xposterXPOSTER · Your data
Privacy Policy
Effective and last updated: 15 October 2026
This policy explains how the XPOSTER iPhone app, publishing service and website handle your information. The data controller is Rewrite, CVR 43102990, Denmark. Contact contact@xposter.dk about privacy or your data.
1. Information we handle
- Videos and drafts. The video you select, its title and captions, duration and dimensions, selected platforms, visibility and audience declarations, interaction options and other posting choices. The app imports a working copy of the selected video; selecting a video does not give our server access to your whole Photos library. A video is sent to our backend when you start its upload.
- Preferences on your iPhone. Saved platform defaults, such as your usual destinations and YouTube visibility, and TikTok interaction preferences. Drafts and these defaults are stored locally; XPOSTER does not provide cloud draft synchronization.
- Connected-account information. Account or channel identifiers, display names, authorization and refresh tokens, and information returned about publishing or processing. You authorize access through the relevant platform. We do not receive your Instagram, TikTok or Google password.
- Publishing and connection records. Installation/session credentials, request identifiers, destinations, posting settings, status and error information, timestamps and platform post identifiers. Your device credential is stored in Keychain; the server stores its hash. These records help avoid duplicate submissions and support destination-specific retries.
- Apple identity, subscriptions and usage. When Apple billing is enabled, Apple-signed app-purchase information links your installation to a pseudonymous usage account. We process app-purchase, subscription and transaction identifiers, an app-account token, entitlement status, billing-period dates and accepted-crosspost counts. The service verifies these with Apple and processes signed subscription notifications. This integration does not provide us with your Apple Account password, email address or payment-card details. In previews, an installation session may be used instead of an Apple purchase identity.
- Website, security and support information. IP addresses and ordinary network/request information needed to deliver the service and address abuse or faults, plus your email address and anything you send to support. This website has no analytics scripts, advertising trackers, embedded social feeds, third-party fonts or non-essential cookies.
2. How and why we use it
We use this information to save your work, connect accounts you authorize, upload and publish the content you confirm, display progress and history, retry affected destinations, clean up working files, verify and restore purchases, and enforce posting allowances. We also use relevant information to answer support enquiries, secure the service, investigate faults and meet legal obligations.
Saved defaults apply to new drafts. TikTok visibility is chosen for each post, and applying saved interaction preferences still requires your action. Posting declarations are transmitted with the post where required by the selected platform.
Under the GDPR, our legal bases are performance of our agreement with you for the service you request (Article 6(1)(b)), legitimate interests in service security and reliability (Article 6(1)(f)), and compliance with applicable legal obligations (Article 6(1)(c)). Authorizing a platform connection lets us access the information needed for that integration; you may revoke it. We do not sell your personal data, use your videos or connected-account data for advertising, or use them to train general-purpose AI models.
3. Who receives information
Your selected platforms receive the video, title, caption, account information and posting instructions needed for publication. Access to a server-held video may be provided through a temporary signed download link. Anyone with a valid link can retrieve that video until the link expires or the file is removed. Files are not listed on this website.
Instagram, TikTok and YouTube process information under their own terms and privacy policies. Their controls govern content once they receive it. Apple processes App Store payments and receives the identifiers needed to verify purchases and subscription status. We use Hetzner for backend and website hosting, and our email provider for support correspondence. Relevant providers process information to supply those services.
We may also disclose information when legally required or necessary to protect legal rights or service security. We do not provide your content to unrelated advertisers or data brokers. Some platform or support processing may take place outside the European Economic Area. Where Rewrite arranges a transfer requiring safeguards, applicable data-protection requirements apply; contact us for details of the arrangements relevant to your information.
4. Google and YouTube information
XPOSTER uses YouTube API Services. With the youtube.upload and youtube.readonly permissions, we identify your channel, upload the videos you confirm, and check their status. Your YouTube caption is sent as the video description, together with your chosen title, visibility, audience and applicable disclosure settings. These permissions are not used to read Gmail or download your existing YouTube video library.
XPOSTER’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. See the Google Privacy Policy for Google’s practices.
You can revoke XPOSTER’s access through Google’s security permissions page and disconnect YouTube in XPOSTER. Revoking access does not remove videos already uploaded to YouTube. To request deletion of retained YouTube API data held by Rewrite, contact us using the process in section 6.
5. Automatic cleanup, retention and security
Cleanup of published video working copies is automatic. Once every selected destination confirms successful publication or processing, the backend deletes the uploaded original and its download record. Cleanup runs during the service’s worker cycles while it is operating; an outage can delay it. A partial success does not trigger early deletion while another selected destination still needs the file.
| Information | Retention and control |
|---|---|
| Server video: all destinations succeeded | Automatically removed during cleanup after success is confirmed. |
| Server video: failed or uncertain result | Kept for up to seven days from upload to support retries, then removed during cleanup. A retry does not extend the deadline. |
| Unused or interrupted server upload | Removed during cleanup after 24 hours if it was not submitted as a publishing job. |
| Imported copy inside XPOSTER | Removed when the app next synchronizes the server cleanup result. Submitted local copies also expire after seven days during synchronization. Unsubmitted local drafts stay until you delete them or remove the app. |
| Photos originals and published posts | Remain in Photos or on the selected platform. Manage them through those services. |
| Publishing history and connected-account credentials | Kept separately from the video. File cleanup does not remove titles, captions, posting settings, results or platform post identifiers. Disconnecting removes the stored connection credentials; contact us about other retained records. |
| Subscription, identity and usage records | Kept as needed to verify access, count accepted crossposts, restore purchases, handle billing changes and meet applicable obligations. They are not deleted by video cleanup or by disconnecting a social account. |
| Support correspondence | Kept as necessary to resolve your enquiry and meet applicable obligations. |
Connections use HTTPS. Platform authorization credentials and publishing job records are encrypted at rest on the backend. Uploaded video files are stored separately with access restricted to service purposes. No storage or transmission method guarantees absolute security.
Automatic cleanup covers active XPOSTER working storage. It does not remove copies in pre-existing device or server backups. We do not describe XPOSTER as a video archive; keep your own originals.
6. Your controls and privacy rights
You can delete drafts from the app and manage connected accounts from Settings. You can also revoke access through Google’s security settings, Instagram’s connected-app controls, or TikTok’s connected-app settings. Disconnecting cannot undo an upload already accepted by a platform. Apple subscriptions can be restored or managed from Plans & Usage; removing the app or disconnecting a platform does not cancel an Apple subscription.
Automatic video cleanup requires no request. For access, correction, a copy or deletion of other server-held personal data, or earlier removal of a retained file, email contact@xposter.dk with the subject “XPOSTER privacy request”. Identify your connected account or channel and explain the request. We may need reasonable information to verify ownership; do not send passwords, payment details or access tokens.
Requests to delete YouTube API data are handled as soon as possible and within seven calendar days. Other requests are handled within applicable legal deadlines, normally one month. We may retain limited information where legally required and will explain any applicable exception. Deleting information held by XPOSTER does not delete content held by the platforms or transaction records independently held by Apple.
Where the GDPR applies, you may also have rights to restrict processing, object to processing based on legitimate interests, and data portability. You may complain to your local supervisory authority or Datatilsynet, the Danish Data Protection Agency. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
7. Children and policy changes
XPOSTER is intended for people aged 18 or over. Contact us if you believe a child has provided personal data through the service, so we can investigate and remove it where appropriate.
We publish updates and their date here as the service changes, and provide notice of material changes where required. New uses of connected-account information requiring additional permission will require that permission before use.
8. Contact
Rewrite · CVR 43102990 · DenmarkPrivacy and support: contact@xposter.dk