Privacy Policy

RepostX ("RepostX", "we", "us", "our") is operated by Brian Reynolds doing business as Talented Icons, an individually-operated business based in California, USA. This Privacy Policy explains what information we collect when you use RepostX (the "Service"), why we collect it, who we share it with, how long we keep it, and the choices and rights you have over it.

By using RepostX you agree to the collection and use of information in accordance with this policy. If you don't agree, please don't use the Service. This policy should be read together with our Terms of Service.

1. Who we are

RepostX is a link-in-bio and cross-posting tool: creators connect their social accounts, get a single public profile page (repostx.com/username) for their links and content, and can schedule their own original videos to repost across platforms. We are the "data controller" (or equivalent under your local law) for the personal information described below.

Contact: brian@talentedicons.com

2. Information we collect

Account information

• Email address and a bcrypt-hashed password (we never store your plaintext password)
• Username, display name, avatar/cover photos, bio and theme preferences you set
• Timestamps: account creation date and last login date

Connected-platform data (OAuth)

When you connect TikTok, YouTube, Instagram, or Facebook, we receive and store, on our servers:

• OAuth access tokens and refresh tokens for the account you connect
• Basic profile info from that platform: display name, avatar, and (where the platform provides it) a follower/subscriber count
• Metadata about your own videos on that platform: title, thumbnail, duration, publish date, and a share/permalink URL
• Video files you explicitly upload yourself as a fallback source for reposting

We only ever access data belonging to your own authenticated account on each platform — never another user's content, comments, or private data. Full platform-by-platform detail is in Section 6.

Shop / buyer information

If you sell paid content through RepostX's Shop feature, and someone buys it, we (via our payment processor Stripe) collect and store the buyer's email address, the amount charged, and a reference to the Stripe payment. We never see or store the buyer's card number — that's handled entirely by Stripe's own hosted Checkout.

Analytics and usage data

We record page views and taps (clicks on your links or social icons) on your public profile page as individual timestamped events, plus running lifetime totals, so you (and, in aggregate only, us) can see how your page is performing. This data is tied to your creator account, not to the identity of the visitor — we don't track who viewed your page, only that a view happened and when.

Cookies and session data

A single signed session cookie keeps you logged in. See Section 12.

3. How we use your information

We use the information above to:

• Operate your account and public profile page
• Authenticate to your connected platforms and list your own original content so you can choose what to repost
• Publish scheduled reposts to the destination platforms you choose, on the schedule you set
• Process Shop payments, deliver purchased content to buyers, and calculate our platform fee
• Show you analytics about your own page's performance
• Keep the Service secure, prevent abuse, and debug problems
• Send you transactional email (e.g. a buyer's purchase receipt/unlock link) — we don't send marketing email today

We do not sell your personal information, and we do not use your content or account data to train any machine-learning or AI model.

4. Legal basis for processing

If you're located in the EEA, UK, or another jurisdiction that requires a legal basis for processing, we rely on:

• Performance of a contract — most processing (account operation, reposting, Shop payments) is necessary to provide the Service you signed up for.
• Consent — connecting a third-party platform via OAuth is an affirmative action you take and can revoke at any time (see Section 6 and Section 9).
• Legitimate interests — security, fraud prevention, and aggregate product analytics, balanced against your rights.
• Legal obligation — where we must retain records (e.g. payment records) to comply with tax or accounting law.

5. How we share information

We don't sell your data. We share it only with the service providers that make RepostX work, and only to the extent needed to provide the Service:

Each of these providers has its own privacy policy governing how it handles data on our behalf. We also disclose information if required by law, subpoena, or to protect the rights, property, or safety of RepostX, our users, or the public.

6. Platform-specific disclosures

YouTube API Services

RepostX uses YouTube API Services. By connecting a YouTube account to RepostX, you agree to be bound by the YouTube Terms of Service, and you can review how Google handles your data in the Google Privacy Policy.

When you connect YouTube, RepostX accesses only your own authenticated channel's basic info (channel name, thumbnail) and your uploads list (so we can show you your videos to repost) — we never access any other channel's data, and we don't read comments, analytics, or subscriber lists (only the channel's own public subscribercount, when visible, to power your page's follower total). Your YouTube OAuth tokens are stored server-side, scoped to your RepostX account, and are never exposed to the browser or to any other user.

You can revoke RepostX's access to your Google account at any time, independently of RepostX, from your Google account security settings. Disconnecting there stops RepostX from making any further YouTube API calls on your behalf, but we recommend also disconnecting the account inside RepostX (Content tab → tap YouTube → Disconnect) so we delete our copy of your tokens and synced video data too.

RepostX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok

RepostX integrates with TikTok via TikTok's official Login Kit and Display API. When you connect TikTok, we request only the user.info.basic and video.list scopes: your basic profile (display name, avatar) and a list of your own public videos (id, title, cover image, share URL, duration, post date) so you can choose what to repost. We do not request or store TikTok direct messages, comments, or any other user's data. Your TikTok access and refresh tokens are stored server-side and automatically refreshed as needed; they're never exposed to your browser or any other user. You can revoke access at any time from TikTok's app permissions settings in the TikTok app (Settings and privacy → Security → Manage third-party access), or by disconnecting TikTok inside RepostX, either of which stops further API calls and (for the RepostX-side disconnect) deletes our stored tokens and synced video data. RepostX's handling of TikTok data otherwise follows TikTok's TikTok Privacy Policy and Developer Terms.

Meta (Facebook & Instagram)

RepostX integrates with Meta's platforms via two separate OAuth flows: Facebook Login (scopes pages_show_list, pages_read_engagement, used to list Pages you manage) and Instagram Business Login (scopes instagram_business_basic, instagram_business_content_publish). For Instagram, we access your own connected professional account's basic profile (username, avatar, follower count) and use the content-publishing scope only to post reposts you schedule — we do not read your Instagram DMs, comments, or any other account's data. Tokens are stored server-side and never exposed to the browser. You can revoke access from your Facebook/Instagram account settings ("Apps and websites" / "Apps and Websites" permissions) at any time, or by disconnecting the platform inside RepostX. See Meta's Privacy Policy for how Meta itself handles your data.

7. Data retention

We keep connected-account tokens and synced video metadata for as long as the connection stays active, and account/profile data for as long as your account exists. You're in control of deleting this data at any time:

• Disconnecting a platform (Content tab → tap the platform → Disconnect) immediately deletes that platform's stored OAuth tokens, every video we synced from it, and their repost history.
• Deleting your RepostX account (Account tab → Delete account) immediately and permanently deletes everything above for every connected platform, plus your page, links, and stats — there's no recovery period.

Shop purchase records (buyer email, amount, payment reference) are retained after account deletion for as long as required by tax and accounting law, and to prevent buyers from being charged twice for content they already own. Aggregated, de-identified analytics may be retained indefinitely.

8. Security

Access tokens are stored server-side, scoped per user, and are never exposed to the browser. Passwords are hashed with bcrypt, never stored in plaintext. All traffic to RepostX is encrypted in transit (HTTPS/TLS). Access to your dashboard requires a signed, verified session cookie tied to your account. Paid-content files are never served directly — only through short-lived, token-gated URLs. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we work to protect your information using industry-standard practices appropriate to a service of our size.

9. Your rights

Regardless of where you live, we extend the following rights to every RepostX user:

• Access — see what account info, connected platforms, and analytics we hold via your own dashboard at any time.
• Export / portability — email brian@talentedicons.com and we'll send you a machine-readable copy of your account data within 30 days.
• Correction — update your profile, display name, bio, and other account details directly in the dashboard.
• Deletion — delete a single connected platform's data (Content tab → Disconnect) or your entire account (Account tab → Delete account) yourself, instantly, with no recovery period; or email us to request it.
• Objection / restriction — object to or ask us to limit certain processing (e.g. disconnect a platform instead of deleting your whole account) by emailing us.
• Revoke platform consent independently — you can always revoke RepostX's access directly from TikTok, Google, or Meta's own account settings, in addition to disconnecting inside RepostX (see Section 6).

If you're in the EEA/UK, you also have the right to lodge a complaint with your local data protection authority. If you're a California resident, you have rights under the CCPA/CPRA to know, delete, and opt out of the sale of personal information — as noted above, we do not sell personal information.

10. Children's privacy

RepostX is not directed at children and is not intended for use by anyone under 13 years old. If you're in the EEA/UK or another jurisdiction that sets a higher digital consent age, you must be at least 16 (or have verifiable parental consent) to use RepostX. We do not knowingly collect personal information from children below the applicable age. If we learn that we've collected information from a child under that age without appropriate consent, we'll delete it promptly — contact us at brian@talentedicons.com if you believe this has happened.

11. International data transfers

RepostX is operated from the United States, and our infrastructure provider (Railway) may process and store data in the United States or other countries where it operates data centers. If you're accessing RepostX from outside the United States, your information will be transferred to, stored, and processed in the United States (and any other country our service providers operate in), which may have different data protection laws than your own country. Where required, we rely on standard contractual clauses or equivalent safeguards with our service providers to protect data transferred internationally.

12. Cookies

RepostX uses a single, strictly-necessary session cookie to keep you logged in — it contains a signed reference to your user ID and nothing else, and isn't used for advertising or cross-site tracking. We don't currently use analytics, advertising, or third-party tracking cookies of our own. If that changes, we'll update this policy and provide a way to manage cookie preferences.

13. Changes to this policy

We may update this policy from time to time as RepostX changes. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you (e.g. by email or an in-app notice). Continued use of RepostX after a change takes effect means you accept the updated policy.

14. Contact

Questions about this policy, or want to exercise any of the rights above? Contact us at brian@talentedicons.com. See also our Contact page.