Privacy Policy
Last updated: May 26, 2026
This Privacy Policy explains how Kittichote Kamalapirat("we ", "us", or "our"), the operator of Post0(the "Service"), collects, uses, and shares your information when you use the Service. We are based in Thailand.
1. Information We Collect
Account information.When you create an account, we collect your email address and, if you set one, a password (stored as a salted hash). If you sign in with Google, we receive your name, email address, and profile picture from Google in accordance with the permissions you grant on Google's consent screen.
Connected social accounts. When you connect a third-party social account (such as Instagram, TikTok, or YouTube) to the Service, we receive an OAuth access token and a refresh token from that provider, together with basic account metadata such as the account ID, username, display name, and profile picture URL. We store these so we can publish content and read analytics on your behalf as described in your authorization.
Content you create. We store the posts, captions, media files, comments, schedules, and other content you upload or schedule through the Service.
Analytics data from connected platforms.When you view analytics in the Service, we retrieve metrics (such as follower count, reach, impressions, likes, comments, shares, and saves) from the connected platform's API on your behalf and display them to you.
Technical information. Our servers automatically log standard request data (IP address, user agent, timestamps) for security, debugging, and abuse-prevention purposes.
2. How We Use Your Information
- To create and operate your account.
- To publish posts and comments to the third-party social accounts you have connected, at the times you have scheduled.
- To retrieve and display analytics from your connected accounts.
- To provide customer support and respond to your inquiries.
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations.
We do not sell your personal information. We do not use your content or your connected-account data to train machine-learning models, and we do not share it with advertising networks.
3. Data from Meta Platforms (Instagram)
When you connect an Instagram Business or Creator account, we request the following permissions via the Instagram Business Login flow:
instagram_business_basic— to retrieve your account ID, username, display name, and profile picture so we can show the connected channel in the Service.instagram_business_content_publish— to publish images, videos, Reels, carousels, and stories on your behalf at the time you schedule.instagram_business_manage_comments— to publish a follow-up "first comment" on your own newly-published posts when you choose to add one in the post composer.instagram_business_manage_insights— to display account-level and per-post analytics for your connected account.
Data we receive from Meta is used only to provide the features described above and to show analytics to you. We do not share Meta-platform data with third parties except as required by law, and we do not use it for advertising or model training. You can disconnect your Instagram account from the Service at any time from the Launches page; doing so will cause us to delete the stored access token and account metadata for that connection.
4. Sharing and Disclosure
We share information only in the following limited cases:
- With the third-party platforms you have connected, when you publish a post or comment through the Service — by design, the post becomes visible on that platform.
- With our infrastructure providers (for example, our hosting provider Railway, our object storage provider, and our email-sending provider), strictly to operate the Service. These providers are contractually bound to use the data only on our behalf.
- When required by law, such as in response to a subpoena, court order, or other valid legal process.
- In connection with a merger, acquisition, or sale of assets, in which case we will notify you and give you the opportunity to delete your account before the transfer takes effect.
5. Data Retention
We retain your account information and content for as long as your account is active. When you delete your account or disconnect a social channel, we delete the corresponding data within 30 days, except where we are required to retain it to comply with legal obligations or resolve disputes.
6. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise any of these rights, email us at post0@theacorn.studio from the address associated with your account.
7. Data Deletion
You can request deletion of all data associated with your account at any time by emailing post0@theacorn.studiofrom your account's email address. We will confirm and complete the deletion within 30 days. If you used Sign in with Google or connected a Meta-platform account, deletion includes the OAuth tokens, account metadata, scheduled posts, published-post records, and cached analytics associated with those connections.
8. Cookies
We use a small number of essential cookies to keep you signed in and to remember your language preference. We do not use advertising cookies.
9. Children
The Service is not directed to children under the age of 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
10. Changes to this Policy
We may update this Privacy Policy from time to time. If we make a material change, we will notify you via email or via the Service. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
Questions about this Privacy Policy or your data? Email post0@theacorn.studio.
Kittichote Kamalapirat, Thailand.