Privacy Policy

Who we are

Preflight is a social media scheduling tool operated by ADMI ENTERPRISES s.r.o., Nové sady 988/2, 602 00 Brno, Czech Republic, company number 29581010 ("we", "us"). We are the data controller for the personal data described in this policy.

For any question about this policy or your data, write to [email protected].

What Preflight does

Preflight lets you write a post once, attach a photo or a video, and publish or schedule it to the social media accounts you have connected. To do that we hold your account details, the content you create, and the access tokens the platforms issue when you connect an account.

What we collect

Account information

• Your email address and display name.
• A cryptographic hash of your password. We never store the password itself and cannot recover it.
• Session records: a session token, the IP address and browser user agent of the device you signed in from, used to keep you signed in and to rate-limit abuse.

Connected social accounts

• Your identifier, username, display name and profile picture on each platform you connect.
• The OAuth access and refresh tokens that platform issued, together with the permissions you granted. These tokens are encrypted at rest using AES-256-GCM with a key held only in our server environment, never in the database.

We request the narrowest permissions each platform offers for publishing. We do not read your existing posts, your messages, or the list of who follows you. Where a platform reports it, we do store how many followers each connected account has, once a day, so the analytics screen can show whether that number is going up — it is a total, never the people behind it. Those daily totals are kept for as long as your plan keeps figures and are deleted with the account. The profile details we store from a platform are refreshed, or deleted if no longer available, at least every 30 days.

Content you create

• Post text, links, scheduling times and per-platform options.
• Images and videos you upload, or that we fetch on your behalf from a URL you supply.
• After publishing: the identifier and public link of the resulting post on each platform, plus any error the platform returned.

API keys

If you create an API key we store its name, a non-secret prefix and a hash of the key. The key itself is shown once at creation and is never stored, so we cannot recover it for you.

What we do not collect

• No advertising or tracking cookies. The only cookie we set keeps you signed in.
• No third-party analytics or advertising networks.
• No payment card details.

Why we use it, and on what legal basis

• To provide the service — creating your account, storing your posts, publishing them to the platforms you chose. Legal basis: performance of a contract with you.
• To keep the service working and secure — retrying failed publications, diagnosing errors, limiting abusive traffic. Legal basis: our legitimate interest in a reliable and secure service.
• To meet legal obligations where applicable. Legal basis: compliance with a legal obligation.

We do not sell your personal data, we do not share it with anyone except the processors and platforms described below, and we do not use your content or data to train machine learning models or for advertising.

YouTube API Services

Preflight uses YouTube API Services to connect your YouTube channel, upload the videos you schedule, and show you how they performed. Through those services we access and store your channel's identifier, name and profile picture; the OAuth tokens Google issues when you connect the channel; the identifier and title of each video you published through us; and that video's view, like and comment counts together with its watch time, average view duration and average percentage viewed. We do not read videos you did not publish through Preflight, and we do not access anyone else's channel. Google's handling of your data is described in the Google Privacy Policy.

You can revoke Preflight's access to your Google account data at any time via the Google security settings page. In addition to our own deletion process described below, disconnecting YouTube in Settings deletes the stored tokens and channel details immediately.

Preflight's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else processes your data

We use a small number of service providers as processors. They act on our instructions and are bound by contract.

• Railway — application hosting and the PostgreSQL database.
• Cloudflare (R2) — storage for the images and videos you upload.

Separately, when you publish a post we transmit that post — its text and media — to the social platform you selected (for example YouTube, TikTok, Instagram, Facebook, Threads, Bluesky, Mastodon, Pinterest, Telegram, Discord or LinkedIn). Those platforms are independent controllers of what happens on their own services, and their own privacy policies apply to the published content.

Some of these providers operate outside the European Economic Area. Where data is transferred outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Account and connected accounts — until you delete the account or disconnect the platform. Disconnecting deletes the stored tokens immediately.
• Uploaded images and video — the file itself is deleted from our storage a short period (currently 7 days) after every selected platform has finished with it. The published post continues to exist on the platform. We keep a thumbnail and basic details so your history still makes sense.
• Posts and publication results — until you delete them or close your account.
• Server logs — a rolling window of 30 days, used only for diagnosing faults and investigating abuse.

Security

• All traffic is encrypted in transit with TLS.
• Social media tokens are encrypted at rest and never sent to your browser.
• Passwords are stored only as salted hashes.
• Uploaded media is stored in a private bucket. Where a platform needs to fetch a file itself, we issue a short-lived signed link rather than making the file public.
• Every request is scoped to your workspace before any data is read or written.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the supervisory authority as required by law.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we process it;
• receive your data in a portable, machine-readable format;
• withdraw consent where processing is based on consent.

To exercise any of these, email [email protected]. We respond within one month.

You can also revoke Preflight's access at any time from each platform's own settings — for example the Google security settings page for YouTube, Settings → Apps and websites (Business integrations) on Facebook and Instagram, or Settings and privacy → Security → Apps on TikTok. Doing so stops us publishing on your behalf immediately.

If you believe we have handled your data improperly you may complain to your local supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.cz.

Deleting your account

You can delete your account from Settings, or by emailing [email protected]. Either way we delete your account, your connected account tokens (including data obtained from platform APIs such as YouTube API Services), your posts and your stored media. Content already published to a social platform is not affected — you control that through the platform itself.

Children

Preflight is not intended for anyone under 16, and we do not knowingly collect data from children.

Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes affecting how we use your data will be notified to you by email before they take effect.