Privacy Policy

Privacy Policy

TryPost by CobiHay is a social media content planning and publishing service operated by Cobi Hay Digital. It is used by businesses, agency teams and the client accounts they manage. This policy describes the data the service actually processes, why it is processed, and what you can do about it.

1. Data we process

User account data. The name and email address of the person using the service, their sign in credentials, the workspaces they belong to and the role they hold in each, and their interface preferences such as language.

Connected social media accounts. When you connect an account, we store what the network returns for that account: its identifier at the network (for TikTok, the open_id), the basic public display identity such as the display name or handle, the profile picture, and the list of permissions the network granted. The profile picture is stored as a copy on our storage so the interface can show it.

Access and refresh tokens. Connecting an account produces an access token and, on most networks, a refresh token. These are what allow TryPost by CobiHay to publish on your behalf. They are stored encrypted at rest in our database and are never shown in the interface or sent to your browser.

Content you create. Post text, the images, video and documents you upload to the workspace library, the accounts and formats you selected, the per network settings you chose, scheduling times, comments teammates leave on a post, and templates.

Publishing results. For each post and each account: whether it was published, when, the identifier and link the network returned, and the error the network reported if it failed. Where a network exposes performance figures for content published through the service, those figures are shown in the interface.

Operational data. Ordinary server and application logs needed to run the service and investigate faults.

2. Why we process it

• To provide the service: to store what you plan, and to publish it to the accounts you connected, at the times you set.
• To keep a connection alive, by refreshing an access token before it expires, and to tell you when a connection needs to be reconnected.
• To show you the state of your work: the calendar, the drafts, what published and what failed, and the figures a network reports back.
• To secure the service: to authenticate users, separate one workspace from another, and investigate abuse or faults.

We do not use your content or your connected account data to build advertising profiles, and we do not use it to train AI models.

3. How tokens are handled

• Access and refresh tokens are encrypted at rest in the database.
• Token refresh happens server side. Tokens are never exposed to the browser and are not written into post content or logs of the interface.
• Tokens are used only to perform the actions you asked for on the account they belong to.
• Deleting the connected account inside TryPost by CobiHay deletes the stored tokens with it.

4. Who else sees the data

We do not sell personal data, and we do not share it for advertising. Data leaves the service in three narrow situations:

• The social network you publish to. When a post is published, its text, its media and the settings you chose are sent to that network through its official API. From that point the network’s own terms and privacy policy apply to the published post.
• Service providers that run the service. Hosting, database and file storage, and email delivery. They process the data on our instructions in order to operate the service.
• AI providers, only if you use the AI features. If you ask the service to draft or review content for you, the text and, where relevant, the media involved in that request are sent to the AI provider configured for this installation. If you do not use those features, nothing is sent.

We may also disclose data where the law requires it.

5. TikTok

TikTok is connected through TikTok’s own login screen. The authorization request asks for exactly two permissions:

• user.info.basic — the account’s open_id and its basic display identity, so the interface can show which account a post will go to.
• video.publish — permission to publish the post you created to that account.

The authorization request does not ask for permission to read follower counts or other profile statistics, it does not ask for access to the videos already on the account, it does not ask for access to messages, and it does not request video.upload. What we send to TikTok is the video or the photos you attached, the caption you wrote, and the settings you selected including who may view the post and the commercial content declaration. What we receive back is the identifier and the publishing status of that post.

You can disconnect TikTok inside TryPost by CobiHay at any time, which deletes the stored tokens, and you can also revoke access from TikTok’s own settings.

6. Retention, disconnection and deletion

We keep data for as long as it is needed to run the service for you: a post and its media stay in the workspace until they are deleted, and a connected account stays until it is disconnected. There is no fixed retention period beyond that.

• Disconnecting an account deletes the connected account record and its encrypted tokens from our database, and removes it from posts that were still waiting to publish. Posts already published keep their history so the record of what went out is not lost.
• Deleting content that you created inside a workspace removes it from the workspace. Content already published to a social network has to be removed on that network.
• Closing an account or a workspace, or asking for the deletion of the data held about you, is done by writing to cobihay@gmail.com. Backups and ordinary server logs age out on their own schedule.

7. Your rights and contact

You can ask what data we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to cobihay@gmail.com and we will answer. If we change this policy, the date at the top of this page changes with it.

See also the Terms of Service.