Privacy Policy

Last updated: May 16, 2026

Introduction

Scattr (“we”, “our”, “us”) operates scattr.app. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our service.

Data We Collect

Account Information

When you create an account, we collect your email address and password (hashed). If you sign up via Google OAuth, we receive your name and email from Google.

OAuth Platform Data

When you connect platforms (X, Telegram, Instagram, Facebook, Threads, LinkedIn), we receive and store:

Access tokens and refresh tokens protected by server-side access controls
Your username/handle on each platform
Your numeric user ID on each platform
Profile photo URL (for display purposes only)

Content You Create

We store the posts you compose in Scattr, including text content, uploaded images, scheduling preferences, and per-platform customizations.

Usage Analytics

We track post counts, platform usage, feature usage, and plan tier for billing and product improvement.

Cookies

We use essential cookies for authentication (session tokens). We do not use advertising or tracking cookies.

Server Logs

Our servers automatically log IP addresses, user agents, request timestamps, and response codes for security and debugging.

How We Use Your Data

To publish your content to the platforms you select
To authenticate you and maintain your session
To enforce plan limits and billing
To debug issues and improve the service
To communicate service updates via email

Third-Party Services

X (Twitter): We use X’s OAuth 2.0 to authenticate your account and the Twitter API v2 to publish posts on your behalf.

Telegram: We use Telegram’s Login Widget for authentication and the Bot API to publish messages to your chosen channel or DM.

Meta (Instagram, Facebook, Threads): We use Meta’s OAuth and Graph APIs to publish content to your connected accounts. Instagram requires professional accounts.

LinkedIn: We use LinkedIn’s OAuth 2.0 and Posts API to publish content to your profile.

Supabase: Our database and authentication provider. Data is stored in Supabase’s infrastructure.

Data Sharing

We do not sell your data. We share your content only with the platforms you explicitly authorize. We may share data with law enforcement if legally required.

Cookies and Tracking

We use only essential session cookies. No third-party analytics, advertising pixels, or cross-site tracking.

GDPR Rights (EU Users)

If you are in the EU/EEA, you have the right to:

Access: Request a copy of your data
Rectification: Correct inaccurate data
Deletion: Request deletion of your account and data
Portability: Receive your data in a machine-readable format
Objection: Object to processing of your data

CCPA Rights (California Users)

California residents may request disclosure of data collected, request deletion, and opt out of data sales (we do not sell data).

Data Retention

We retain your data for as long as your account is active. After you request account deletion, we delete your data within 30 days. Server logs are retained for 90 days.

Children’s Privacy

Scattr is not intended for users under 13. We do not knowingly collect data from children.

International Data Transfers

Our servers are located in the EU (Hetzner, Germany). If you access Scattr from outside the EU, your data will be transferred to and processed in the EU.

Security Measures

We use HTTPS encryption for connections, server-only credential access, row-level security in our database, and restricted service credentials for platform publishing.

Changes to This Policy

We may update this policy. Material changes will be communicated via email to registered users. Continued use after changes constitutes acceptance.

Contact

For privacy questions or data requests, contact us at 0xkekw@gmail.com.

← Back to Scattr