Effective date: 11 August 2026
Policy version: 2026-08-11
1. Who is responsible
The hosted OpenPost service at app.openpost.social is operated by Rodrigo Dias in Porto, Portugal. For privacy requests, email openpost@rgo.pt. OpenPost is the data controller for account and service data described in this policy.
A self-hosted OpenPost installation is controlled by its operator. This policy does not govern an independent self-hosted installation; contact that operator about its practices.
2. Data we process
- Account and workspace data: email address, display name, profile image, workspace and organization details, roles, invitations, and settings.
- Post data: drafts, scheduled and published content, media, account versions, OpenPost Image Editor designs and saved versions, explicitly cloud-saved OpenPost Video Editor projects, templates, brand settings, prompts, schedules, post status, and job history.
- Analytics data: account and post numbers, past results, update status, and safe platform error codes. Analytics records do not contain full platform replies, access tokens, post text, or direct messages.
- Product and website telemetry: cookieless public page views and selected interactions; opaque signed-in user and workspace identifiers; product and service events; release, route-template, status, and sanitized error facts. We do not send post content, media, request bodies, credentials, email addresses, names, usernames, query strings, or raw URLs as telemetry properties.
- Brand font records: custom WOFF2, TTF, or OTF files, family and style details, and the account and time associated with the required font-license acknowledgement.
- Connected-account data: social network, account ID, username, profile, supported features, X plan when relevant, granted access, and encrypted access or refresh tokens. OpenPost does not ask for your social-network password.
- Security data: password hashes, session identifiers, passkey public-key material, TOTP settings, API token details, IP address, browser details, sign-in and token activity, and password-reset records. OpenPost never stores a readable account password.
- Billing data: plan access, subscription, checkout, customer, transaction, and billing-status identifiers received from Paddle or the payment provider identified at checkout. OpenPost does not receive or store full payment-card details.
- Support and service data: messages you send, service logs, errors, request timing, usage counters, and abuse-prevention signals.
3. How we receive data
We receive data from you when you register, set up a workspace, upload content, connect a social network, buy a plan, or contact support. We also receive account and post data from the networks you connect, billing status from Paddle or the payment provider identified at checkout, and limited technical data when your browser or client uses the service.
Camera access is requested only after you choose a camera action. A live preview stays in the browser and is not saved. A still photo is uploaded to the selected workspace only after you choose to use it. OpenPost Video Editor can optionally record a camera track; that recording and its local project stay in browser storage until you choose a cloud save, Media save, or post handoff.
4. Why we use data
- Provide, secure, and support accounts, workspaces, publishing, analytics, and automation.
- Send content to the social networks and accounts you select.
- Draft image alternative text when automatic captioning is enabled.
- Process subscriptions, enforce plan limits, and keep billing records.
- Detect abuse, investigate failures, and protect users and the service.
- Comply with law, enforce the Terms of Service, and resolve disputes.
- Improve the service using technical logs and error data.
- Understand anonymous traffic and selected interactions on the marketing and documentation sites.
For users in the European Economic Area, these uses rely on performing our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required. You can withdraw consent without affecting earlier lawful processing.
5. When data is shared
We share data only as needed with:
- Social networks you choose, such as X, Mastodon servers, Bluesky, LinkedIn, Meta services, TikTok, or YouTube, to connect accounts and perform requested publishing actions. Their terms and privacy policies then apply.
- An identity provider you choose, such as Google, when you use that provider to sign in or link an identity.
- Hosting companies that run the app, database, media, email, network, analytics, and backups under their service terms.
- OpenRouter and selected AI model providers, when automatic image captioning is enabled, to process a 400-pixel JPEG thumbnail and up to 1,000 characters of the relevant draft or thread segment as untrusted context. OpenPost does not send the original image for this feature. Their service and privacy terms apply.
- Paddle and prior payment providers for checkout, subscriptions, tax, billing records, refunds, fraud prevention, and customer portals. Paddle acts as Merchant of Record for orders it processes.
- Stock-media services you search to return requested photo or video results and record provider-required selection or download events.
- The disclosed feedback recipient when you choose to send the in-app report, including its text, optional screenshot, and the diagnostics shown before submission.
- Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business reorganization.
OpenPost does not sell personal data, build advertising profiles, or share personal data for cross-context behavioral advertising.
The dated managed service trust register names current data locations, service providers, user-directed recipients, international-transfer facts, and the human production-access boundary.
6. Google and YouTube API data
If you connect YouTube, OpenPost uses Google API data only to provide the connection, video-publishing, and channel or video analytics features you request. That use and transfer comply with the Google API Services User Data Policy, including its Limited Use requirements. OpenPost does not use Google user data for ads, credit decisions, or unrelated profiling.
OpenPost uses YouTube API Services. Google's handling of information is described in the Google Privacy Policy.
You can disconnect a YouTube account in OpenPost and revoke access from your Google account permissions.
7. Retention and deletion
The schedule below states who operates each managed data category, why it is kept, its current duration, and the event that deletes it or ends its use. “No general age-based purge” means the database does not currently delete that category merely because it reached a fixed age. Authorization can still expire before a row is physically removed.
You can download an account export or request permanent deletion from account settings. Deletion can be delayed when you must first transfer shared ownership, cancel active billing, or preserve the last required instance administrator. Primary account and personal workspace data are removed when deletion completes. The managed service makes daily database and media recovery copies in root-restricted operator storage. Routine database dumps and changed or deleted media versions are pruned by a daily job after they become more than 14 days old. A copy can therefore remain until the next daily run. Operator-created repair or incident snapshots follow a separate review and are kept only while needed for recovery, security, legal duties, fraud prevention, or enforcing legal rights. OpenPost does not add a separate application-level encryption layer to each backup artifact.
Retention schedule reviewed: 11 August 2026
| Category | Owner and purpose | Duration | Deletion trigger and limits |
|---|---|---|---|
| Account, profile, and legal acceptance Email, display name, username, avatar, public-profile choice, account settings, accepted Terms and Privacy versions, and acceptance time. | Managed OpenPost service Create and administer the account, apply user settings, show an optional public profile, and record the policy terms accepted by the user. | For the account lifetime. The managed service has no separate age-based purge while the account remains open. | A completed account-deletion request removes the user row and personal profile data after required ownership, billing, and administrator blockers are resolved. Limits: Content in a shared organization can remain after ownership is transferred. Minimal records can be retained when required for law, security, fraud prevention, or legal claims. |
| Organizations, workspaces, members, and invitations Organization and workspace names, roles, membership, settings, invitations, schedules, and usage configuration. | Managed OpenPost service Separate customer work, authorize members, support collaboration, and apply organization and workspace settings. | Until the organization, workspace, membership, or invitation is removed. Accepted and expired invitation rows do not have a general age-based purge. | Workspace or organization deletion removes owned records. Account deletion removes the user's memberships and personal organizations, or transfers shared ownership when another owner must retain the organization. Limits: A shared organization and its content remain for its other members. Invitation records can remain for operational history until their parent workspace or organization is deleted. |
| Sign-in credentials and identity links Password hashes, passkey public-key material, encrypted TOTP secrets, hashed MFA recovery codes, linked OIDC identities, identity-assurance records, and hashed action-bound reauthentication grants. | Managed OpenPost service Authenticate users, provide optional stronger sign-in methods, enforce organization identity policy, and recover access safely. | Credentials and linked identities remain until removed, replaced, or the account is deleted. Session identity assurance expires at its policy time and has no separate age purge; a new assurance for the same session and provider replaces it. Expired reauthentication grants are pruned when another grant is created. | Credential removal, recovery-code replacement, identity unlinking, password replacement where applicable, related session or provider deletion, or completed account deletion. Limits: OpenPost never stores a readable password. Provider-side identity records remain subject to the selected identity provider's policy. |
| Organization identity administration and audit OIDC provider and organization policy settings, encrypted provider client secrets, verified domains, actor and subject identifiers, safe audit details, and hashed time-limited impersonation grants with creation and use metadata. | Managed OpenPost service Configure organization sign-in policy, verify identity-provider domains, authorize tightly scoped administrator actions, and explain identity-policy changes. | Identity-provider and policy settings remain until removed or their organization is deleted. Identity audit events and used or expired impersonation grants have no general age-based purge. | Provider, domain, policy, organization, or account deletion removes related records according to their stored relationship. Expiry prevents an unused impersonation grant from being accepted even if its row remains. Limits: When an actor or subject account is deleted, an organization identity audit event can remain with that user reference cleared. These application records are not a complete host command log. |
| Instance settings, provider applications, and provider-safety evidence Encrypted instance-setting values and provider client secrets, provider application metadata, dynamic Mastodon registrations, one-way app and instance fingerprints, approval reviews, normalized certification checks, and append-only runtime control events. | Managed OpenPost service operator Configure the hosted instance and provider applications, register supported Mastodon instances, and fail closed when a provider approval, certification result, or runtime safety control is missing or stale. | Current settings and application registrations remain until replaced, removed, deactivated, or the instance is retired. Approval reviews, certification runs and checks, and runtime control events have no general age-based purge. Their stored time and state fields control whether they still satisfy readiness or restrict an operation. | An administrator can delete a database-backed provider application or replace and clear supported instance settings. Dynamic Mastodon registrations and expired provider-safety evidence remain until verified operator maintenance or database retirement. Limits: Environment-managed configuration is controlled outside the application database. Provider-safety evidence stores app and instance fingerprints, an approval-source URL, normalized scope sets and results, and external-reference hashes rather than plaintext client secrets, instance URLs, granted tokens, or provider response bodies. |
| Authenticated browser sessions Opaque server-side session ID, creation and expiry times, IP address, browser details, last use, and revocation state. | Managed OpenPost service Keep a user signed in, show and revoke active sessions, and investigate suspicious session use. | Each session expires after seven days. Revoked and expired session rows have no separate scheduled age purge before account deletion. | Expiry ends authorization. Logout, password-reset session revocation, manual session revocation, or account deletion ends or removes session access. Limits: The browser cookie follows the separate browser-storage inventory. Security records can remain in size-bounded operational logs after a session row expires. |
| One-time verification, reset, and sign-in records Email verification challenges, email-change challenges with old and new addresses and keyed code hashes, password-reset token hashes, MFA or passkey authentication challenges, OIDC authorization requests, native handoffs, logout events, social OAuth request tokens and account selections, CLI authorization sessions, OAuth codes, and short-lived editor return tokens. | Managed OpenPost service Complete time-limited identity, account recovery, authorization, native sign-in, and editor-return operations without storing reusable plaintext secrets. | Email verification codes are valid for 10 minutes and records more than 24 hours past expiry are pruned when a later challenge is created. Email-change codes are valid for 15 minutes; records more than 24 hours past expiry are pruned when a later email-change challenge is created. Password-reset tokens are valid for one hour and the prior unused token is replaced by a new request. OIDC authorization requests are valid for 10 minutes. Image and Video Editor return tokens are valid for two hours. Other one-time records use their stored expiry. | Use or expiry ends authorization. Replacement, explicit cancellation where supported, cleanup during a later related operation, or account/workspace deletion can remove the stored row. Limits: Use and expiry do not always physically remove a row immediately, but they prevent the one-time record from being accepted again. |
| Connected social accounts and grants Network, account and profile identifiers, capabilities, granted scopes, encrypted access and refresh tokens, token expiry, connection selections, and connection health. | Managed OpenPost service Connect the selected social account, show its supported capabilities, and perform only the publishing or reading actions authorized for it. | Connection metadata has no general age-based purge and can remain after a destination is disconnected or its grant is revoked. Active credentials remain until the grant is revoked, its workspace is deleted, or the owning personal account is deleted. Refresh-token jobs are replaced as token schedules change. | Disconnecting one destination disables it while retaining a shared provider grant. Revoking the grant clears its managed credentials and disables every destination that uses it. Workspace or account deletion removes the stored connection rows. Limits: The social network controls its own records, published content, logs, and revocation behavior. Disconnecting OpenPost does not delete provider-side content. |
| API, CLI, MCP, and automation access Hashed access tokens, prefixes, names, scopes, workspace limits, expiry and revocation state, OAuth client metadata, and MCP tool-call audit records. | Managed OpenPost service Authorize scoped non-browser clients, enforce access limits, and retain a safe record of MCP operations. | API-family tokens default to 90 days unless a supported caller chooses another expiry. Expiry or revocation blocks use; token metadata and tool-call records otherwise remain until account or workspace deletion. | Manual revocation, expiry for authorization, OAuth-code consumption, or account/workspace deletion for stored records. Limits: Tool-call records contain operation metadata and safe error text, not social access tokens or full provider responses. |
| Drafts, schedules, publications, and automation Post and thread text, segments, destination settings, schedules, renditions, prompts, social sets, repost rules, publication state, and provider identifiers for published results. | Managed OpenPost service Draft, adapt, schedule, publish, and automate the customer content and destinations selected by the user. | Until the user deletes the item or its workspace or personal account is deleted. Published-result metadata and failed history have no general age-based purge. | Item deletion where offered, workspace deletion, or completed deletion of the owning personal account and workspace. Limits: Content already sent to a social network remains under that network's controls. Shared-workspace content can remain after the user leaves or transfers ownership. |
| Publishing history, authorizations, delivery state, and jobs Lifecycle events, consent fingerprints, provider write attempts, delivery state, job payloads, status, safe errors, run times, and retry history. | Managed OpenPost service Execute durable work, prevent unsafe duplicate provider writes, explain delivery outcomes, and preserve authorization evidence. | The database has no general age-based purge for completed or failed history. Records remain with the related publication, workspace, account, or job until that parent data is deleted. | Publication, workspace, social-account, or account deletion removes related rows and jobs where the stored references can be identified. Pending schedule replacement removes only the matching pending primary publication job. Limits: Authorization records retain hashes instead of plaintext publication payloads. A completed job without a removable parent reference can remain until operator maintenance or database retirement. |
| Cloud-saved editor projects, templates, and brand data Image Editor designs, Video Editor projects, project assets, templates, brand kits, licensed font records, saved revisions, previews, and handoff results explicitly saved to OpenPost. | Managed OpenPost service Restore explicitly cloud-saved creative work, provide reusable customer templates and brand resources, and support safe revision recovery. | Current projects, named checkpoints, templates, and brand data remain until the user deletes the item or its workspace or account is deleted. Image and Video Editor autosaves are capped at the 20 most recent during later saves. Both receive a 30-day expiry timestamp, but only the Video Editor currently deletes expired autosaves during a later project save; the Image Editor has no separate age-based purge for that timestamp. | Project, template, brand item, workspace, or account deletion. Later saves remove excess autosaves in both editors and expired autosaves in the Video Editor. Limits: Browser-only projects are covered by the browser-storage inventory, not this managed-service schedule. Referenced media follows the media lifecycle. |
| Uploaded, generated, and saved media Original media, generated previews and thumbnails, alternative text, technical metadata, provenance, tags, collections, editor exports, and storage object keys. | Managed OpenPost service Store, organize, edit, preview, deliver, and recover media used in OpenPost publications and customer libraries. | Library, favorited, tagged, or actively referenced media remains until the user removes it or its workspace is deleted. Eligible temporary media moves to Trash after publication or 14 days without use. Trashed media becomes eligible for permanent deletion after seven more days. | Manual trash, temporary-media publication, the daily inactivity sweep, permanent purge after the trash window, workspace deletion, or completed account deletion. Limits: Editable, retryable, organized, favorited, brand, template, and active-publication references block automatic trash or purge. Recovery copies can retain deleted objects for the separate recovery-copy period. |
| Social analytics, usage, limits, and provider cost records Normalized account and publication metric snapshots, sync status, usage counters, immutable confirmed provider-usage events, reservations, and monthly projections. | Managed OpenPost service Show normalized performance results, schedule safe refreshes, enforce plan limits, and reconcile confirmed provider usage. | Analytics snapshots, general usage counters, and period counters have no general age-based purge. Confirmed provider-cost events and unresolved reservations become eligible after the configured 180-day managed-service window; each service start prunes up to 1,000 eligible rows of each type and never prunes current-month rows. Confirmed or released reservations are removed when settled. | Workspace deletion or completed deletion of the owning personal workspace removes scoped records. Reservation settlement removes the in-flight row; bounded startup pruning removes eligible provider-cost events and unresolved reservations. Limits: Because startup pruning is bounded, eligible rows can remain until a later start or operator run. OpenPost does not retain raw analytics provider responses or access tokens in analytics tables. Provider-side analytics remains controlled by each social network. |
| Comments, engagement, inbox, messages, and notifications Normalized engagement items, attachments, opted-in conversations and direct messages, sync state, in-app notifications, actions, and delivery preferences. | Managed OpenPost service Provide opted-in engagement and inbox views, send authorized replies, and notify users about relevant workspace activity. | There is no general age-based purge. User notifications remain until the user deletes them or the account is deleted. Normalized engagement, conversation, message, and sync records remain until the related social account, workspace, or account is deleted; provider-deleted engagement remains as a deletion-marked record. | Notification deletion removes selected notifications. Social-account, workspace, or completed account deletion removes related communication records. Provider synchronization can mark an engagement item deleted without removing its stored row. Limits: Disabling inbox collection stops future reads but does not by itself delete records already stored. Page requests read stored data and do not call provider APIs. Provider copies of comments and messages remain under the provider's controls. |
| Account, security, and opted-in notification email Recipient and sender addresses, message content, related user or workspace identifiers, queue state, safe delivery errors, and provider delivery metadata. | Managed OpenPost service and Purelymail within their stated roles Deliver verification, recovery, security, invitation, and opted-in activity messages to the intended recipient. | OpenPost has no general age-based purge for completed or failed email-job payloads. Purelymail controls its own message and delivery records under its policy. | Related account or workspace deletion removes identifiable queued jobs where supported. The operator can remove delivery history after support, security, and legal needs end. Limits: Email already delivered to the recipient's mailbox is controlled by the recipient and their email provider. Required account and security messages are distinct from optional activity email. |
| Billing and subscription records Organization plan and entitlement state, Paddle customer and subscription identifiers, normalized checkout attempts, webhook event IDs, status, period dates, and provider reconciliation payloads. | Managed OpenPost service and Paddle within their stated roles Start and reconcile checkout, provide subscription access, prevent duplicate webhook handling, and support billing, tax, fraud, dispute, and refund work. | OpenPost has no general age-based purge for billing customer, checkout, webhook-idempotency, or subscription records. A personal organization's subscription and checkout records are removed with that organization; shared-organization records remain with it. | Organization deletion where foreign-key ownership applies, account deletion for a personal organization, or a verified operator deletion request where law, fraud prevention, dispute, tax, and reconciliation needs allow it. Limits: Paddle is Merchant of Record and keeps its own transaction, tax, fraud, and customer records under its policies. OpenPost does not receive or store full payment-card details. |
| Support and in-app feedback User-written report text, optional approved screenshot, allowlisted diagnostics, recipient, delivery status, and a database rate-limit window. | Managed OpenPost service and the disclosed feedback recipient Deliver a user-requested report with the exact optional evidence shown before submission and prevent feedback abuse. | The feedback rate-limit window is removed after it is more than 24 hours behind a later accepted submission. Delivered or failed feedback job payloads have no general age-based purge and can remain until account deletion or operator maintenance. | Account deletion removes jobs that contain the user reference when detectable. The operator can delete retained delivery history after support, security, and legal needs end. Limits: The configured feedback recipient receives a separate copy and controls that copy under its own policy. Sensitive-looking values and private paths are sanitized before queueing. |
| Stock-media searches and provenance A hash of normalized search parameters, normalized provider results, cache expiry, and provenance for media the user imports. | Managed OpenPost service Return a requested stock-media search efficiently and retain the source and attribution facts needed for imported media. | Search results are usable for 15 minutes, or 24 hours for Pixabay. Expired rows are ignored but have no separate age-based purge; a repeat of the same query replaces the row. Imported provenance remains with the media item. | Replacement by the same query, operator database maintenance, media deletion for attached provenance, or workspace/account deletion where the related media is removed. Limits: The cache stores a query hash rather than the plaintext query. Stock providers keep their own request and selection records under their policies. |
| Automatic image-caption requests A 400-pixel JPEG thumbnail, up to 1,000 characters of relevant post context, locale, instructions, model, and limited request metadata sent through OpenRouter when requested. | Managed OpenPost service, OpenRouter, and the selected model host within their stated roles Generate a draft image description after the user requests or permits the automatic captioning feature. | OpenPost keeps the generated alternative text with the media item but does not write the request image or prompt to a separate application table. The managed request requires an OpenRouter zero-data-retention endpoint; OpenRouter can retain non-content request metadata under its policy. | OpenPost does not persist the request thumbnail or prompt after the provider request completes. The saved alternative text is replaced manually or removed with its media item. Limits: The original image is not sent for captioning. Provider-side request metadata follows the provider disclosures in the managed-service trust register. |
| Product, marketing, documentation, and service telemetry Cookieless page views and selected interaction events on the public sites; opaque user, workspace, publication, rendition, and job identifiers for managed product events; browser and service version, environment, route template, status, error type, and sanitized exception context. OpenPost does not send email addresses, names, usernames, post text, media, request bodies, credentials, query strings, or raw URLs as telemetry properties. | Managed OpenPost service and PostHog Measure public-site use, understand product workflows, diagnose failures, and improve the managed service without advertising profiles, cross-site tracking, or session replay. | Managed PostHog event data is configured for a maximum 12-month retention window. OpenPost does not keep a separate telemetry copy after PostHog deletes or expires the event data. | Expiry under the managed PostHog retention window, operator deletion of an event or person, a supported account-deletion request for linked identified data, or retirement of the analytics project. Limits: Marketing and documentation traffic remains anonymous and personless. The managed app and backend use the same opaque OpenPost user ID after sign-in so product events and service outcomes can be joined. Browser persistence is memory-only; autocapture, session replay, console capture, network bodies, and advertising tracking are disabled. |
| Operational and security logs Service and authentication events, errors, request timing, container and system events, and limited infrastructure metadata. | Managed OpenPost service operator Operate the service, diagnose failures, detect abuse, and investigate security or reliability events. | Managed host journals are size-bounded to 50 MiB of persistent storage and 10 MiB of runtime storage rather than retained for a fixed number of days. | System journal rotation removes older entries as the configured size bounds are reached. The operator can remove logs when incident, reliability, legal, or security needs end. Limits: The host does not provide a complete command-level audit trail. Account deletion does not selectively remove entries already written to shared operational logs. |
| Database and media recovery copies Daily PostgreSQL dumps, the current media mirror, changed or deleted media versions, and separately reviewed repair or incident snapshots. | Managed OpenPost service operator Restore customer data after service failure, operator error, or a validated recovery need. | Routine database dumps and changed or deleted media versions are pruned by the first daily run after they are more than 14 days old. The current mirror follows live media. Exceptional snapshots remain only while their stated recovery, security, legal, fraud, or claims purpose continues. | Daily age-based pruning for routine copies; purpose review and operator deletion for exceptional snapshots. Limits: Deletion from the live service can remain in a routine recovery copy through this window. OpenPost does not add a separate application-level encryption layer to each backup artifact. |
8. Cookies and browser storage
The inventory below covers first-party cookies, localStorage, sessionStorage, IndexedDB databases and object stores, Origin Private File System (OPFS) roots and patterns, and Cache Storage names used by the app, marketing site, and documentation site. An exact identifier is one fixed name. A prefix covers names with a generated suffix. The inventory was reviewed on 11 August 2026.
OpenPost Image Editor background removal runs in your browser with model and runtime files served by the OpenPost operator. Source pixels are not sent to a background-removal service. A result is uploaded to the selected workspace only when processing succeeds.
The managed app, service, marketing site, and documentation site use PostHog EU Cloud for product, service, error, and website telemetry. Public traffic remains cookieless and personless. The signed-in app and backend use the same opaque OpenPost user ID to join product actions to service outcomes. Browser persistence is memory-only; autocapture, session replay, console capture, network bodies, advertising profiles, and cross-site tracking are disabled. The privacy-enhanced YouTube player is loaded only when you open the product demo; YouTube may then process device and playback data.
OpenPost Video Editor live previews, optional screen, camera, and audio recording, editing, transcription, voice detection, framing analysis, and export run in the browser. Model files are downloaded only after the user starts the related tool. Local project data, recordings, sources, and exports are uploaded only when the user chooses a cloud save, Media save, or post handoff.
cookie
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
openpost_session exact | OpenPost authentication service Authenticates a browser session without exposing the token to application JavaScript. | Application origin; Path=/; HttpOnly; SameSite=Lax; Secure on HTTPS. Duration: Seven days unless logout, revocation, password reset, or account deletion ends it sooner. | Strictly necessary |
openpost_oidc_binding exact | OpenPost identity service Binds an OIDC sign-in, link, or reauthentication callback to the browser that started it. | Application origin; Path=/api/v1/auth/oidc/; HttpOnly; SameSite=Lax; Secure on HTTPS. Duration: Expires after ten minutes and is cleared after a successfully completed callback; browser site-data clearing can remove it sooner. | Strictly necessary |
PARAGLIDE_LOCALE exact | Paraglide localization runtime Keeps the selected interface language across visits. | Application and marketing origins separately; Path=/; readable by the page. Duration: 400 days or until the user changes the language or clears site data. | Functional |
sidebar:state exact | OpenPost application shell Keeps the application sidebar expanded or collapsed. | Application origin; Path=/; readable by the page. Duration: Seven days after the last sidebar change or until site data is cleared. | Functional |
localStorage
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
mode-watcher-mode exact | mode-watcher theme runtime Keeps the light, dark, or system color-mode preference. | Application and marketing origins separately. Duration: Until the preference is changed or site data is cleared. | Functional |
mode-watcher-theme exact | mode-watcher theme runtime Library-owned theme name storage; OpenPost currently uses the default unnamed theme. | Application and marketing origins separately. Duration: Until the theme changes, the library removes the key, or site data is cleared. | Functional |
vitepress-theme-appearance exact | VitePress documentation theme Keeps the documentation site's light, dark, or system color-mode preference. | Documentation origin and current browser profile. Duration: Until the preference changes or documentation site data is cleared. | Functional |
openpost_current_workspace exact | OpenPost application shell Restores the last selected workspace and its safe display metadata. | Application origin for the current browser profile. Duration: Until another workspace is selected, the account loses access, logout/account cleanup removes it, or site data is cleared. | Functional |
openpost_instance_url exact | OpenPost installed mobile application Keeps the self-hosted server address selected by the installed mobile application. | Installed application WebView storage; not needed by the ordinary web app. Duration: Until the server is changed, disconnected, or application site data is cleared. | Functional |
openpost:interface-sounds exact | OpenPost application shell Keeps the interface-sound on or off preference. | Application and marketing origins separately. Duration: Until the preference changes or site data is cleared. | Functional |
oauth_account_management_mode exact | OpenPost social-account connection flow Returns a social-account connection to the direct Accounts page or the embedded Settings account manager that started it. | Application origin. Duration: Removed after the OAuth return is interpreted or account-data cleanup runs; otherwise retained until another connection replaces it or site data is cleared. | Strictly necessary |
oauth_workspace_id exact | OpenPost social-account connection flow Carries the selected workspace through the browser-staged Mastodon code exchange. Other social OAuth starts currently also write this key but rely on server callback state. | Application origin. Duration: Removed after a successful Mastodon exchange or account-data cleanup; otherwise retained until replaced or site data is cleared. | Strictly necessary |
oauth_mastodon_server exact | OpenPost Mastodon connection flow Restores the named configured Mastodon server after its OAuth redirect. | Application origin. Duration: Removed after a successful exchange, when another Mastodon connection mode replaces it, or when account/site data is cleared. | Strictly necessary |
oauth_mastodon_instance_url exact | OpenPost Mastodon connection flow Restores a custom Mastodon instance URL after its OAuth redirect. | Application origin. Duration: Removed after a successful exchange, when another Mastodon connection mode replaces it, or when account/site data is cleared. | Strictly necessary |
openpost:first-account-celebrated: prefix | OpenPost account-connection interface Prevents replaying the first-connected-account celebration for the same workspace. | Application origin; one suffix per workspace ID. Duration: Until site data is cleared. | Functional |
openpost-image-editor-tools-v1 exact | OpenPost Image Editor Keeps Image Editor tool sizes, tolerances, smoothing, pressure, sampling, and related preferences. | Application origin and public Image Editor on that origin. Duration: Until preferences are replaced or site data is cleared. | Functional |
openpost-image-editor-first-edit-v1 exact | OpenPost Image Editor Records that first-edit guidance was dismissed. | Application origin and public Image Editor on that origin. Duration: Until site data is cleared. | Functional |
openpost-image-editor-recent-colors-v1 exact | OpenPost Image Editor Keeps up to eight recent Image Editor color choices. | Application origin and public Image Editor on that origin. Duration: Until colors are replaced or site data is cleared. | Functional |
openpost-image-editor-layout-v1 exact | OpenPost Image Editor Keeps Image Editor asset, inspector, and layer panel sizes. | Application origin and public Image Editor on that origin. Duration: Until layout values are replaced or site data is cleared. | Functional |
openpost-image-editor-view-v1 exact | OpenPost Image Editor Keeps Image Editor snapping, rulers, guides, and grid preferences. | Application origin and public Image Editor on that origin. Duration: Until view values are replaced or site data is cleared. | Functional |
openpost-video-editor-text-styles exact | OpenPost Video Editor Keeps reusable local Video Editor text styles. | Application origin and public Video Editor on that origin. Duration: Until styles are replaced or site data is cleared. | Functional |
openpost-video-editor-diagnostics-v1 exact | OpenPost Video Editor Keeps up to 100 sanitized local Video Editor failure diagnostics for recovery and user-approved support reporting. | Application origin and public Video Editor on that origin. Duration: Old entries are dropped as the 100-entry limit is exceeded; all entries disappear when site data is cleared. | Functional |
sessionStorage
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
openpost_reauth_pending_action exact | OpenPost reauthentication flow Matches an OIDC reauthentication return to the sensitive action that requested it. | Application origin and current browser tab session. Duration: Removed after the returned grant is stored or when the start request fails; otherwise removed when the tab session ends or site data is cleared. | Strictly necessary |
openpost_reauth_grants exact | OpenPost reauthentication flow Temporarily holds action-bound reauthentication grants until the requested sensitive action consumes them. | Application origin and current browser tab session. Duration: Each grant is accepted for at most five minutes and is removed when consumed; storage also ends with the tab session or site-data clearing. | Strictly necessary |
openpost:editor-handoff:return: prefix | OpenPost editor handoff Restores the composer destination and unsaved snapshot after an Image or Video Editor handoff. | Application origin and current browser tab session; one random-token suffix per handoff. Duration: It becomes unusable at its stored expiry and is removed on a later read. Explicit clearing, the end of the tab session, or site-data clearing can remove it sooner. | Strictly necessary |
openpost:image-editor:return: prefix | OpenPost editor handoff compatibility layer Reads and removes pre-v2 Image Editor handoff recovery written by older OpenPost versions. | Application origin and current browser tab session. Duration: Removed when consumed or cleared; otherwise ends with the tab session. | Strictly necessary |
openpost:studio:return: prefix | OpenPost editor handoff compatibility layer Reads and removes pre-rename Studio handoff recovery written by older OpenPost versions. | Application origin and current browser tab session. Duration: Removed when consumed or cleared; otherwise ends with the tab session. | Strictly necessary |
openpost-image-editor-export-v1: prefix | OpenPost Image Editor Resumes a multi-page Image Editor save or attachment without re-uploading successful pages. | Application origin and current tab; suffix contains design ID, export mode, and format. Duration: Removed after the export is cleared or when the tab session ends or site data is cleared. | Strictly necessary |
openpost:marketing-motion exact | OpenPost marketing site Keeps the visitor's pause or play choice for marketing-page motion during the current tab session. | Marketing origin and current browser tab session. Duration: Until the tab session ends or site data is cleared. | Functional |
IndexedDB
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
openpost-studio exact | OpenPost Image Editor Stores unsynced authenticated recovery documents and public Image Editor designs and media in the documents, guest-designs, and guest-media object stores. | Application origin; browser profile. The original database name is retained for compatibility. Duration: Authenticated recovery becomes unusable after seven days and is removed on a later load; a newer recovery or explicit clear can remove it sooner. Guest designs remain until the user deletes them, the browser evicts data, or site data is cleared. | Functional |
documents exact | OpenPost Image Editor Stores authenticated unsynced Image Editor recovery documents inside the openpost-studio database. | Application origin; openpost-studio database. Duration: A recovery becomes unusable after seven days and is removed on a later load. A newer recovery, explicit clear, browser eviction, or site-data clearing can remove it sooner. | Functional |
guest-designs exact | OpenPost Image Editor Stores public Image Editor design documents inside the openpost-studio database. | Application origin; openpost-studio database. Duration: Until the user deletes the design, the browser evicts data, or site data is cleared. | Functional |
guest-media exact | OpenPost Image Editor Indexes public Image Editor media and its IndexedDB or OPFS storage location inside the openpost-studio database. | Application origin; openpost-studio database. Duration: Until the linked guest design or media is deleted, the browser evicts data, or site data is cleared. | Functional |
openpost-video-editor exact | OpenPost Video Editor Indexes local projects, revisions, OPFS assets, recording manifests, analysis results, model metadata, and export jobs across seven named object stores. | Application origin and public Video Editor on that origin; browser profile. Duration: Project records remain until the user deletes a project, the browser evicts data, or site data is cleared. Autosave revisions are capped at 20 per project. Disposable indexed assets are eligible after seven days without access or earlier under storage pressure. | Functional |
projects exact | OpenPost Video Editor Stores local Video Editor project documents and cloud-link state inside the openpost-video-editor database. | Application origin; openpost-video-editor database. Duration: Until project deletion, browser eviction, or site-data clearing. | Functional |
project-revisions exact | OpenPost Video Editor Stores bounded local autosaves, checkpoints, operation journals, and migration backups for Video Editor recovery. | Application origin; openpost-video-editor database. Duration: Autosaves are capped at 20 per project; other revisions remain until project deletion, browser eviction, or site-data clearing. | Functional |
asset-index exact | OpenPost Video Editor Indexes local Video Editor source, recording, proxy, thumbnail, waveform, analysis, export, and temporary OPFS files. | Application origin; openpost-video-editor database. Duration: Project assets remain until project deletion. Disposable assets become eligible after seven days without access or earlier under storage pressure. | Functional |
recording-manifests exact | OpenPost Video Editor Stores resumable local Video Editor recording manifests and chunk verification metadata. | Application origin; openpost-video-editor database. Duration: Until the recording or project is deleted, the browser evicts data, or site data is cleared. | Functional |
analysis-results exact | OpenPost Video Editor Stores local transcription, voice-activity, framing, and related Video Editor analysis results. | Application origin; openpost-video-editor database. Duration: Until replaced or removed with the project or source, browser eviction, or site-data clearing. | Functional |
model-cache-metadata exact | OpenPost Video Editor Records the version, integrity, size, and last use of locally cached Video Editor models. | Application origin; openpost-video-editor database. Duration: Until the model is removed or replaced, browser eviction, or site-data clearing. | Functional |
export-jobs exact | OpenPost Video Editor Stores local Video Editor export progress, recovery state, and output references. | Application origin; openpost-video-editor database. Duration: Until the export or project is cleared, browser eviction, or site-data clearing. | Functional |
workbox-expiration exact | Workbox service-worker runtime Workbox stores URL timestamps in its cache-entries object store to enforce the declared PWA cache limits. | Application origin service worker. Duration: Metadata follows the related runtime-cache entry and is removed when Workbox expires or deletes that cache metadata, or when site data is cleared. | Functional |
cache-entries exact | Workbox service-worker runtime Stores runtime-cache URL timestamps inside the workbox-expiration database. | Application origin; workbox-expiration database. Duration: Metadata follows the related runtime-cache entry and is removed during Workbox expiry or site-data clearing. | Functional |
OPFS
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
openpost-image-editor-media exact | OpenPost Image Editor Stores browser-local media blobs for public Image Editor designs when OPFS is available. | Application origin and browser profile. Duration: A media file is removed with its guest design; otherwise it remains until browser eviction or site-data clearing. | Functional |
openpost-image-editor-media/ prefix | OpenPost Image Editor Describes the browser-generated media files stored beneath the Image Editor OPFS root. | Application origin and browser profile; one generated filename per guest-media record. Duration: A file is removed with its guest design or media; otherwise it remains until browser eviction or site-data clearing. | Functional |
openpost-video-editor exact | OpenPost Video Editor Stores browser-local Video Editor sources, recordings, proxies, thumbnails, waveforms, analysis files, exports, temporary files, and resumable model-download parts. | Application origin and browser profile; projects use openpost-video-editor/projects/<project-id>/<area>/ paths. Duration: Project files remain until project deletion or site-data clearing. Disposable assets become eligible after seven days without access or earlier under pressure. Completed model partials are removed after verification; interrupted parts remain for resume until replaced or site data is cleared. | Functional |
openpost-video-editor/projects/ prefix | OpenPost Video Editor Describes project-scoped Video Editor source, recording, proxy, thumbnail, waveform, analysis, export, and temporary files. | Application origin and browser profile; followed by project ID, storage area, and generated filename. Duration: Project files remain until project deletion. Disposable files become eligible after seven days without access or earlier under storage pressure. | Functional |
model-downloads exact | OpenPost Video Editor Nested Video Editor directory for resumable model .partial and .etag files while each download is fetched and verified. | Application origin under openpost-video-editor/. Duration: Removed after successful model verification, restarted when inconsistent, or removed when site data is cleared. | Functional |
openpost-video-streams exact | OpenPost Video Editor export pipeline Holds partial streamed video exports when the browser cannot keep the full result in memory. | Application origin and browser profile. Duration: Removed when the export is discarded; files older than 24 hours are removed opportunistically when another streamed output starts; site-data clearing also removes them. | Strictly necessary |
openpost-video-streams/render- prefix | OpenPost Video Editor export pipeline Describes timestamped and randomly suffixed partial video-export files beneath the streaming-output OPFS root. | Application origin and browser profile; one generated file per streamed export. Duration: Removed when discarded; files older than 24 hours are removed when another streamed output starts; site-data clearing also removes them. | Strictly necessary |
Cache Storage
| Identifier | Owner and purpose | Scope and duration | Necessity |
|---|---|---|---|
openpost-pages-1 exact | OpenPost application service worker Provides a short offline fallback for recently visited application pages. | Application origin service worker; at most 32 entries. Duration: Up to seven days, subject to entry-count eviction, service-worker replacement, browser pressure, or site-data clearing. | Functional |
openpost-app-assets-1 exact | OpenPost application service worker Caches immutable application JavaScript, CSS, and assets for faster repeat loads and offline use. | Application origin service worker; at most 400 entries. Duration: Up to 30 days, subject to entry-count eviction, service-worker replacement, browser pressure, or site-data clearing. | Functional |
openpost-image-editor-models-1.7.0 exact | OpenPost Image Editor service-worker route Caches Image Editor background-removal model and runtime files after the related tool is used. | Application origin service worker; at most 32 entries. Duration: Up to 365 days, subject to versioned-cache replacement, entry-count eviction, browser pressure, or site-data clearing. | Functional |
transformers-cache exact | OpenPost Video Editor Stores integrity-checked Video Editor transcription, voice-activity, and reframing model files downloaded after the user starts the tool. | Application origin and browser profile. Duration: Until the user removes a model, a changed manifest replaces it, browser pressure evicts it, or site data is cleared. | Functional |
workbox-precache-v2- prefix | Workbox service-worker runtime Workbox's scope-suffixed cache for the application icon and web app manifest needed by the installed PWA. | Application origin service worker; suffix is the service-worker registration scope. Duration: Entries are replaced by a new service-worker build and outdated Workbox precaches are deleted during activation; browser pressure or site-data clearing can remove them earlier. | Functional |
9. International transfers
Your selected social networks and some service providers may process data outside Portugal or the European Economic Area. When OpenPost controls a transfer and a safeguard is required, it must use an adequacy decision, contractual safeguards, or another lawful transfer method. The managed service trust register states the current provider-specific facts and any unresolved documentation gap. Publishing to a social network is also a transfer that you choose.
10. Your rights
Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing, and to withdraw consent. Use account settings for export and deletion or email openpost@rgo.pt. We may need to verify your identity before completing a request.
You may also complain to your local data-protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).
11. Security
OpenPost uses encrypted social account tokens, password hashing, secure session cookies, limited tool tokens that you can remove, access controls, TOTP, passkeys, request limits, backups, and checks for unsafe software packages. No internet service can guarantee full security. Report a suspected security flaw to openpost+security@rgo.pt.
12. Children
The hosted service is not directed to anyone under 18. Do not create an account if you are under 18.
13. Changes and contact
We may update this policy when the service or legal requirements change. Material changes will be announced in the service or by email when appropriate, and the policy version and effective date will change. Corrections to spelling, formatting, or links that do not change meaning keep the same version. Questions and requests can be sent to openpost@rgo.pt.
This register records material changes to the official hosted-service legal documents. Spelling, formatting, and link corrections that do not change meaning are not separate entries. This history was reviewed on 11 August 2026.
Privacy Policy version 2026-08-11
Effective 11 August 2026
- Replaced the prior public-site-only Umami disclosure with the managed PostHog product, service, website, documentation, and error telemetry boundary.
- Documented opaque signed-in identifiers, cookieless public analytics, memory-only browser persistence, disabled replay and autocapture, excluded content and credentials, retention, and the PostHog EU Cloud subprocessor.
Privacy Policy version 2026-08-09
Effective 9 August 2026
- Named the managed service's current data locations, service providers, user-directed recipients, and international-transfer facts.
- Explained the managed human production-access boundary, routine recovery-copy window, and browser-local Image and Video Editor boundary.
- Documented the automatic image-caption request, feedback recipient, stock-media providers, Paddle role, and current retention and browser-storage schedules.
Privacy Policy version 2026-08-05
Effective 5 August 2026
- Replaced the prior billing disclosure with Paddle's Merchant of Record role and retained the boundary for prior payment-provider records.
- Added the operator identity, Portugal contact facts, policy-version behavior, and hosted-versus-self-hosted scope.
Terms of Service version 2026-08-05
Effective 5 August 2026
- Added Paddle's Merchant of Record role, subscription and cancellation terms, the incorporated Refund Policy, and the operator and governing-law facts.
- Clarified the hosted-service boundary and the acceptance version recorded by the application.
Refund Policy version 2026-08-05
Effective 5 August 2026
- Published the first separate Refund Policy incorporated into the Terms, including the standard request window, statutory-rights boundary, exclusions, and Paddle processing path.
Privacy Policy version 2026-07-22
Effective 22 July 2026
- Published the first complete hosted-service Privacy Policy covering account, publishing, connected-account, security, billing, support, sharing, retention, browser storage, transfer, and user-rights categories.
Terms of Service version 2026-07-22
Effective 22 July 2026
- Published the first complete hosted-service Terms of Service covering accounts, acceptable use, customer content, connected services, paid plans, availability, liability, termination, and changes.