SocAils.

SocAils Privacy Policy

Effective October 12, 2026

SocAils is run by Naylor Holdings LLC, Maumelle, Arkansas, USA ("we"). SocAils is a tool for writing, scheduling and publishing posts to social-media accounts you own or manage. This page says what we store, what we do with it, who else touches it, and how to get rid of it.

What we store

• Your email address and a hashed password. We never store the password itself.
• Your time zone, taken from your browser, so posts go out at your local time.
• Access tokens for the social accounts you connect (YouTube, Facebook, Instagram, Threads, TikTok, Bluesky, Mastodon, LinkedIn). They are used only to publish on your behalf and to read the results of your own posts.
• Videos, cover frames, captions, drafts, product links and your brand-voice notes.
• Your posting schedule and a log of what SocAils posted, where, and when.
• Basic per-post numbers (views, likes, comments) and the comments on posts SocAils made, so you can read and reply to them from the Inbox.
• If you connect Dropbox or Google Drive: the files in the one folder you point SocAils at, and nothing else.
• Billing status (plan, renewal date, a Stripe customer id). We never see or store card numbers.
• One cookie that keeps you signed in. The SocAils app uses no advertising or analytics cookies and no third-party scripts.

What we do with it

• Publish and schedule the posts you create. SocAils never posts to an account unless you press Post or schedule it yourself.
• Write caption drafts, and suggested replies in the Inbox, with AI when you ask for them. For a caption draft, frames from your video, your title and notes, and your brand-voice text are sent to Anthropic's API; for a suggested reply, the comment you are replying to and the commenter's name are sent. Nothing is sent until you ask. Anthropic does not use API data to train its models.
• Find the best moments when you ask for clips from a long video. The sound only (no picture) is sent to Deepgram to turn speech into text with timings; the text then goes to Anthropic to pick the moments. Nothing is sent until you press Make clips. We opt out of Deepgram using it to train its models.
• Send you verification codes, password-reset codes, and receipts for your scheduled posts (you can turn receipts off in Settings). No marketing email.

What we never do

• Sell your data, or share it with advertisers or data brokers.
• Use your connected accounts beyond the permissions you granted when you connected them.
• Post anything to TikTok as a direct post without you choosing who can see it first.

Who else handles your data

We use these providers to run the service. Each one sees only what it needs for its job:

• Railway (US) hosts the app and stores your uploads.
• Supabase (US) holds some account and staging data and nightly backups.
• Anthropic writes caption drafts and suggested replies from the data described above.
• Deepgram (US) turns the speech in a video into text when you make clips. It receives the sound only, and we opt out of it being used for training.
• Stripe processes web payments. Card details go to Stripe, never to us.
• Apple App Store / Google Play process purchases made inside the mobile apps.
• Resend delivers our email.
• Dropbox / Google only if you connect them, and only for the folder you choose.

How we protect your data

• Encrypted connections. Every connection — between your browser and SocAils, and between SocAils and the platforms we post to — uses HTTPS (TLS 1.2 or newer).
• Encrypted storage. Your data is stored with Railway and Supabase, which encrypt stored data at rest and are independently audited for security (SOC 2 Type II).
• Access tokens stay on our servers. The tokens for your connected accounts, including your Google / YouTube token, are never sent to your browser and never written to our logs, and they are used only for the posts and replies you make or schedule. Disconnecting an account deletes its token.
• Passwords are never stored. We keep only a scrypt hash made with a unique random salt.
• Each account is walled off. Every account's data is kept in its own storage area, and every request is checked against the signed-in account, so one customer can never reach another customer's data.
• Sign-in protection. Your sign-in cookie can't be read by scripts and is only sent over HTTPS, repeated wrong passwords lock sign-in for 15 minutes, and an email address must be verified before it can connect accounts or publish.
• Few people, limited access. Only the owner of Naylor Holdings LLC can access our production systems. Passwords and API keys for our providers are kept in our hosts' secret settings, never in our code.
• Google user data is used only to provide the features you see in SocAils. We never sell it, never use it for advertising, and never use it to train AI models. No person reads it unless you ask us for help, it is needed for security, or the law requires it.
• If something goes wrong: if we learn of a security incident that affects your data, we will email you without undue delay, and within 72 hours where the law requires it.

YouTube

SocAils uses YouTube API Services. By using SocAils' YouTube features you agree to be bound by the YouTube Terms of Service. Google's Privacy Policy is at google.com/policies/privacy.

Through the YouTube API we access and store: your channel id and name, an OAuth token (kept until you disconnect), the videos SocAils uploads for you, the comments on those videos, and their basic statistics. Statistics and comments are refreshed when you open the Posted or Inbox tabs; we keep only the latest fetch and drop cached data that has not been refreshed for 30 days. We do not share YouTube data with any third party except the providers above as needed to run the service, and we do not use it for advertising. When you ask for a suggested reply to a YouTube comment, that comment and the commenter's name are sent to Anthropic to write the draft; nothing is sent unless you ask.

You can revoke SocAils' access to your Google account at any time at security.google.com/settings/security/permissions. Disconnecting YouTube inside SocAils deletes the stored token.

SocAils' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook, Instagram and Threads

We use Meta's official APIs to publish to the Pages and accounts you connect and to read the comments on those posts. You can remove SocAils from your Facebook settings at any time (Settings → Apps and Websites). Removing it there also sends us a deletion request; the status of that request is shown at socails.com/data-deletion.html.

TikTok

Posts go to TikTok through the official Content Posting API, either as drafts in your TikTok app or as direct posts. For a direct post you choose the audience (public, friends, followers, or only you) each time, and we honor the comment, duet and stitch settings on your account.

Deleting your data

Delete my account in Account settings removes your account, connected-account tokens, uploads, drafts, schedule, post log and metrics, and cancels any web subscription. Disconnecting a single social account removes its token. You can also revoke SocAils from each platform's own settings at any time. Deleted data is gone from live systems immediately and from backups within 30 days.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it by emailing support@socails.com. If you are in the UK or EU you have these rights under the GDPR; we answer every request within 30 days.

Children

SocAils is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone under 18.

Changes

When this policy changes we will post the new version here with its effective date. Material changes get an email to your account address.

Contact

Naylor Holdings LLC, Maumelle, Arkansas, USA · support@socails.com

Effective October 12, 2026. Terms of Service