How Social360 handles your data

Social360 (“Social360,” “we,” or “us”) is a social-media publishing workspace available at social360.site. This policy explains what information Social360 accesses or collects, where it comes from, how it is used and protected, who it is disclosed to, how long it is retained, and how you can request its deletion. This policy applies to the Social360 website and application. Effective 16 September 2026.

Privacy questions, access requests, and deletion requests can be sent to hello@barq.dev.

Information we collect

Account and profile information. We store the email address, first and last name, and optional profile information you provide, such as a display name, avatar, headline, company, and time zone. If you create a password, Social360 stores a salted password hash rather than the readable password.

Information from social sign-in. If you choose Google, Facebook, or LinkedIn sign-in, the provider sends Social360 the identity information allowed by the sign-in scopes you approve. Social360 uses the verified email address and first and last name to create or match your account. The provider access token used for sign-in is not stored after the sign-in request is completed.

Connected-channel information. When you authorize a publishing channel, we receive and store the OAuth access token, refresh token when supplied, token expiry, platform account identifier, display label, and granted permissions needed to maintain that connection. These credentials are separate from social sign-in credentials.

Content and publishing information. We store the titles, captions, per-channel variants, hashtags, schedules, uploaded images and videos, crops, photo tags, selected destinations, review notes, and delivery results you create. Delivery records can include a platform post ID or URL, attempt count, status, and error message.

Workspace and security records. We keep an activity history of actions such as creating, approving, scheduling, publishing, or deleting content and connecting or pausing channels. If you create an API key, we store its one-way digest and its name, permissions, expiry, and usage metadata; we do not store the readable secret after showing it once.

Technical information. Our servers can process IP addresses, timestamps, request paths, browser and device information, and error details for authentication, rate limiting, security, troubleshooting, and service operation. Social360 does not use advertising trackers or sell this information.

How we use information

We use information to authenticate users; provide and secure the workspace; store, review, schedule, and publish content at your direction; connect and maintain authorized channels; display delivery results and activity history; provide support; detect abuse; troubleshoot failures; and send account-verification or password-reset messages.

We do not sell personal information, use it for targeted advertising, provide it to data brokers, determine creditworthiness, or use connected-channel credentials or content to train Social360-owned machine-learning models.

Google user data Social360 accesses

Google sign-in. If you choose “Continue with Google,” Social360 requests the openid, email, and profile scopes. We access your verified Google email address and your given and family names. We do not use Google sign-in to access Gmail, Google Drive, contacts, calendars, or other Google services.

YouTube channel connection. If you separately connect YouTube as a publishing channel, Social360 requests only https://www.googleapis.com/auth/youtube.upload. We receive the OAuth access token, refresh token, token expiry, and the authorization needed to upload videos. For each upload, Social360 sends the video file, title, description, audience setting, and selected privacy status to YouTube. We store the resulting YouTube video ID, URL, delivery status, and the channel ID and title returned with a successful upload.

Social360 does not request permission to read your YouTube library, subscribers, comments, private analytics, Gmail, Drive files, or other unrelated Google data.

How Social360 uses Google user data

Google sign-in information is used only to verify your email address, create or match your Social360 account, display your name, and sign you in. YouTube authorization is used only to maintain the channel connection, upload the videos you explicitly choose to publish, refresh the authorization when necessary, show whether delivery succeeded, and link you to the resulting YouTube video.

Social360 does not use Google user data for advertising, retargeting, profiling, data resale, credit or lending decisions, or the development, improvement, or training of generalized or non-personalized artificial-intelligence or machine-learning models.

How Google user data is shared

We do not sell Google user data or disclose it to advertising networks, data brokers, information resellers, or AI providers. We disclose it only in these limited circumstances:

Google and YouTube. When you direct Social360 to publish, the selected video and its metadata are sent to YouTube to perform that request.

Service infrastructure. Our hosting, database, and security infrastructure necessarily processes stored or transmitted data to operate Social360. These providers act on our behalf and are not permitted to use the data for their own advertising purposes.

Legal and safety obligations. We may disclose information when required by valid law or when reasonably necessary to protect users, the public, or the security and integrity of Social360. We limit any disclosure to what is necessary.

We do not transfer YouTube OAuth tokens, uploaded videos, or Google sign-in information to OpenAI, Gemini content-generation features, or other connected social networks.

Google API Services User Data Policy

Social360’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Access is limited to providing and improving the user-facing sign-in and YouTube publishing features described above.

Data from other connected platforms

When you connect Meta services (Facebook Pages or Instagram), TikTok, X, LinkedIn, or WhatsApp, Social360 stores the account identifiers and credentials that the platform supplies and uses them to publish content, refresh authorization where supported, identify the chosen destination, and record delivery results. Content is transferred only to the destinations you select. Each platform also processes that content under its own privacy policy.

Optional AI-assisted features

If you ask Social360 to generate trend-based drafts or media, the topic, source excerpts, brand instructions, generation prompt, and target platform names needed for that request are sent to the configured provider, which may be OpenAI or Google Gemini. Generated content is saved to the workspace only after you choose to save or approve it. Do not include sensitive personal information in generation instructions.

Passwords, session cookies, API-key secrets, social-platform OAuth tokens, and Google sign-in information are not included in AI-generation requests. Provider handling is also governed by the selected provider’s terms and privacy policy.

Other service providers

Social360 uses infrastructure providers to host the application, database, cache, and uploaded media. Transactional email is delivered through the configured email provider, currently Resend, which receives the destination email address and message content needed to deliver verification and password-reset messages.

If production error monitoring is enabled, Sentry may process account identifiers, IP addresses, request metadata, and error details needed to diagnose failures. We do not intentionally include passwords, readable API-key secrets, or OAuth tokens in error reports. Publishing-failure notifications may also be sent to configured operator-only Slack or Telegram channels and can include a post title, destination label, and failure reason.

Storage and security

Social360 uses HTTPS to encrypt information in transit. OAuth access and refresh tokens are encrypted at rest with a key stored separately from the database. Passwords and API-key secrets are stored only as one-way hashes or digests. OAuth tokens are not rendered in the user interface. Access to the application and its administrative functions is restricted through authenticated sessions, role checks, and scoped API keys.

No internet service can guarantee absolute security. If we become aware of a security incident affecting your information, we will investigate and provide notice when required by applicable law.

Retention and deletion

Account data. Account, profile, and Google sign-in information is retained while your Social360 account remains active. You can delete your account yourself at any time from Your profile → Delete your account, which removes your profile, posts and scheduled posts, uploaded media, and API keys, and deletes the stored credentials of the social accounts connected to it. Deletion is immediate and cannot be undone, and we email a confirmation to your address. You may also request deletion by emailing hello@barq.dev; we will verify the request and complete it within 30 days unless retention is required for security, fraud prevention, dispute resolution, or law.

Connected channel credentials. OAuth tokens and account identifiers are retained while the connection is maintained. Pausing a channel stops publishing but keeps its stored authorization. Disconnecting a channel, from Channels in the application, deletes the stored access and refresh tokens and the platform-side account identifier, and asks the platform to revoke the authorization where the platform provides a revocation endpoint (currently Google, Meta, TikTok, and X). The record of posts already delivered to that channel is kept so your publishing history stays accurate.

YouTube credentials and channel data. YouTube OAuth tokens and channel identifiers are retained while the YouTube connection is maintained. Disconnecting the channel deletes the stored token and asks Google to revoke it. You can also remove Social360 from your Google Account permissions at any time.

Posts and media. Workspace content and delivery history is retained until you delete it or request account deletion. Media no longer referenced by a post is removed by an automated cleanup process after a short safety window.

Operational records. Security logs, activity records, error reports, email-delivery records, and backups are retained only as long as reasonably necessary for security, troubleshooting, legal obligations, and service continuity, then deleted or de-identified under the relevant provider’s retention cycle.

Cookies and local storage

Social360 uses an essential session cookie to keep you signed in and a CSRF cookie to protect state-changing requests from forgery. The interface stores your theme and sidebar preference in your browser’s local storage. These technologies are used for security and requested interface preferences, not cross-site advertising.

Your choices and rights

You may update profile information in the application, delete content where a delete control is provided, pause or disconnect a connected channel, delete your account from your profile page, revoke a provider’s authorization through that provider, or ask us to access, correct, export, restrict, or delete information associated with your account. Send requests to hello@barq.dev. We may need to verify your identity before fulfilling a request.

Revoking a platform authorization prevents future API access but does not automatically remove posts already published to that platform. Delete published content through the destination platform when you want it removed there as well.

Children’s privacy

Social360 is a professional publishing service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to Social360, contact us so we can investigate and delete it.

Changes to this policy

We will update this page and its effective date when our data practices change. If a change materially affects how we use Google user data or other personal information, we will provide additional notice in the application or by email before the change takes effect when reasonably possible.

Contact

For privacy questions or requests, email hello@barq.dev. Include the email address associated with your Social360 account and enough detail for us to identify the request; do not send passwords, OAuth tokens, or API keys.