Privacy Policy
Last updated 29 August 2026.
Megapost lets you write a post once and publish it to several social media accounts. It is operated by Runloop. This page describes exactly what it stores, why it needs it, and how to get rid of it.
What we store
| Data | Why |
|---|---|
| Email address and name | To identify your account and sign you in. |
| Password | Stored only as a bcrypt hash. We cannot read it, and it is never logged or sent anywhere. |
| Time zone | So a post scheduled for 9am goes out at 9am where you are. |
| Access tokens for the social accounts you connect | To publish on your behalf. These are issued by each platform when you authorise Megapost, and are the only way the app can post. |
| Your connected accounts' usernames and profile pictures | To show you which account a post is going to. |
| Post content, scheduling times and publishing results | To publish at the right moment and to show you what happened — including the error a platform returned when publishing failed. |
| Images and videos you upload | To attach to posts. Several platforms fetch media from a public URL rather than accepting an upload, so files are stored at an address that is reachable without signing in. |
What we do not do
- We do not sell or rent your data.
- We do not use it to train machine learning models.
- We do not read the social accounts you connect beyond what is needed to publish and to show your username and picture.
- We do not run third-party advertising or analytics trackers on the app.
Who processes it
Megapost is a small application built on a few services. Each of these handles some of your data on our behalf:
- Neon — the PostgreSQL database holding everything in the table above except uploaded files.
- Google Cloud Run — runs the application itself.
- Cloudflare R2 — stores uploaded images and videos.
- The platforms you connect — X, LinkedIn, Instagram, Facebook, Threads, TikTok, YouTube, Pinterest and Bluesky. When you publish, your post and its media are sent to the platforms you chose, and are then governed by their own terms and privacy policies.
Nothing is shared with anyone else. We use no advertising networks and no third-party analytics.
How long we keep it
Posts are kept until you delete them. Deleting a post archives it, so you keep a record of what went out and when; you can then erase it permanently, which removes it from our database entirely. Deleting your account removes your posts, media, connected accounts and stored tokens.
Removing a post from Megapost is not the same as removing it from a platform. You can ask for both, and the app tells you plainly which actually happened — a copy already published may remain live on a platform even after it is gone from here.
Your control
- Disconnect an account at any time under Accounts. That deletes the stored tokens for it, and Megapost can no longer post on your behalf. You can also revoke access from the platform's own settings, which has the same effect.
- Delete your data by deleting posts and media in the app.
- Delete your account and everything attached to it by emailing us.
- Ask for a copy of what we hold about you, or ask us to correct it, by emailing us.
Security
Passwords are hashed with bcrypt. Access tokens and other credentials are held in the database and are never shown in the interface or written to logs. All traffic is served over HTTPS. No system is perfectly secure, and we do not claim otherwise.
Children
Megapost is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects what we collect or who we share it with, we will update the date at the top and, where the change is significant, tell you in the app.
Contact
Questions, requests, or anything you want removed: support@runloop.digital.