Privacy Policy

Last updated November 1, 2026

Who we are

Tidepost is a social media management service for agencies. It is operated by Vauxine LLC. The company’s address is Newark, DE, United States. Vauxine LLC is organized in Delaware.

Privacy questions go to [email protected].

This policy is effective November 1, 2026.

Two roles

For an agency’s own account — the people who sign up, their names and email addresses, team membership, and billing — Tidepost decides why that data is used. In privacy-law terms, Tidepost is the controller of that account data.

For data an agency brings in about its clients — connected social accounts, posts, comments and messages, and the people who receive reports — the agency decides what is collected and why. Tidepost processes that data only to provide the service the agency asked for.

A Data Processing Agreement is available on request. Email [email protected] and ask for one.

What we collect

Account and team data

When someone creates an account we store their name, email address, time zone, and display preferences, including theme and motion. The password is stored in a form that cannot be read back. Confirmation and password-reset links in email are single-use.

We remember the devices someone uses to stay signed in. Team members have a role in the agency (owner, admin, or member) and, for a client, a role such as admin, approver, editor, or viewer.

Workspace and client data

For each client we store the name and the details the agency enters, plus a logo and brand color if the agency uploads them. Client logins are separate accounts with one of two roles: client approver or client viewer. A connect link lets a client connect their own social accounts. We keep the invitation and which account was connected through it.

Connected social accounts

For each account you connect we store the network, the handle, the display name, the profile photo, whether the connection is active, and when access needs to be renewed. The network’s access credential is held by our social media connection provider. We do not keep it ourselves. A short-lived permission used only to choose a page, organization, or board is not kept.

Content and media

For each post we store the text, the schedule, the channels, and the result on each channel. Media for a post is held by the connection provider for about seven days, unless a post still uses it. Profile photos and client logos are kept in our file storage. Those files go directly from the browser to that storage.

Inbox

We store comments and direct messages from the connected networks: the author’s name and photo, the message, the time, and your replies. A reply can include an attachment. Saved replies the team writes are stored too.

Analytics and follower history

For connected accounts we keep the daily counts the networks provide, such as reach, impressions, and engagements, and a history of follower counts. These stay with the account for as long as that account remains.

Reports

We keep the report, a fixed copy of what was sent, and a PDF when one is made. A share link records how many times it was opened, when it was last opened, and an optional password. Each recipient is stored as an email address, with their own link, a view count, and whether they opened it. A schedule stores who receives the report, the subject, the message, and when it sends. A report that has been sent stays as it was sent.

Billing

Card details are entered with our payment processor. We never see the card number, expiry, or security code. The processor may also collect an email address and a tax id. We keep a record of the plan, whether it is set to end at the close of the paid period, and which promotions have been applied.

AI writing

When you use AI writing, we send the text you ask it to work on, and the client’s voice settings, so it can suggest a rewrite. We do not use client content to train our own models. AI writing does not publish on its own.

Support emails

If you email us, we receive the address you wrote from and whatever you put in the message.

Technical logs

We keep operational logs so we can run and fix the service. Those logs can include an IP address. The signed-in product does not include a separate analytics or error-tracking service.

Marketing site analytics

This website uses Google Analytics, only after you agree. What that collects is in Cookies and analytics.

How we use it

We use this information to:

If you are in the European Economic Area or the United Kingdom, the legal bases we rely on are:

Who we share it with

We do not sell personal data. We do not share it for cross-context advertising.

A list of the companies we use is available on request at [email protected] and in our Data Processing Agreement.

Cookies and analytics

This marketing site uses Google Analytics to understand visits: pages viewed, approximate location, device and browser, and how visitors arrived. Nothing is measured until you choose Accept. We do not send names, email addresses, or anything that identifies an account.

Until you accept, analytics stays off. We do not use advertising cookies. Accept allows analytics only.

Google Analytics does not store the full IP address. Google’s privacy policy is at policies.google.com/privacy. How Google uses data from sites that use its services is at policies.google.com/technologies/partner-sites.

After you accept, Google sets a cookie named _ga and another whose name starts with _ga_. Google gives both a lifetime of two years. Your Accept or Decline choice is remembered for six months.

The signed-in app uses a cookie so you stay signed in. It lasts 30 days. The app also remembers your theme and which client you last opened, on that device. The app does not use Google Analytics.

Cookie settings in the footer reopens this choice. You can also use Google’s browser opt-out at tools.google.com/dlpage/gaoptout.

International transfers

The providers above may process data outside the country you are in. Where a provider offers Standard Contractual Clauses, or the UK or Swiss equivalent, that is the safeguard we rely on.

How long we keep it

While an account is active, we keep the data needed to run it, including posts, inbox messages, analytics history, and reports.

If a trial ends and the agency does not choose a plan, the account becomes read-only. Connected channels are then disconnected 14 days later, with a warning 3 days before that. Posts and reports stay after the channels disconnect. Trial length and plan limits are on the pricing page.

If you cancel a paid plan, it runs until the end of the period already paid. When that period ends, the same read-only period and channel disconnection apply. We do not delete the client at the moment of cancellation.

Archiving a client permanently deletes it 30 days later, including that client’s connection with the social media connection provider and the files we stored for them. A report that has been sent stays unchanged until that account or client is deleted.

There is no button that deletes the whole agency account. Email the privacy address and ask. Removing a team member ends their access.

Our hosting providers may keep their own backups. We do not state a separate backup period here.

Security

The service is encrypted in transit. Passwords are stored so they cannot be read back, and so are sign-in sessions and report links. Network access credentials are held by the connection provider. What a person can do depends on their role. A client login cannot do what an agency admin can do.

Tidepost does not claim a security certification.

Your rights

Depending on where you live, you can ask to access, correct, delete, or export personal data, object to some uses, and withdraw consent for analytics cookies. Withdrawing consent does not affect processing that already happened under another basis.

If the GDPR or UK GDPR applies, we respond within one month, or tell you why we need longer. If the California CCPA/CPRA applies: we collect identifiers (name, email), commercial information (your plan and payment records), professional information (your role and agency), and the customer content you put into the product. Internet activity on this marketing site is collected only if you accept analytics. We do not sell personal information and we do not share it for cross-context behavioral advertising. You can ask to know, delete, and correct, and we will not discriminate against you for asking. California requests are answered within 45 days, with one extension if the law allows it. If Malaysia’s Personal Data Protection Act 2010 applies, you can ask for access and correction, and you can withdraw consent, within the time that Act requires.

If you are a client of an agency that uses Tidepost, contact that agency first. They decide what is done with the client data they brought in. We will help them when they ask.

Send requests to [email protected].

Social network data

Connecting an account opens that network’s permission screen through our social media connection provider. The app named on that screen is the provider’s. Disconnecting a channel in Tidepost removes that access. You can also revoke it in the network’s own settings, where it lists connected apps.

Some networks require the app you authorize to follow their terms, and to explain how to delete data they shared. Those duties sit with the connection provider’s app. Disconnect the channel in Tidepost, remove the app in the network’s settings, and email the privacy address if you believe something remains. We will delete the connected account and the messages and analytics that belong to it when the client is deleted.

Children

Tidepost is not for anyone under 18. We do not knowingly create accounts for people under that age.

Changes and contact

When this policy changes, we update the date at the top of this page. For a change that materially affects how we use account data, we will email the account owner before it takes effect.

Vauxine LLC
Newark, DE, United States