Privacy policy

Last updated: 6 November 2026

Almost done. Fill in the parts in [square brackets] (name, address, email), then delete this box. Have a lawyer review the text before you open sign-ups to the public. It is a starting point, not legal advice.

Who is responsible

[Company or full name], [street and number], [postcode and city], [country]. Contact: [email address].

What OnceOut does

OnceOut lets you write a post once and publish it, now or at a scheduled time, to the social platforms you connect. It can also turn your own YouTube videos into text posts. To do that it has to store some data.

What we store

• Account: your email address and a hashed (not readable) password.
• Platform connections: the access tokens, app passwords or session cookies you give us for each platform, encrypted on the server, together with a display name such as your username.
• Posts: the text, photos and videos you submit, the platforms you chose, the schedule, and the result of each publish attempt, including links to the published posts.
• YouTube videos (only if you connect YouTube and use "Check for new video"): the ID, title, publish date and length of your newest uploads, and the captions (transcript) of the video you turn into posts. We keep the video ID and title with the posts made from it. The transcript is only used to write the posts and is not stored.
• Autopilot settings: how many posts you want per platform, your timing and quiet hours, your time zone, and the voice and style rules you type in.
• Technical data: a session cookie that keeps you logged in, and server logs with IP addresses and timestamps for security and troubleshooting.

Why, and on what legal basis

• To provide the service you asked for (Art. 6(1)(b) GDPR): account, connections, posts, scheduling.
• To keep the service secure and working (Art. 6(1)(f) GDPR): logs, rate limiting.
• To write posts from your videos when you ask for it (Art. 6(1)(b) GDPR): sending the transcript to our AI provider.

Who receives data

• The platforms you connect (LinkedIn, X, Threads/Meta, Bluesky, Substack, YouTube/Google, Instagram/Meta, TikTok) receive the posts you publish and the sign-in data needed to publish them. Their own privacy policies apply to what they do with it.
• Hosting provider: Render Services, Inc., USA. OnceOut's server and database run in Render's Frankfurt (Germany) region. Render processes data on our behalf under a data processing agreement with the EU Standard Contractual Clauses.
• AI provider (only when you use "Check for new video"): the video title, its transcript, and your voice and style rules are sent to OpenRouter, Inc., USA, which passes them to Anthropic's Claude model, run by Anthropic or a cloud provider it works with (such as Google Cloud, Amazon Web Services or Microsoft Azure), to write the post drafts. This happens under the providers' API terms, which do not allow them to use the data to train their models. Transfers to the USA are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

We do not sell your data and we do not use it for advertising. OnceOut uses no third-party analytics, fonts or trackers.

YouTube API Services

OnceOut uses YouTube API Services to upload videos you choose and, if you use "Check for new video", to read the list of your newest uploads and the captions of your own videos. Google's privacy policy applies to that: https://policies.google.com/privacy. By connecting YouTube you also agree to the YouTube Terms of Service: https://www.youtube.com/t/terms.

OnceOut only reads data from the YouTube account you connect, only to provide the features above, and never shares it with anyone except as described under "Who receives data". You can remove OnceOut's access at any time by disconnecting YouTube in OnceOut, or in your Google account at https://myaccount.google.com/permissions. When you disconnect, OnceOut deletes the stored YouTube credentials right away.

Cookies

OnceOut sets one cookie, a session cookie that is strictly necessary to keep you logged in. It needs no consent banner. The app also stores a draft and your platform selection in your browser's local storage on your device.

How long we keep it

• Account, connections and posts: until you delete them or your account. Deleting your account removes everything, including photos, videos and scheduled posts.
• Photos and videos not attached to a scheduled post are removed automatically after 3 days. Finished posts are removed after 90 days.
• The list of videos you turned into posts (video ID, title, status): the last 10 are shown in the app; all of it is removed when you delete your account.
• Server logs: kept by our hosting provider for a limited time, at most 30 days.

Your rights

You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. You can delete your account yourself under Accounts in the app. You also have the right to complain to a data protection authority, for example the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Kiel.

How to delete your data

You can delete everything yourself, at any time:

• Everything: open the app, go to Accounts, and tap "Delete my account and all saved connections". Your account, all platform connections, posts, photos, videos and settings are deleted immediately.
• One platform: go to Accounts and tap "Disconnect" on that platform. Its stored sign-in data is deleted immediately.
• By email: write to [email address] from the email address of your account, and we delete your account and all its data within 30 days.

If you connected Threads or Instagram and remove OnceOut in your Meta settings, you can ask us the same way to delete the data we received from Meta.

Connections can be revoked

Disconnect a platform in OnceOut to delete the stored credentials. For platforms that use sign-in screens you can also remove OnceOut's access in that platform's own settings.

Changes

If this policy changes in a way that matters, we will tell you in the app or by email.