Privacy policy

Who this covers

Two kinds of people use Cosmic Social: the agencies and social media managers who hold an account with us, and the people they invite to approve posts for a client. This policy applies to both.

If you are a customer of one of our agencies and a post about your business was scheduled here, the agency is the one who decided what to publish. We process that content on their instructions.

What we collect

• Account details. Your email address, and a password if you set one. If you sign in with Google we receive your email address, name and profile picture from Google — not your Google password.
• Client and brand information. Whatever you enter about the businesses you manage: name, brand voice, facts about the business, content themes, topics to avoid, posting schedule.
• Social account connections. The access tokens the platforms issue, the account identifier and name, and when the token expires. What those tokens let us do is set out in the next section.
• Content we generate and publish. Drafts, reviewer notes and scores, your edits, approval decisions, the final text, any image or video made for the post, and the identifier the platform returns once it is published.
• Media you upload. Images and video you add to the library, stored in our file storage and served to you through short-lived signed links.
• Performance data. Public metrics for posts we published on your behalf — impressions or reach, engagement, clicks — read back from the platform’s own reporting.
• Billing details. Handled by Stripe. We keep a customer and subscription identifier and never see your full card number.
• Operational records. Sign-in times, IP address, browser, a log of what the posting engine did, and a record of every email we tried to send you — for security, for billing accuracy and for support.

What connecting a social account lets us do

When you connect an account we ask the platform for a specific, named set of permissions. Nothing here is a general grant: each one exists for a feature, and the list below is the whole list — generated from the same configuration the app sends to the platform, so it cannot describe a permission we do not ask for, or omit one we do.

Across every platform: we publish only posts a person has approved in Cosmic Social, or that you have configured to publish automatically. We do not read your private messages, your personal feed, your friends or connections, or anything belonging to accounts you have not connected. We do not post to personal profiles. We do not sell, rent or share what we read from a platform with anyone, and we do not use it to train any model.

You can disconnect at any time, in Cosmic Social or from the platform’s own settings. See deleting your data.

YouTube API Services

Cosmic Social uses YouTube API Services. By connecting a YouTube channel you are also agreeing to the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy.

You can revoke our access to your Google account at any time, without asking us, at myaccount.google.com/permissions. Doing so stops us uploading anything further immediately. It does not delete what we already hold — for that, see deleting your data.

We store the authorisation token, your channel name and channel id, and the identifier and status of any video we uploaded for you. We delete stored YouTube data within 30 days of you disconnecting the channel, closing your account, or asking us to.

Posts are written by AI

The copy, images, voiceover and video are made by machine learning models run by other companies: Anthropic writes and reviews the copy, Google makes the images, Resemble AI speaks the voiceover, and Shotstack assembles the video. Exactly what each one receives, how long it keeps it and whether it may train on it is set out under who we share it with.

The voiceover on every video is a synthetic voice cloned from our founder’s own voice. Nobody’s voice is recorded or cloned by Cosmic Social, and no customer audio is sent to Resemble.

We do not use your content, your clients’ brand information or your posts to train any model of our own. Whether a provider may is decided by its own terms, so we say it provider by provider rather than promise it for all of them: Anthropic, Resemble and Google (on the paid tier we use) do not; Shotstack’s terms do not cover the ordinary rendering we use it for, so we make no promise about it.

Generated posts can be wrong. That is why approval exists, and why a person decides what is published under a client’s name.

Cookies

We use cookies for one thing: keeping you signed in. They are set by our authentication provider, Supabase, and without them you would have to log in again on every page.

There is no analytics, no advertising pixel, no session recording and no third-party tracking script anywhere in Cosmic Social. We do not track you across other websites, and there is nothing here to opt out of. If that ever changes, this section changes with it and we will ask before setting anything new.

Blocking the sign-in cookie will stop you being able to log in. Stripe sets its own cookies on its own checkout pages when you pay; those are covered by Stripe’s privacy policy, not this one.

How we use it

• To generate, review, schedule and publish posts you have asked us to.
• To show you what was published, what failed, and how it performed.
• To take payment, and to enforce the limits of your plan.
• To keep the service working and secure: detecting abuse, diagnosing failures, and telling you when a connected account needs reconnecting.

We do not sell your data, and we do not share it for advertising.

Who we share it with

Only the providers we need to run the service, each for a specific job:

• Supabase — database, authentication and file storage. Receives: Everything described in this policy. It is where the service keeps its data. Keeps it: For as long as we keep it (see "How long we keep it"). Database backups are kept for at most 30 days. Training: Not applicable: it stores data and runs no models on it. Where: Canada (ca-central-1). Its terms.
• Netlify — application hosting. Receives: Every request to the service, including your IP address and browser. Keeps it: Function logs for up to 7 days. Training: Not applicable: it hosts the application. Where: United States (us-east-1). Its terms.
• Anthropic — writing and reviewing post copy, studio scripts and research. Receives: The brand information for the client a post is for, recent post history, drafts being reviewed, topics you type into Studio, and research questions about the brand — which Anthropic may pass to its web-search provider to answer. Keeps it: Deleted within 30 days. Content flagged for a usage-policy violation is kept for up to 2 years. Training: Not used to train its models, under its commercial terms. Where: Not stated by Anthropic (a US company). Its terms.
• Google — generating images; speech when resemble is unavailable, and voice previews. Receives: Image prompts, which carry the brand name, style and colours; and, for a voice preview or when Resemble is unavailable, the script or line to be spoken. Keeps it: Prompts and outputs kept for 55 days for abuse monitoring. Training: Not used to improve Google’s products on the paid tier, which is what we use (checked 5 October 2026). Where: Not fixed: Google may process and cache it in any country. Its terms.
• Resemble AI — speaking the voiceover for video. Receives: The voiceover script for each clip. The voice is a synthetic voice cloned from our founder’s own voice; no customer’s voice or audio is sent to Resemble. Keeps it: Scripts and generated audio are not kept after delivery. Training: Not used to train its general models, under its privacy policy. Where: United States. Its terms.
• Shotstack — rendering video. Receives: The script and captions, brand name and colours, and links to the images, voiceover and any audio you uploaded for the clip. Those links stay valid for one year. Keeps it: The finished video stays on Shotstack’s servers, and we cannot currently delete it there. Working files are deleted after 24 hours. Training: We use none of Shotstack’s AI features. Its terms allow training on the inputs and outputs of those features unless switched off, and say nothing either way about an ordinary render, so we make no promise about it. Where: Not stated by Shotstack (an Australian company). Its terms.
• Stripe — payments and subscriptions. Receives: Your agency name, billing email and plan. Card details go to Stripe directly; we never see them. Keeps it: For as long as the law requires it to. Stripe also acts as an independent controller for fraud prevention. Your Stripe customer record is kept when you close your account, as a billing record. Training: Not applicable. Where: United States. Its terms.
• Resend — sending email. Receives: Each email we send: the recipient, subject and body — approval requests, invitations, trial and billing notices, and alerts. Recipients can include the client staff you invite as approvers. Keeps it: Email content and logs for 30 days. Training: Not applicable. Where: United States. Its terms.
• TikTok and Google — receiving the posts you have approved, on your instruction.

We may also disclose information where the law requires it, or to protect our rights, safety or property.

Platform data

Data we receive from TikTok and Google is used only to provide the features you asked for — publishing to your accounts and reporting on those posts. We do not transfer it to a data broker, use it for advertising, or combine it with data from other sources to build profiles of individuals. Our use of information received from Google APIs follows Google’s API Services User Data Policy, including the Limited Use requirements.

How long we keep it

While your account is open we keep it. Posting history, generated media and performance data are what the reporting is made of, so deleting them on a timer would empty the product; we keep them until you delete the client, the post or the account.

Some things go sooner. Access tokens are deleted the moment you disconnect an account, and replaced whenever a platform issues a new one. Deleting a client removes its posts, connections and history from our database immediately, and its images, voiceovers and uploads from our file storage within two days.

When you close your account we delete your data within 30 days, except where we must keep records for tax or legal reasons — invoices and payment records principally, which we keep for seven years, and your customer record at Stripe. Our database backups are kept for at most 30 days, so a deleted record can survive in one for up to 30 days after it is deleted.

What deleting cannot reach. Copies a provider already holds are kept for that provider’s own period, listed above: up to 30 days at Anthropic (2 years for anything flagged for a policy violation), 55 days at Google, 30 days at Resend. Finished videos stay on Shotstack’s servers, and we cannot currently delete them there. Links we gave Shotstack and the platforms to your images and audio are valid for up to a year, but stop working as soon as we delete the file they point to. And posts already published to a platform stay there — they belong to that account.

Your choices

• You can see and edit everything about a client from inside the app.
• You can disconnect any social account at any time, which deletes its tokens.
• You can ask for a copy of your data, or for it to be corrected or deleted: how to delete your data.
• Depending on where you live you may have rights under the GDPR, the UK GDPR or US state privacy laws, including the right to object to processing and to complain to a regulator. We honour these regardless of where you live.

Write to privacy@usecosmicsocial.com and we will respond within 30 days. For deletion, see privacy@usecosmicsocial.com.

Security

Social account tokens are encrypted with AES-256-GCM before storage and are decrypted only on our servers, for the length of a single call to the platform. They are never sent to your browser. Every table enforces tenant isolation in the database itself, so one agency cannot read another’s data even if the application has a bug. Access to production systems is limited to people who need it.

No system is perfectly secure. If we discover a breach affecting your data we will tell you and the relevant regulators as the law requires.

Children

Cosmic Social is a business tool and is not directed at anyone under 18. We do not knowingly collect information from children.

International transfers

We operate from the United States. Your data is stored in Canada (Supabase) and processed in the United States (Netlify, Resend, Resemble AI, Stripe). Google may process it in any country; Anthropic and Shotstack do not say where they do. Each provider’s location is in the list above.

For data transferred out of the European Economic Area or the United Kingdom, Anthropic, Stripe, Resend and Resemble AI rely on the European Commission’s standard contractual clauses under their own terms.

Changes

If we change this policy we will update the date at the top, and for a material change we will tell you in the app before it takes effect.

Contact

Cosmic LLC, 6516 S Crane Dr, Oak Creek, WI 53154, United States. privacy@usecosmicsocial.com