MySoku legal
This policy explains what personal data MySoku collects, why we collect it, how long we keep it, and the choices you have. It covers mysoku.io, the MySoku app at app.mysoku.io, the MySoku apps for iOS and Android, our API, MCP server, and CLI, and the social media accounts you connect to MySoku.
MySoku ("MySoku", "we", "us") is a social publishing service. You write a post once, and MySoku publishes or schedules it to the social media accounts you connect, such as Instagram, X, Facebook Pages, Threads, LinkedIn, YouTube, and TikTok, and reports how those posts perform.
MySoku is the data controller for the personal data described in this policy. You can reach us at hello@mysoku.io.
We collect the following categories of data, depending on how you use MySoku.
We do not sell personal data, and we do not use the content of your posts or the data from your connected accounts to serve advertising.
When you connect a YouTube channel, MySoku uses Google's OAuth consent screen to ask for specific permissions. MySoku's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. MySoku also uses YouTube API Services, so by connecting a channel you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.
What we request and why. MySoku asks for only these scopes:
How we store it.Google access and refresh tokens are encrypted at rest and are used only by MySoku's servers to act on your behalf. We store the channel's id, handle, title, avatar URL, and upload status, the ids and statuses of videos uploaded through MySoku, and the metrics reported for those videos. We do not download, copy, or store your existing YouTube videos, your subscribers, or your watch history.
How we share it.We do not sell Google user data, transfer it to advertisers or data brokers, or use it to build profiles for any purpose other than providing MySoku to you. It is processed only by the infrastructure providers listed under "Who we share data with", and only to run the service. Humans at MySoku read Google user data only with your permission to resolve a support request, for security investigations, or where required by law.
How to revoke access.Disconnect the channel from the Accounts page in MySoku, which immediately deletes the stored tokens and stops all access. You can also revoke MySoku's access at any time from your Google Account security settings. Cached channel details and metrics are deleted within 30 days of disconnecting, and any scheduled posts to that channel are canceled.
The same principles apply to Instagram, Facebook Pages, Threads, X, LinkedIn, and TikTok. We request only the permissions needed to publish on your behalf and read performance data for the posts we published, we store platform tokens encrypted, we never post without an action you took or an automation you configured, and disconnecting an account deletes its tokens immediately. Each platform's own privacy policy governs how it handles your data, and you can also revoke MySoku's access from that platform's settings.
MySoku uses a session cookie to keep you signed in and first-party cookies to remember preferences and landing-page variants. We use PostHog for product analytics, Sentry for error reporting, and Cloudflare Turnstile to block bots on sign-in forms. These tools may collect usage and technical data described above. We do not use third-party advertising cookies.
We share personal data only with providers that help us run MySoku, under contracts that restrict them to processing it for us:
We may also disclose data when required by law, to protect the rights and safety of MySoku or others, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred data.
Platform tokens are encrypted at rest, all traffic uses TLS, access to production systems is limited to authorized staff, and sign-in uses one-time codes with rate limiting and bot protection rather than stored passwords. No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as required by law.
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can update your profile and disconnect accounts in the app. You can delete your account yourself in the web app or the iOS and Android apps under Settings → Profile → Delete account: this cancels your subscription immediately, disconnects your social accounts, signs you out everywhere, and permanently deletes your data after a 30-day grace period. To exercise any other right, or to delete your account by request, email hello@mysoku.io from the address on your account. We respond within 30 days. If you are in the EU, UK, or California, you also have the right to complain to your local data protection authority.
MySoku is operated from the United States, and our providers process data in the United States. If you use MySoku from elsewhere, your data is transferred to and processed in the United States under appropriate safeguards.
MySoku is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy as MySoku changes. We will post the new version here with a new effective date and, for material changes, notify you by email or in the app before they take effect.
Questions, privacy requests, and data deletion requests: hello@mysoku.io.