Privacy Policy

1. About This Policy

Pipe Posts is a social publishing service operated by Numbat Web (ABN 80 697 984 048), an Australian business. This Policy explains what information Pipe Posts collects, why, where it is held, who else handles it, and how to have it deleted.

Numbat Web is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Policy covers the Pipe Posts service at pipe-posts.com (previously post.numbatweb.com.au, which now leads to the same service) only. Numbat Web's studio website and client services are covered by a separate policy at numbatweb.com.au/privacy.

By using Pipe Posts, or by connecting a social account to it, you agree to the practices described here.

2. Who This Policy Covers

Pipe Posts is a business tool. It is used by two groups of people:

• Operators — the people at your business who sign in to write, schedule and publish posts.
• Account holders — the business that subscribes to Pipe Posts and owns the connected social accounts, whether Numbat Web set it up or its owner created it by signing up.

Pipe Posts publishes outward only. It does not read, collect or store your followers, your audience, your comments, your direct messages, or any analytics about the people who see your posts. The service is not intended for use by anyone under 18.

3. Information We Collect Directly

• Account information: your business name, the names and email addresses of your operators, each operator's role (owner or member), your timezone, whether each email address has been confirmed, and, for an account you created yourself, which version of our Terms and this Policy you agreed to and when.
• Sign-in information: how each person signs in (an emailed link, a linked Google or Facebook account, see section 4) and, if they turned it on, their two step sign in. Sessions and emailed sign in links are stored only as one way fingerprints, never as the link or token itself. A two step authenticator key is encrypted under your business's own key. Numbat Web staff passwords are held in server configuration, never in the database. None of these is ever written to logs.
• Content you create: headlines, story text, links, scheduling times, and the images and video you upload — together with the per-platform versions Pipe Posts derives from them (resized crops, trimmed captions, encoded video).
• Publishing records: which channel a post went to, when, the permalink of the published post, how many attempts it took, and any error the platform returned.
• Technical information: server logs recording IP address, browser user agent, request path and timestamp, kept for security and fault diagnosis.
• A person check: where a form can send an email to any address (signing up, or asking for a deletion link), Cloudflare Turnstile checks that a person, not a script, sent it. Cloudflare reads signals from your browser and connection, such as your IP address, only to tell people from scripts, not to identify, profile or track you; Pipe Posts receives only a pass or fail.

Pipe Posts uses no analytics, no advertising cookies and no cross-site tracking. Every cookie it sets is its own and is strictly necessary for the service to work: one keeps you signed in; short lived ones carry a sign in, a sign up or a social account connection while it is in progress (from 10 minutes to an hour); and one remembers your device's time zone so times show correctly.

4. Signing In With Google or Facebook

You can sign in, or create an account, with a Google or Facebook account. That provider shows you what it will share before you agree. We ask only for your basic profile and email address, and we receive:

• a stable identifier for your account at that provider, which is how we recognise you next time;
• your name, and your email address if you choose to share it, together with whether the provider has confirmed that address (Facebook does not tell us, so we always confirm a Facebook email ourselves).

We store the identifier, the email address and whether it was confirmed, so that this account keeps signing in to your Pipe Posts account and to nobody else's. We do not receive or store your password, and we do not keep the provider's access token: we use it once, to confirm who you are, and discard it. We do not receive your contacts, friends, photos or posts. You can unlink a provider from Your account at any time, as long as another way to sign in remains.

Signing in with Facebook uses a Meta app that is separate from the one Pipe Posts uses to publish to your Facebook Page or Instagram account, and asks for nothing more than the above.

5. Information We Receive From Connected Platforms

When you connect a social account, that platform sends us information about it. The exact permissions requested are shown to you on that platform's own consent screen before you approve the connection, and we request the minimum needed to publish.

From Meta (Facebook and Instagram), where you connect a Facebook Page or an Instagram professional account, we receive:

• the list of Facebook Pages you manage, so you can choose which one to connect;
• the identifier and display name of the Page and of any Instagram professional account linked to it;
• an access token permitting Pipe Posts to publish to that Page or account on your behalf, and the date that token expires;
• after a post is published, the identifier and permalink of the published post, and any error message the platform returned.

From Google, where you connect a YouTube channel, we receive:

• the identifier and name of the YouTube channel you chose, so you can see which channel is connected (Google's “View your YouTube account” permission);
• a refresh token permitting Pipe Posts to upload the videos you choose to that channel on your behalf (Google's “Manage your YouTube videos” permission);
• after a video is uploaded, its identifier and link, and any error message YouTube returned.

Pipe Posts uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's own handling of information is described in the Google Privacy Policy. You can remove Pipe Posts' access to your channel at any time: disconnect it on your Connections page, which deletes the stored token, or remove Pipe Posts in your Google Account's security settings (Third party apps and services).

From TikTok, where you connect a TikTok account, we receive:

• the account's identifier and display name;
• a refresh token permitting Pipe Posts to post the videos you choose to that account on your behalf;
• each time you prepare a TikTok post, the account's current posting options (who can see a post, whether comments, Duets and Stitches can be allowed, and the longest video it accepts), so we can show you the choices TikTok offers;
• after a post is sent, its publishing status and identifier, and any error message the platform returned.

From LinkedIn, where you connect your LinkedIn profile, we receive:

• your LinkedIn member identifier and your name, so you can see which profile is connected (LinkedIn’s sign in permissions);
• an access token permitting Pipe Posts to post the content you choose to your profile on your behalf, and the date it expires (about 60 days);
• after a post is published, its identifier and link, and any error message LinkedIn returned.

We do not receive your connections, messages, email address or work history from LinkedIn.

From Mastodon, where you connect an account on a Mastodon server you choose, we receive:

• the account’s identifier, username and display name, so you can see which account is connected;
• an access token permitting Pipe Posts to post the content you choose to that account on your behalf (it does not expire until you or the server remove it);
• the server’s public settings, such as the longest post and the largest file it accepts;
• after a post is published, its identifier and link, and any error message the server returned.

We do not receive your followers, the accounts you follow, your messages or your email address from Mastodon.

We receive equivalent connection and publishing information from any other platform you connect.

We do not request, receive or store the content of your inbox, your follower or friend lists, your audience demographics, or advertising data.

6. How We Use Your Information

We use the information above only to run the service you have asked for:

• to publish the posts you create, to the accounts you have connected, at the times you choose;
• to reformat a single post into the version each platform requires;
• to keep your connections working — including warning you before an access token expires and prompting you to reconnect;
• to show you the status of each delivery, including failures and partial results;
• to operate, secure, support and troubleshoot the service;
• to bill your subscription and meet our tax and accounting obligations;
• to send you the emails the service needs: sign in and confirmation links, invitations, alerts about your connected accounts, trial and renewal reminders, and notices about your account. We do not send marketing email without your consent.

The writing assistant is optional. Your words are sent to it only when you press one of its buttons, and only the headline and story on screen. Its suggestions replace nothing until you choose to use them. We record how much each business uses it (not what was written) so we can keep its cost in check.

We do not sell your information. We do not use your content, your connected-account information or any data received from a platform for advertising, for profiling, or to train artificial intelligence models. We do not use it for any purpose other than those listed above without your consent, except where required by law.

7. Platform Data Handling

Information obtained through a platform's API — including access tokens, account identifiers and publishing results — is used solely to publish content on your behalf and to report the outcome to you. It is held only for as long as that connection exists. Disconnecting an account, or asking us to delete your data, destroys the stored credentials for it (see section 11).

This information is never sold, never shared with advertisers or data brokers, and never disclosed to anyone other than the service providers listed in section 9, who process it only on our instructions in order to run the service.

Google user data. Pipe Posts' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to upload the videos you ask us to publish and to show you which channel is connected and how each upload went; no person at Numbat Web reads it except to fix a problem you have asked us about, for security, or where the law requires.

8. Where Your Information Is Held, and How It Is Protected

Pipe Posts runs on a server in Helsinki, Finland. Its database is hosted by Neon in Frankfurt, Germany. Uploaded media is held on the application server's private volume and is served only through short-lived signed links that expire.

Access tokens for your connected social accounts are encrypted before they are stored. Each account holder has its own data key, which is itself encrypted with a master key held outside the database; tokens are sealed with AES-256-GCM. A token is decrypted only at the moment a post is being published. Nothing token-shaped is ever written to a log or an error message.

Because a data key is destroyed when an account is deleted, the credentials it protected become permanently unreadable — including in any backup. This is deliberate, and it is irreversible.

All traffic to and from Pipe Posts uses HTTPS. We take reasonable steps to protect information from misuse, loss and unauthorised access, but no internet service can promise absolute security.

Overseas disclosure. Because our hosting and database providers are located in Finland and Germany, your information is held overseas. Both operate under the European Union's General Data Protection Regulation, and we have taken reasonable steps to satisfy ourselves that they uphold protections comparable to the Australian Privacy Principles.

9. Service Providers

We share information with the following providers only to the extent needed to run the service:

• Neon — database hosting (Frankfurt, Germany)
• Hetzner — server hosting (Helsinki, Finland)
• Cloudflare — DNS, HTTPS, protection against malicious traffic, and the Turnstile person check. Cloudflare also tells Pipe Posts which country a visit comes from, worked out from your IP address; we use that only to show the price in your currency, and never store or log it. If you choose a currency yourself, your browser keeps that choice in a cookie
• Amazon Web Services — sends Pipe Posts' email (Amazon SES, Sydney, Australia): it receives each message's recipient and contents
• Google and Meta — where you sign in with them, they confirm who you are to us (section 4)
• Meta Platforms — receives the post content and media you have chosen to publish to Facebook or Instagram
• Google (YouTube) — receives the videos, titles and descriptions you have chosen to publish to YouTube
• TikTok — receives the videos and captions you have chosen to publish to TikTok, with the audience and settings you picked
• LinkedIn — receives the text, links and images you have chosen to publish to LinkedIn
• The Mastodon server you connect — receives the text, links, images, videos and image descriptions you have chosen to publish there, with the visibility you picked. Each server is run by its own operator, in the country that operator chooses
• DeepInfra — runs the assistant: when you press an assistant button in Compose, it receives the headline and story on screen to suggest titles or a rewrite, and, for Choose for me on a title, a small copy of that one image (512 pixels, without its location or camera details) to suggest a title style. It does not store or log that content and does not use it to train models
• Other platforms you connect — each receives only the content you have chosen to publish to it
• Stripe — where a subscription is billed on the web, Stripe processes the payment. Card numbers are handled entirely by Stripe and never reach Pipe Posts
• Apple and Google — where you subscribe through the App Store or Google Play, they process the payment and tell us only that the subscription is active
• Professional advisers — accountants or lawyers, where legally required

Every provider is required to handle information securely and in line with applicable privacy law. Publishing a post necessarily discloses that post to the platform you are publishing it to — that is the purpose of the service.

10. How Long We Keep It

• Drafts, posts and media: kept while your account is open, until you delete them.
• Publishing records: kept while your account is open, as the history of what was sent where.
• Access tokens: kept until you disconnect the account, the token is replaced, or your account is closed.
• Account information: deleted when your account is closed, subject to the records below.
• Sign up and sign in in progress: a sign in started with Google or Facebook is kept for 10 minutes; a sign up waiting for you to name your business for 30 minutes (an hour when it started from an emailed link). Each is deleted once used.
• A business that ends its free trial without subscribing: kept, paused, for 90 days, then deleted, after an email to its owner at least 30 days before.
• A request to close your account: kept for the 7 days before it is carried out, so you can cancel it. Afterwards we keep a record that an account was deleted and when, with no name or email address in it.
• Server logs: held in a rotating buffer of limited size — currently about 30 MB per service — with the oldest entries discarded as new ones arrive. They are not kept for a fixed period, and they are not archived elsewhere.
• Financial records: invoices and payment records are retained for seven years, as Australian tax law requires.

After deletion, residual copies may remain in our database provider's point-in-time restore history. That history is 24 hours, after which the deleted data is unrecoverable.

11. Deleting Your Data

You can delete your account yourself at any time, from Your account, or start at pipe-posts.com/delete-account. It happens 7 days after you confirm, and we email you a link to cancel it until then. If you are the only owner of your business, the business and its data are deleted with your account.

You can also ask us to delete your data at any time, and you do not need a reason.

Email [email protected] from the address on your account, telling us what you want deleted — a single connected account, your content, or everything. Full instructions, including what we can and cannot remove, are on our Data Deletion page.

We acknowledge every request within 5 business days and complete it within 30 days. Posts already published to a social platform are not ours to remove — they live on that platform and must be deleted there.

12. Access and Correction

You may request access to the personal information we hold about you, and correction of anything inaccurate, incomplete or out of date. Contact us at [email protected] and we will respond within a reasonable time, in accordance with the APPs.

13. Complaints

If you believe we have breached the Australian Privacy Principles, write to us at [email protected]. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If our response does not satisfy you, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5218, Sydney NSW 2001

14. Changes to This Policy

We may update this Policy to reflect changes in the service or in our legal obligations. The current version is always at pipe-posts.com/privacy, and the effective date at the top of this page tells you when it last changed. Where a change materially affects how we handle your information, we will tell account holders directly.

For any privacy enquiry, contact us at [email protected].