Privacy Policy

Naked Post is operated by Tansfom, LLC, which is the data controller for the information described here. If you have questions about this policy or your data, contact us at nakedpost@tansfom.com or by post at Tansfom, LLC, 46539 Mission Blvd #1005, Fremont, CA 94539, United States.

We collect what we need to run the service, nothing more:

• Account info — your email and an auth identifier, via Firebase Authentication.
• Connected social accounts — profile identifiers and usernames for any LinkedIn or X account you connect.
• OAuth access and refresh tokens for those accounts, stored encrypted, used only to publish on your behalf.
• The drafts, scheduled posts, and publish history you create in the app.
• Any images or video you upload, stored in Firebase Storage for publishing.
• Beta signup info (name and email), if you join the waitlist.
• Product feedback you submit through the in-app feedback form.
• Basic technical and log data needed to operate and secure the service.
• Usage analytics — pages visited, approximate location (from IP), and general device and browser info, collected via Google Analytics to understand how the product is used. Only if you agree: we ask before setting any analytics cookie, and nothing is collected unless you accept. This is aggregate usage measurement; we don't use it to build advertising profiles, and the content of your posts is never sent to it.

• To provide the service: authentication, scheduling, and publishing your posts.
• To run the private beta: sending invites, applying beta post caps, and letting an admin review feedback and signups.
• To maintain security and prevent abuse of the service.

We don't sell your personal data. We don't use your posts to train or generate AI content — that's the point of the product.

If you're in the UK or EEA, UK GDPR and GDPR require us to name a legal basis for each thing we do with your data:

• Performing our contract with you — your account, drafts, connected accounts, and publishing. Without this data there is no service to provide.
• Your consent — analytics, which we ask for before collecting and which you can withdraw at any time from "Cookie settings" in the footer.
• Our legitimate interests — keeping the service secure, preventing abuse, and running a beta we can support (post caps, invites, reviewing feedback).

You have rights over your data, including access, correction, deletion, and a portable copy of it. You can download everything we hold about you, and delete your account outright, from the Account page — no need to ask. For anything else, email us at the address above and we'll sort it out. You can also complain to your local data protection authority.

• Firebase and Google Cloud — authentication, database, file storage, and hosting for the app.
• Google Analytics (via Firebase) — usage measurement, as described above, and only with your consent. It sets cookies in your browser to recognize repeat visits. You can accept or decline when first asked, and change your mind at any time via "Cookie settings" in the footer of any page — declining stops analytics from loading at all.
• LinkedIn and X — when you connect an account and publish, your post text and any images or video attached to it are sent to that platform under its own terms. Once posted, that platform's policies govern the content, not this one.
• Stripe — payments. Your card details go to Stripe directly and never reach our servers; we store only a customer reference and the state of your subscription.
• Resend — delivers the emails we send you (sign-in links, invites, account and billing notices, and product updates if you opted in). Your email address is shared with it for that purpose.
• Sentry — error reporting, so we learn when something breaks. Reports carry the technical context of the failure and are configured not to include personal details.

Access tokens for your connected accounts are used only to publish and manage the specific channels you authorized — nothing else. You can disconnect any connected account at any time from the Channels page, which removes its stored tokens.

We keep your account and drafts while your account is active. Publish history is kept for 30 days: posts older than that are deleted from Naked Post automatically, along with any media only they referenced. This only affects your history here — the posts themselves stay up on LinkedIn or X, which we don't touch. The History page shows the current window. You can permanently delete your account yourself at any time from the Account page — that removes your profile, drafts, scheduled posts, publish history, uploaded media, and the stored tokens for every connected account, and cancels any subscription so nothing further is charged. We keep a minimal record that the account existed — the email address, when it was created and deleted, and the billing reference — for seven years, so we can answer a later question about it and meet record-keeping obligations; nothing you posted is kept. Payment records stay with Stripe under its own policy. An account that has had no subscription for 90 days is deleted the same way, after three email notices — at the start, 30 days before, and 7 days before — each pointing to the export. You can also contact us at the email above and we'll take care of it.

• OAuth tokens and other sensitive credentials are encrypted at rest.
• Access is controlled: signup is invite-only during the beta, and admin areas are restricted to designated admin accounts.

Naked Post isn't for anyone under 16, and we don't knowingly collect data from them. If you believe a child has given us their data, email us at the address above and we'll delete it.

We may update this policy as the product changes. The "Last updated" date at the top of this page reflects the most recent revision.