistics; the numbers themselves are not sent). Building the other networks' captions also sends the YouTube text you approved.
    • Suggested replies: your brand name and voice, the network, your post's text, the comment you are replying to, the commenter's name, and your product list with its links.
    • Learning your voice: the writing you paste, and your website's text if you tick that box.
    • The guess of how a post might do (on its own while AI is on, before you post): the post's opening line, hashtags, networks and time, with your past posts' opening lines and hashtags, the network and hour each went out, and whether each did well.
    • Learning your style (on its own while AI is on, after you post): the AI drafts you changed, your final text, your brand details and the style notes so far.
    Anthropic does not use API data to train its models.
  • Hear what is said in a video when AI writes its captions. The sound of its first 10 minutes only (no picture) is sent to Deepgram to turn the speech into text, which then goes to Anthropic with the frames. We opt out of Deepgram using it to train its models.
  • Find the best moments when you ask for clips from a long video. The sound only (no picture) is sent to Deepgram to turn speech into text with timings; the text and a few frames from the video then go to Anthropic to pick the moments and frame each clip, and each clip you keep gets its captions written as above. Nothing is sent until you press Make clips. We opt out of Deepgram using it to train its models.
  • Send you verification codes, password-reset codes, and receipts for your scheduled posts (you can turn receipts off in Settings). No marketing email.
  • If you turn them on in the iPhone or Android app, send phone notifications when posts go out or fail, when clips are ready, and when new comments come in.

What we never do

  • Sell your data, or share it with advertisers or data brokers.
  • Use your connected accounts beyond the permissions you granted when you connected them.
  • Post anything to TikTok as a direct post without you choosing who can see it first.

Who else handles your data

We use these providers to run the service. Each one sees only what it needs for its job:

  • Railway (US) hosts the app and stores your uploads.
  • Netlify (US) serves www.socails.com and passes each request on to the app.
  • Supabase (US) holds some account and staging data and nightly backups.
  • Anthropic (US) writes caption drafts and suggested replies, learns your voice and style, picks the moments for clips and guesses how a post might do, from the data described above, only while AI is on.
  • Deepgram (US) turns the speech in a video into text when AI writes its captions and when you make clips. It receives the sound only, and we opt out of it being used for training.
  • Stripe processes web payments. Card details go to Stripe, never to us.
  • Apple App Store / Google Play process purchases made inside the mobile apps.
  • Apple Push Notification service / Google Firebase Cloud Messaging deliver notifications to your phone, if you turn them on. They get the phone's notification token and the short notification text.
  • Resend delivers our email.
  • Dropbox / Google only if you connect them, and only for the folder you choose.

Where your data is processed

SocAils is run from the United States. Your data is stored and processed in the US by us and the providers listed above, so if you use SocAils from another country, your data is transferred to the US. Where the law requires it, these transfers are covered by our providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.

Why we are allowed to use your data (EU and UK)

  • To provide the service you signed up for: your account, connected accounts, uploads, schedule, posts and billing.
  • Your consent: sending your content to Anthropic and Deepgram for the AI features. You can withdraw it at any time in Settings → AI.
  • Our legitimate interests: keeping SocAils secure, preventing abuse (for example, one free trial per card), and fixing problems.
  • Legal obligations: keeping billing and tax records.

How long we keep it

We keep your data while your account exists, and deleting your account removes it as described below. These things are kept after that:

  • A closed account record: your email address, the date you signed up, your plan and billing details (plan, dates, and the Stripe, App Store or Google Play reference) and your free-trial dates, for our billing and tax records. It has no set end date: it stays until you sign up again with the same email, which replaces it, or ask us to remove it, and then we remove everything tax law does not require us to keep.
  • If you started a free trial on the website: the trial's Stripe reference and, when a card could be read, Stripe's fingerprint of that card (never the card number), with no set end date, so the same card cannot get a second free trial.
  • The App Store or Google Play purchase id that was linked to your account, with no set end date, so the purchase can be used with a new account.
  • How many free AI posts each connected YouTube, Instagram or TikTok account used this month, until the count starts over next month.

Your sign-in record (the time and IP address of your last sign-in, how many times you signed in, and when you last used SocAils) is deleted with your account.

How we protect your data

  • Encrypted connections. Every connection — between your browser and SocAils, and between SocAils and the platforms we post to — uses HTTPS (TLS 1.2 or newer).
  • Encrypted storage. Your data is stored with Railway and Supabase, which encrypt stored data at rest and are independently audited for security (SOC 2 Type II).
  • Access tokens stay on our servers. The tokens for your connected accounts, including your Google / YouTube token, are never sent to your browser and never written to our logs, and they are used only for the posts and replies you make or schedule. Disconnecting an account deletes its token.
  • Passwords are never stored. We keep only a scrypt hash made with a unique random salt.
  • Each account is walled off. Every account's data is kept in its own storage area, and every request is checked against the signed-in account, so one customer can never reach another customer's data.
  • Sign-in protection. Your sign-in cookie can't be read by scripts and is only sent over HTTPS, repeated wrong passwords lock sign-in for 15 minutes, and an email address must be verified before it can connect accounts or publish.
  • Few people, limited access. Only the owner of Naylor Holdings LLC can access our production systems. Passwords and API keys for our providers are kept in our hosts' secret settings, never in our code.
  • Google user data is used only to provide the features you see in SocAils. We never sell it, never use it for advertising, and never use it to train AI models. No person reads it unless you ask us for help, it is needed for security, or the law requires it.
  • If something goes wrong: if we learn of a security incident that affects your data, we will email you without undue delay, and within 72 hours where the law requires it.

YouTube

SocAils uses YouTube API Services. By using SocAils' YouTube features you agree to be bound by the YouTube Terms of Service. Google's Privacy Policy is at google.com/policies/privacy.

Through the YouTube API we access and store: your channel id and name, an OAuth token (kept until you disconnect), the videos SocAils uploads for you, the comments on those videos, and their basic statistics. Statistics for the videos SocAils uploaded are refreshed automatically: every 30 minutes for a video's first 2 hours, every 2 hours until 12 hours, every 6 hours until 3 days, once a day until 30 days, and once a week after that; opening the Posted tab also refreshes them. Comments are refreshed every hour in the background and when you open the Inbox. We keep only the latest fetch and drop cached data that has not been refreshed for 30 days. We do not share YouTube data with any third party except the providers above as needed to run the service, and we do not use it for advertising. When you ask for a suggested reply to a YouTube comment, that comment, the commenter's name and your video's title are sent to Anthropic to write the draft; nothing is sent unless you ask. While AI is on, what your posts' statistics (YouTube's included) show is also sent to Anthropic, never the numbers themselves: with each caption draft, the opening lines, hashtags and posting times of your posts that did well; with each guess of how a post might do, your past posts' opening lines, hashtags, network and hour, and whether each did well.

You can revoke SocAils' access to your Google account at any time at security.google.com/settings/security/permissions. Disconnecting YouTube inside SocAils deletes the stored token.

SocAils' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook, Instagram and Threads

We use Meta's official APIs to publish to the Pages and accounts you connect and to read the comments on those posts. You can remove SocAils from your Facebook settings at any time (Settings → Apps and Websites). Removing it there also sends us a deletion request; the status of that request is shown at socails.com/deletion.

With Sign in with Threads, Threads asks you for five permissions: to see your Threads profile, to publish the posts you create or schedule, to read the replies to your posts, to reply to or hide those replies for you from the Inbox, and to read your posts' numbers (views, likes, replies, reposts and quotes). You can remove SocAils on Threads at any time (Settings → Account → Website permissions → remove SocAils); this also deletes that Threads account and its token from SocAils.

Bluesky and Mastodon

With Sign in with Bluesky you sign in on your Bluesky server's own page; we never see your Bluesky password. Bluesky asks you to give SocAils broad access to your account, and SocAils uses it only to post for you and read your posts' numbers. If you add a Bluesky account with an app password instead, SocAils stores that app password (never your main password) and uses it only for the same things. With Sign in with Mastodon you type your server and sign in there, and SocAils asks for a token to upload your photos and videos, publish your posts, and read your posts and profile; an older server that does not offer these narrower permissions gives full read and write access instead, and SocAils still uses it only for those things. Removing a Bluesky or Mastodon account in SocAils deletes what we stored for it, and a signed-in account's token is also cancelled on its server (on Bluesky, where the server allows it).

TikTok

Posts go to TikTok through the official Content Posting API, either as drafts in your TikTok app or as direct posts. For a direct post you choose the audience (public, friends, followers, or only you) each time, and we honor the comment, duet and stitch settings on your account.

Deleting your data

Delete my account in Account settings, in the app or on the web, removes your password and every brand in the account with its connected-account tokens, uploads, drafts, schedule, post log and metrics, Inbox data, brand voice, notification tokens, AI answer and your sign-in record, and cancels any web subscription. A subscription bought in the iPhone or Android app is billed by Apple or Google, so cancel it there. Posts already published stay on each network until you delete them there. Disconnecting a single social account removes its token. You can also revoke SocAils from each platform's own settings at any time. Deleted data is gone from live systems immediately and from backups within 30 days. What is kept is listed under How long we keep it, and the steps are at socails.com/support.

Your rights

You can ask us for a copy of your data in a portable format, ask us to correct or delete it, or object to or limit how we use it, by emailing support@socails.com. We answer every request within 30 days. If you are in the EU or UK and think we handled your data wrongly, you can complain to your local data protection authority (in the UK, the ICO). If you live in a US state with its own privacy law, such as California, you have the same rights to know, correct and delete your data, and we never sell or share it for advertising.

Children

SocAils is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone under 18.

Changes

When this policy changes we will post the new version here with its effective date. Material changes get an email to your account address.

Contact

Naylor Holdings LLC, Maumelle, Arkansas, USA · support@socails.com

Effective October 28, 2026. Terms of Service · Sign in