Privacy Policy

Karan Joshi (“Cue”, “we”, “us”)operates Cue, a social media scheduling tool that lets agencies plan, schedule, and publish posts to their clients' LinkedIn and Instagram accounts. This policy explains what we collect, why, and the choices you have.

Information we collect

• Account data. The email address you sign in with (via a passwordless magic link) and a display name you choose.
• Connected social accounts. When you connect a LinkedIn or Instagram account, we receive and store an access token (and, where provided, a refresh token) plus that account's platform id, username, and display name. Tokens are encrypted at rest and used only to publish on your behalf.
• Content you create. Post captions, scheduling times, and any images, videos, or documents you upload for publishing. Media is stored in Cloudflare R2.

How we use your information

We use the data solely to provide the service:

• Authenticate you and keep your workspace isolated.
• Schedule and publish your posts to the LinkedIn and Instagram accounts you connect, at the times you set.
• Show publishing status, history, and account health.

We do not sell your data or use it for advertising.

Platforms and third parties

Cue integrates with the official APIs of LinkedIn and Meta (Instagram). When you publish, your content and the relevant access token are sent to those platforms to create the post. Our use of the Instagram Platform complies with the Meta Platform Terms and Developer Policies. We also rely on these processors:

• Supabase — authentication and database.
• Cloudflare R2 — storage for the media you upload.
• Vercel — application hosting.

Data retention

• Access tokens are kept until you disconnect the account or delete the client, then removed.
• Published posts and their uploaded media are automatically purged about 7 days after they finish publishing; a lightweight record (platform, link, date) is retained for your history.
• Deleting a client or workspace removes its accounts, posts, and media.

Your choices and data deletion

You can disconnect any social account at any time from the Clients page, which immediately deletes its stored tokens. To request deletion of your account and all associated data, see our Data Deletion instructions or email us at joshikaran0008@gmail.com.

Security

Traffic is served over HTTPS and social access tokens are encrypted at rest. No system is perfectly secure, but we work to protect your data using industry-standard measures.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Contact

Questions? Email joshikaran0008@gmail.com.