Privacy Policy

Who we are

socialized.dev is operated by Fishball Ltd, a company registered in England and Wales (company number 16287336), with its registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom.

Fishball Ltd (“Fishball”, “we”, “us”, or “our”) is the data controller responsible for personal data collected through socialized.dev, including our website at socialized.dev, our dashboard at dash.socialized.dev, and our API at api.socialized.dev.

If you have questions about this policy or your personal data, contact us at yo@socialized.dev.

What we collect

We collect and store only the data required to provide our distribution service, authenticate users, and publish content to connected platforms:

• Account and authentication data: When you sign in via email magic link or Google sign-in, we record your email address, name, and profile photo. We do not collect or store passwords.
• Session and network data: Session identifiers, IP address (derived at the edge from Cloudflare headers; geolocation tracking is disabled), and user-agent details.
• Workspaces and brands: Workspace names, member associations, invitations, brand names, and brand identifiers created to organize publishing destinations.
• Developer API keys: Cryptographic API keys (prefixed sk_) along with their associated brand scopes and metadata.
• Webhook configurations: Endpoint URLs, a signing secret, descriptions, active state, and delivery records.
• Uploaded media files: Videos, thumbnail images, and caption files (SRT/VTT) stored in Cloudflare R2 object storage. Uploaded media files are served from a public custom domain (media.socialized.dev), meaning an uploaded file is reachable by anyone with its direct URL. This public access is required so external platforms (such as Instagram) can ingest media via pull-from-URL protocols.
• Connected platform credentials: OAuth access and refresh tokens for connected social platforms. All platform tokens are encrypted at rest using AES-256-GCM before storage.
• Connected account profiles: Platform account identifiers, channel or page display names, and public avatar URLs retrieved from connected platforms.
• Publication records: Post metadata (titles, messages, platform-specific overrides, scheduling parameters), status timestamps, platform-assigned post IDs, and live permalinks.
• Billing and usage metrics: Stripe customer identifiers, subscription states, and publication counters (post_publishedmeter) sent to Stripe for subscription management and usage-based billing.
• Marketing analytics: The marketing site at socialized.dev uses PostHog for pageview and conversion analytics. Before you choose, nothing is collected. If you accept analytics cookies, PostHog sets cookies and browser storage to understand repeat visits and site usage. If you reject, PostHog counts daily visits using an anonymous server-side hash that rotates daily; it sets no cookies, and only records your refusal in local storage so your choice is respected. The web dashboard (dash.socialized.dev), API (api.socialized.dev), and documentation (docs.socialized.dev) do not run PostHog or any third-party analytics scripts.

Why we process your data (lawful bases)

Under UK data protection law (UK GDPR), we must have a valid lawful basis to process your personal data. We rely on the following bases:

• Consent: When you accept analytics cookies on our marketing site, we process analytics data to understand how visitors use the site. You can withdraw your consent at any time using “Cookie settings” in the footer.
• Performance of a contract: Processing necessary to provide the Service you requested, including authenticating your account, creating workspaces, processing subscription billing, storing media assets, and dispatching publications to your connected destination platforms.
• Legitimate interests: Processing necessary for our legitimate business interests, balanced against your individual rights. This includes maintaining infrastructure security and uptime, preventing spam and abuse, delivering critical service communications and magic links, and measuring aggregate, cookieless marketing-site analytics when you reject cookies.
• Legal obligation: Processing necessary to comply with statutory and regulatory obligations under UK law, such as retaining transaction, invoicing, and VAT records for accounting and tax reporting.

Google user data and YouTube

socialized.dev connects to Google and YouTube APIs when you sign in with Google or connect a YouTube channel. We request only the permissions necessary to operate the service:

• openid, userinfo.email, and userinfo.profile: Used solely during sign-in to authenticate your identity, verify your email address, and display your name and profile photo.
• https://www.googleapis.com/auth/youtube.upload (youtube.upload): Used exclusively to upload the video files you compose and dispatch through socialized.dev to your connected YouTube channel.
• https://www.googleapis.com/auth/youtube.readonly (youtube.readonly): Used to read your connected YouTube channel’s title and avatar to identify your channel in the dashboard, check the processing and publication status of your uploaded videos, and list your channel’s existing playlists for the playlist picker in Compose.
• https://www.googleapis.com/auth/youtube.force-ssl (youtube.force-ssl): Used to attach caption files (SRT/VTT subtitles) to your uploaded videos and insert your uploaded videos into the playlists you select.

socialized.dev uses YouTube API Services. By connecting your YouTube channel, you agree to be bound by the YouTube Terms of Service and acknowledge that your information will be handled in accordance with the Google Privacy Policy.

Google user data is not sold, not used for advertising, not used to train AI or machine learning models, and not read by humans except with your explicit consent, to investigate security incidents or abuse, or to comply with applicable law.

Disconnecting your YouTube channel in the Connections page at dash.socialized.dev immediately and permanently deletes the access and refresh tokens we hold. Disconnect does not revoke socialized.dev’s OAuth grant at Google itself. To revoke that grant, use Google’s security settings at myaccount.google.com/permissions.

Meta (Instagram and Facebook) data

When you connect an Instagram account or Facebook Page, socialized.dev requests the following Meta permissions:

• instagram_business_basic: To read your professional (Business or Creator) Instagram account identifier, username, and profile picture, and verify account eligibility.
• instagram_business_content_publish: To upload and publish video Reels to your Instagram feed and profile grid on your behalf, and retrieve the published Reel’s permalink.
• pages_show_list: To list the Facebook Pages you manage so you can choose which Page to connect to your brand.
• pages_read_engagement: To read basic Page details and monitor publication status.
• pages_manage_posts: To publish videos, Reels, and captions to your selected Facebook Page.

Disconnecting an Instagram or Facebook account from the Connections page in dash.socialized.dev immediately deletes the tokens we hold. Disconnect does not revoke socialized.dev’s OAuth grant at Meta itself. To revoke that grant, use your Meta account and business integration settings.

Cookies and local storage

The marketing site at socialized.dev asks for your consent before using analytics cookies or storage. Before you choose, nothing is collected. If you accept, PostHog sets analytics cookies and browser storage (ph_<project_key>_posthog) to measure traffic and understand site usage. If you reject, PostHog sets no cookies; it counts visits using an anonymous server-side hash that rotates daily, and records your refusal in local storage (__ph_opt_in_out_<project_key> alongside fishball.cookie-consent) so we remember your choice without tracking you. Storing your refusal is strictly necessary to honor your choice under UK PECR. You can change your choice at any time with “Cookie settings” in the footer.

The dashboard (dash.socialized.dev) uses only strictly necessary cookies and storage, namely the sign-in session cookie (__Secure-better-auth.session_token) and, in your browser’s local storage, your light/dark theme choice (socialized:theme) and the brand you last selected (socialized.activeBrandId). During Google sign-in, a short-lived security cookie protects the sign-in from forgery. These are all needed for features you use, so they don’t need a cookie banner under UK PECR.

Sharing and subprocessors

We do not sell your personal data or share it with data brokers. We share data only with the third-party infrastructure and service providers necessary to operate socialized.dev:

• Cloudflare: Core infrastructure provider hosting our edge workers, D1 relational database, R2 object storage, KV store, Queues, Workflows, and CDN/DDoS protection.
• Stripe: Payment processing, subscription billing, and usage metering.
• Forward Email: Transactional email delivery for magic-link sign-in and workspace invitations.
• Destination platforms: Google (YouTube) and Meta (Instagram, Facebook), receiving only the video content, covers, captions, and metadata you explicitly choose to dispatch to them.
• PostHog: Marketing website analytics (limited to the public marketing site at socialized.dev).

International transfers

Our subprocessors and platform partners—including Cloudflare, Stripe, PostHog, Forward Email, Google, and Meta—may process personal data outside the United Kingdom, including in the United States and the European Economic Area.

Where personal data is transferred outside the UK, we rely on safeguards recognised under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework (the UK–US data bridge) or the Information Commissioner’s Office (ICO) International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses.

Your rights

Under UK data protection law, you have specific rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we erase your personal data when it is no longer needed.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Data portability: Request a machine-readable copy of your data or transfer to another provider.
• Objection: Object to processing carried out under our legitimate interests.

To exercise any of these rights, email us at yo@socialized.dev. We respond to all requests within 30 days.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at https://ico.org.uk.

Retention and deletion

We retain data only as long as necessary to provide the service:

• Disconnecting a platform: Immediately soft-revokes the connection and permanently zeroes out and destroys stored OAuth access and refresh tokens in our database.
• Archiving a brand: Revokes all connections bound to that brand and destroys their stored credentials.
• Uploaded media files: An upload you never publish is deleted after 48 hours. Media used in a publication is kept in Cloudflare R2 until you ask us to delete your account (see Account deletion below).
• Account deletion: To delete your account, workspaces, API keys, assets, and publication records, email yo@socialized.dev from your registered address. We complete account deletion within 30 days of receiving your request. Deletion instructions are detailed on our Data deletion page.

Deleting your data on socialized.dev does not remove videos already published to external platforms. Those posts live on YouTube, Instagram, or Facebook under your accounts and must be managed or deleted directly on those platforms.

Security

All traffic to socialized.dev, the dashboard, the API and media is served over HTTPS (TLS). Connected platform OAuth credentials are encrypted at rest using AES-256-GCM. Developer API keys are hashed. No plaintext passwords are ever collected or stored.

Children’s privacy

socialized.dev is for adults: you must be 18 or over to use it. We don't knowingly collect data from anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. When changes occur, we will update the “Last updated” date at the top of this page.