Privacy Policy

Effective date: August 24, 2026

This Privacy Policy explains what data Crossposter (stoian.ai, the "Service"), operated by Dmitrii Stoian ("we", "us"), collects, how it is used and how you can control it.

1. Data we collect

• Account data — your name, e-mail address and password hash when you sign up on the web; your Telegram user ID and display name when you use the Telegram Mini App or bot.
• Connected platform data — when you connect a social account via its official login (Instagram, TikTok, YouTube, Telegram etc.) we receive and store the access/refresh tokens granted by that platform, your platform user ID, username, display name, avatar and basic account type. We request only the permissions needed to publish content on your behalf and to read basic profile information.
• Content data — the text, images and videos you upload for publishing, your scheduling settings and the resulting post identifiers and links returned by the platforms.
• Technical data — server logs (IP address, browser type, timestamps) and error reports needed to keep the Service secure and reliable.

2. How we use data

• To publish and schedule content to the accounts you selected, on your explicit instruction.
• To show you the status and results of your publications.
• To keep connections healthy (e.g. refreshing tokens, notifying you when a connection needs to be renewed).
• To operate, secure and improve the Service and to provide support.

We do not sell your data, do not use your content or platform data for advertising, and do not use it to train machine-learning models.

3. Third-party platforms

To provide the Service we exchange data with the platforms you connect through their official APIs (Meta Platforms for Instagram, TikTok, Google for YouTube, Telegram). Each platform processes your data under its own privacy policy. We use YouTube API Services in accordance with the Google Privacy Policy. We do not share your data with any other third parties except infrastructure providers (hosting, e-mail delivery) bound by confidentiality obligations, or where required by law.

4. Storage and security

Platform access tokens are stored encrypted (AES-256-GCM) and are never displayed in the interface or shared. Data is transmitted over HTTPS. Access to production systems is restricted to the Operator. Uploaded media are stored only as long as needed for publishing and are removed after the retention period below.

5. Retention and deletion

• Platform tokens are deleted immediately when you disconnect an account or delete your Crossposter account.
• Uploaded media are deleted within 30 days after publication; publication records (post IDs, links, status) are kept while your account exists.
• Server logs are kept for up to 90 days.

Data deletion requests. You can delete all your data at any time: disconnect accounts on the Connections page and delete your account in Settings, or e-mail support@stoian.ai from the address associated with your account. Deletion is completed within 30 days and confirmed by e-mail. If you remove Crossposter from your Instagram, TikTok or Google account settings, we receive the platform's deauthorization signal and delete the related tokens and data automatically.

6. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Contact us at the address below to exercise these rights.

7. Cookies

The web application uses only strictly necessary cookies and local storage to keep you signed in. We do not use advertising or cross-site tracking cookies.

8. Children

The Service is not intended for persons under 18 and we do not knowingly collect their data.

9. Changes

We may update this Policy; the current version with its effective date is always available at this address. Material changes are announced in the Service.

10. Contact

Data controller: Dmitrii Stoian, Crossposter (stoian.ai). E-mail: support@stoian.ai.