Privacy Policy

FeedSquad connects to no other social networks today.

We publish only what you approve: posts, threads, images, videos, documents and replies. Approval comes from you, in FeedSquad, in Chief on Telegram, or in an AI assistant you have allowed to publish (section 6). Today Chief cannot approve or schedule a post on its own. If we ever offer an opt-in mode where it can, you'll have to switch it on yourself, and we'll describe it here first. Chief may move an approved post to a better time. On X, likes, reposts, bookmarks and hiding a reply happen only when you take or approve that action.

• Disconnect any account in Settings. FeedSquad stops using it straight away.
• For LinkedIn, X and Threads we delete the access tokens. Disconnecting your LinkedIn account also deletes the tokens of the Company Pages you added through it.
• A LinkedIn Company Page can also be turned off on its own: FeedSquad stops using it but keeps its token, so you can turn it back on. Removing the page deletes its token.
• For X we also ask X to revoke the access we were given. LinkedIn and Threads offer us no way to do that, so to end access completely there, also remove FeedSquad in the platform's own settings.
• Disconnecting does not delete what we already received, such as your posts, their analytics and what Stash learned from them. Delete those in FeedSquad or by deleting your account. The exception is LinkedIn comment data, which would be deleted as soon as you disconnect (section 7.1).

• We do not train or fine-tune AI models on your content. FeedSquad learns your voice and your business by storing what you tell it (in Stash and in Chief's memory) and including the relevant parts in each request to the model.
• We use our AI providers' business APIs. Under their API terms they may not use your data to train their models. They may keep requests for a limited time to detect abuse, under their own terms. We do not have a zero-retention arrangement with them.
• Every request to OpenAI is sent with storage switched off (OpenAI's store: false setting), so OpenAI does not keep it in its stored-responses features.

"Bring your own AI" in FeedSquad means connecting your own AI assistant, such as ChatGPT or Claude, to your account (section 6). The assistant then acts with the permissions you gave it, and your conversation with it is governed by your own agreement with that provider.

Overwride is another Herman Foundry Oy service. When you choose an Overwride rewrite for a post, we send the post's text to Overwride, which uses xAI's model (United States) to rewrite it (each part of a thread separately). Overwride stores its records in the EU (Ireland), and its servers run in the United States (Washington, D.C.), on the same infrastructure providers as FeedSquad (Supabase and Vercel). Rewriting a post creates a public Overwride record of your draft and the rewrite: anyone with the record's link, or with the exact text of the rewrite, can see both. FeedSquad cannot delete these records. We ask you before your first rewrite, and nothing is sent unless you choose it for a post.

• Connections use OAuth 2.1 with PKCE. You authorise each connection and see which permissions (scopes) it gets.
• AI platforms never receive your FeedSquad password or your social media credentials.
• Access tokens expire after one hour and are refreshed automatically. Refresh tokens are stored only as a hash.

When you use FeedSquad through an MCP-connected AI assistant, the assistant receives the data in each answer to a request it makes for you. Depending on which tools it uses and which permissions you granted, that can include:

• Your posts: their text, titles, platform, status and scheduled times, the calendar and campaign they belong to (campaign names, descriptions and themes), and their publishing history
• Media on your posts: the media type, the number of items and the alt text; when the assistant attaches or uploads media, time-limited links to those images, videos or documents; and, when it asks for a post in full detail, the media addresses stored on the post. Some of those stored addresses are time-limited links and some are permanent unlisted addresses
• Your connected accounts: the account labels and handles (for example a LinkedIn company page name), whether each connection is still valid, and the sign-in links to connect a platform
• Engagement metrics for your published posts (likes, comments, shares, impressions and engagement rate), and a written summary of what worked when the assistant asks for one
• Your brand context, when you use the brand tools: the facts you confirmed in FeedSquad about you and your brand, such as your display name and role, your voice and tone examples, your positioning, your audience, your approved claims and your brand colours
• Your plan and usage: which plan you are on, how many posts you have published this month, your queue headroom and your media allowance
• Writing checks: the results of checking a draft for patterns that read as machine-written, and entries from FeedSquad's public AI Tells Index
• In ChatGPT, if you grant the identity permissions, a stable identifier for your FeedSquad account, and your account email address and whether it is verified, so ChatGPT can recognise your account

FeedSquad shares this data only to do what you ask the assistant to do: draft, schedule, review and publish your posts, and report on your account. Some requests also send text or images to FeedSquad's own AI providers (section 5) to do the work:

• the draft and your brand voice, when the assistant asks for platform versions of a post;
• your post text, when it asks for a summary of what worked;
• the notes or transcripts the assistant passes to Stash, which are sorted by a model and wait in your Stash inbox until you approve them;
• visuals Pixel renders for the assistant: every rendered page is inspected by a model, together with the copy on it, before it is offered.

We never share your social media credentials, your payment details, your passwords or your voice recordings with AI platforms through MCP.

What the AI platform keeps from your conversation, and for how long, is governed by that platform's own privacy policy (see 6.4).

• You can revoke MCP access at any time from your FeedSquad settings or from the AI platform.
• Posts created through MCP are saved as drafts. They are published only when you approve them: in FeedSquad, or in the assistant itself if you granted the publishing permission. That permission is part of the default set, so check the consent screen and leave it out if you want to approve every post in FeedSquad.
• Actions taken through an AI assistant are recorded in your account with MCP as their source.
• Rate limits apply to MCP use according to your plan.

When you use FeedSquad through a third-party AI assistant, your interactions are also subject to that platform's privacy policy:

• OpenAI (ChatGPT): openai.com/privacy
• Anthropic (Claude): anthropic.com/privacy

If a customer connects a LinkedIn Company Page, FeedSquad can read the comments other LinkedIn members leave on that page's posts so that the page owner can read and reply to them inside FeedSquad. The page owner decides to do this, and we process the comments for them. Because LinkedIn's terms bind us directly, we also set the limits below ourselves, and they apply whatever the page owner asks.

Reading these comments is switched off today: FeedSquad collects none of them now. The commitments below apply from the day it is switched on.

When a customer sends a newsletter with Herald, we store their subscribers' email addresses and names, the tags and notes the customer adds, subscription status, and proof of consent: when and where someone subscribed and confirmed, with the IP address used. Public sign-ups are confirmed by email (double opt-in). Newsletters are sent through Resend, and we record delivery, first open, first click, bounces and complaints. Every newsletter has a one-click unsubscribe link. When a subscriber is erased, their record and delivery history are deleted, and the consent log keeps only a scrambled (salted hash) form of the email address, as proof that the erasure happened. Subscribers who unsubscribe, or whose address bounces, are erased the same way 30 days later. An erased address cannot be added back to that customer's list by an import or by hand; the person can still sign up again themselves. Newsletters load no web fonts from Google or other font services.

Scout looks for public posts on X and Threads about the topics a customer tracks, and judges whether the author could be a good lead for that customer, using an AI model and the customer's ideal customer profile. We store the author's handle and display name, a link to the post and a short excerpt. For people the customer saves as leads we also store the name, role and company shown publicly, why they look relevant, a fit score and a suggested opening line. After 90 days the excerpt, handle, name and link of each observed post are erased. Saved leads stay until the customer deletes them. Scout never uses LinkedIn data.

Pulse helps a customer keep track of the people they interact with on X. We store each person's X ID, handle, display name and picture, whether they follow each other, the labels the customer sets (for example peer, customer or partner), relationship goals, and interaction history, along with replies to and mentions of the customer's posts. People Pulse has only observed are deleted 90 days after they were last relevant, and raw replies after 90 days; ended relationship goals are deleted after 400 days. People the customer confirms or links to a lead stay until the customer deletes them. Unanswered replies on Threads are deleted after 7 days.

A customer can invite colleagues to their team and to Whisper, which helps employees share company posts. We store each member's name, email address and role; for Whisper also their job title, industry, the topics they speak about and the topics they want to avoid, the drafts written for them, and how their posts perform. Whisper ranks team members by how well a post fits them, so it can suggest who should share it. Invitations are sent by email through Resend.

When a customer connects Google Calendar to Chief, we store what section 4 describes. We do not store calendar attendees' identities.

Posts, photos, recordings and notes can name or show other people. The customer who adds them is responsible for having the right to use them. We process that content only to provide the Service.

Our database and file storage are in the EU (Ireland), and our server functions run in the EU (Frankfurt). Product analytics and error monitoring are also hosted in the EU.

Several providers process data outside the EU, in the United States: our AI providers, payments, email, website analytics and the isolated computers Pixel uses for media work. Vercel, Stripe, Resend, Sentry, PostHog and Google are certified under the EU–US Data Privacy Framework, and for them we rely on it together with the EU Standard Contractual Clauses in their data processing terms. Supabase, OpenAI and Anthropic are not certified; for them we rely on the Standard Contractual Clauses. The sub-processor list names the safeguard for each provider. You can ask us for a copy of the relevant safeguards at privacy@feedsquad.com.

• Account, content and brand context: until you delete the item or your account.
• Images uploaded to a post: up to 90 days after upload. Images on an unpublished (draft or scheduled) post are kept until it is published or you remove them; after publishing, the platform hosts its own copy.
• Media attached through an AI assistant: deleted 30 days after the post is published; uploads never attached to a post, after 7 days; assets saved for reuse, 30 days after upload if never used, or 90 days after they were last used; unfinished uploads, after 24 hours.
• Pixel's shelf (images, screen recordings, the pages you approved for capture and their screenshots): until you delete them or your account. Shelf images are stored at unlisted web addresses that anyone holding the exact address can open; we do not list or publish those addresses. Screen recordings are stored privately and reachable only through short-lived links issued to your account.
• Parley interviews: recordings and transcripts are kept until you delete them or your account.
• Newsletter subscribers who unsubscribed or bounced: erased 30 days later, keeping only the salted hash that stops the address being added back (section 7.2).
• Connections: tokens until you disconnect (section 3.3).
• Other people's data: as section 7 describes (LinkedIn comments 24 and 48 hours, once comment reading is switched on; Scout and X data 90 days; Threads replies 7 days; lapsed newsletter subscribers 30 days).
• Rate-limit counters: 7 days.
• Accounting records: as long as the Finnish Accounting Act requires.

• Ask in Settings → Account, or email privacy@feedsquad.com. Deletion is processed by our team without undue delay, and completed within 30 days of your request.
• We delete your account, your content and your connections. Your Pixel shelf is purged automatically 14 days after your request.
• Your subscription is cancelled at Stripe. Accounting records stay as the law requires.
• We also delete your product analytics data in PostHog: your analytics profile and its events.
• Other records our providers hold outside our database, such as email delivery logs and error reports, are not yet removed automatically. They expire under those providers' retention settings, or we have them removed when you ask.
• Copies in backups disappear as the backups expire.
• What you published stays on the platforms you published to. Delete it there.

• The cookie banner asks everyone who has not answered yet, on the website and in the app, signed in or not. Your choice is stored in your browser's local storage.
• PostHog (product analytics, EU-hosted) does not run at all until you accept analytics cookies: nothing is recorded, not even in memory. After you accept, it records page views and clicks, stores its identifier in a cookie and local storage, and links events to your FeedSquad account ID when you are signed in. If you decline, or later withdraw, it stops and its cookie and local storage are deleted. We do not record sessions: PostHog's session recording is switched off.
• Google Analytics runs in Google's basic consent mode: its script is not loaded, and Google receives nothing from us, until you accept. After you accept, analytics cookies are set; advertising storage stays off. If you decline or withdraw later, it stops sending and we delete its cookies.
• Vercel Web Analytics and Speed Insights count page views, a few product steps (such as finishing sign-up) and page speed. They set no cookies and use no account ID, and run without consent.
• Server events: our servers record product events (for example, that a post was scheduled) with identifiers, counts and categories, never content. The banner does not affect them; the product analytics switch in Settings does.

You can change your choice at any time through "Cookie settings" in the website footer or the app sidebar. If you are signed in and want your account left out of product analytics everywhere, switch off Settings → Account → Privacy → Product analytics.