Privacy policy

Last updated 2026-10-08

Outboxer is a social media publishing tool operated by Outboxer (“we”, “us”). Teams use it to draft, review, approve, schedule and publish posts to their own social accounts, and to read and answer the comments and messages those posts receive. This policy explains what data we handle, why, and the choices you have.

Data we collect

Your account

Your name, email address, timezone, locale and optional avatar URL.
Sign-in records: magic-link tokens, session cookies, API keys you create (stored hashed), and the IP address and time of requests, kept in server logs.
Your organization, workspaces and the role you hold in each.

Content you create

Posts, drafts, comments, approvals, schedules, campaigns, brand and design-system settings, and the images and videos you upload.

Connected social accounts

When you connect an account on X, LinkedIn, Facebook or Instagram, you sign in on that platform and choose what to grant. We then receive and store:

Access and refresh tokens, encrypted at rest.
Profile details of the connected account or Page: platform user or Page id, name, handle and profile picture, and the permissions granted.
For posts published through Outboxer: the post ids and links, and performance metrics such as impressions, reactions, comments and clicks.
If you use the inbox: public comments and replies to those posts and, where you grant it, direct messages to the account, including the sender’s public name, handle and profile picture.

We only request the permissions needed for the features you use, and we access platform data only on behalf of the account owner who connected it.

How we use data

To provide the service: publish and schedule posts you approve, show previews and analytics, and collect replies and messages into your inbox.
To keep connections working: refresh tokens before they expire and tell you when an account needs reconnecting.
To secure the service: authenticate users, enforce permissions, prevent abuse and investigate incidents.
To contact you about your account, such as sign-in links, approvals you are asked for and service notices.

We do not sell personal data, use it for advertising, or use data from social platforms to build profiles of people. We do not use your content or platform data to train machine-learning models. Data obtained from a platform is used only to provide Outboxer features to the account that connected it, in line with that platform’s developer terms.

Automations and AI agents

Outboxer has an API and an MCP server so that you can connect your own automations and AI agents. Those tools act with the API key and permissions you give them. Any data you send to a third-party AI provider through your own agent is governed by your agreement with that provider.

Social platforms (X, LinkedIn, Meta): the content you publish and the requests needed to publish it, read metrics and read or send replies.
Service providers that host and run Outboxer for us, such as cloud hosting, storage and email delivery, under contracts that limit them to processing data on our instructions.
Your organization: members of your workspaces see the content and inbox of those workspaces, according to their role. Webhooks you configure send event data to endpoints you choose.
Legal reasons: when required by law, or to protect the rights, safety or property of our users, the public or us.

How long we keep data

Account and workspace data: while your account is active, and deleted within 30 days after you ask us to close it, apart from what we must keep by law.
Social tokens: deleted immediately when you disconnect an account, or when the platform tells us you removed the app.
Content, metrics and inbox items: kept with the workspace until you delete them or the workspace is deleted.
Server logs, including IP addresses: about 14 days.

Deleting your data

Disconnect a social account: in Outboxer, open Channels and choose Disconnect. We delete its tokens straight away.
Remove the app on the platform: on Facebook go to Settings & privacy → Settings → Apps and websites, and remove Outboxer. On Instagram go to Settings → Apps and websites. On LinkedIn go to Settings → Data privacy → Permitted services. On X go to Settings → Security and account access → Apps and sessions → Connected apps. When Meta notifies us, we disconnect the matching channels, delete their tokens and give you a confirmation code to check the status of the request.
Delete everything: email [email protected] from your account’s address and ask us to delete your account and data. We confirm when it is done, within 30 days.

Security

Data is encrypted in transit with TLS. Social tokens and other secrets are encrypted at rest, and API keys are stored hashed. Each organization’s data is isolated at the database level. Access is limited to people who need it to run the service. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your data protection authority. To use these rights, email [email protected]. Where your organization manages your account, we may pass your request to its administrator.

People who are not Outboxer users but whose comments or messages appear in a customer’s inbox can contact us too; we will help or refer the request to the customer who controls that data.

International transfers

Our servers and service providers may be in other countries than yours. Where the law requires, we use safeguards such as standard contractual clauses.

Children

Outboxer is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children.

Changes

We will post changes on this page and update the date above. For significant changes we will also tell account owners by email.

Contact

Outboxer
[email protected]