Privacy policy

What we collect

• Your account: name, email address, and a salted scrypt hash of your password. We never store the password itself.
• Your product: the website you give us and the public pages we read from it, plus the brand profile, audience and plan built from them.
• Connected accounts: when you connect Reddit, Instagram or a Facebook Page, we store the access tokens those platforms issue, encrypted with AES-256-GCM, together with the account handle and id. For Meta we also keep your app-scoped Facebook user id so a deletion request from Facebook can find your data.
• What you make in Stoppr: public Reddit and X posts we found for you, the drafts and replies you edit or approve, posts you schedule, images and videos you generate or upload, AI creators you describe, and your credit usage.
• Browser extension: if you install it, it holds a token linking it to your workspace and fills in replies you queued on Reddit and X. It does not read your other tabs or browsing history.
• Technical data: your IP address, used briefly to rate-limit sign-ups, logins and scans, and kept no longer than two days.

Cookies

We set one cookie to keep you logged in (30 days) and a short-lived one while you connect an account, to protect that step from forgery. No advertising or analytics cookies.

How we use it

• To run the service: finding conversations, drafting replies and content, and posting what you approved, when you chose.
• To keep it safe: preventing abuse, fraud and automated sign-ups.
• To contact you about your account. We don't send marketing email unless you subscribe.

We don't sell your data, and we don't use your content to train AI models.

Who processes it for us

We share only what each service needs to do its job:

• OpenRouter and the AI model providers it routes to: text you ask us to draft from, and prompts for images and videos.
• Reddit and Meta (Facebook, Instagram): the posts and replies you approved, sent through your connected accounts.
• twitterapi.io: search terms used to find public posts on X.
• GIPHY: search terms when you look for a meme or GIF.
• Our hosting and database providers, who store the data above on our behalf.

How long we keep it

We keep your data while your account exists. Media for a scheduled Instagram or Facebook post is deleted once the post is published or fails. Found threads expire from your queue after a few days. When you delete your account, everything above is deleted immediately from our database.

Your choices and rights

• Disconnect any account on the Accounts page; Reddit access is also revoked at Reddit.
• Delete your account and all its data on the Accounts page, or see data deletion for the other ways.
• Ask for a copy of your data, a correction, or anything else about your privacy at hello@usestoppr.com. Depending on where you live (for example the EU, UK or California) you have rights to access, correct, delete and port your data and to object to processing; we honour them for everyone.

Security

Passwords are hashed, platform tokens are encrypted at rest, sessions are stored only as hashes, and every request is checked against the workspace it belongs to. No system is perfectly secure; if a breach affects you, we'll tell you promptly.

Children

Stoppr is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll update the date above and tell you by email or in the app before it takes effect.