Privacy Policy

Effective October 23, 2026

BlastCP ("BlastCP", "we", "us") provides a posting-queue application at blastcp.com that drafts, schedules, and publishes posts to social platforms — for people and for AI agents acting on their behalf. This policy explains what data we collect from people who use our site and application, how we use it, and the choices you have.

1. Information we collect

Account information. When you sign in with Google or a magic-link email, we receive your name, email address, and profile photo (if provided by Google). We use Supabase Auth to manage sign-in and store session data.

Signing in through Weft. Signing in to Weft, our desktop app, can create a BlastCP account for you: Weft sends us your Weft sign-in, and if your email is new to BlastCP we create an account with your name, email address and profile photo from it, plus a workspace, and give Weft an access token for it (section 4). If your email already has a BlastCP account, nothing is linked until you sign in to BlastCP and confirm it. We store which Weft account belongs to which BlastCP account.

Workspace. We store your workspace's name and slug, and who is a member of it.

Content you create. Posts you draft or schedule — the text, a promoted link, and that link's preview card (title, description, image), every saved version of each post, and the images and videos you attach or generate — plus your workspace's posting schedule, are stored so the product can function.

Your writing library. Each property keeps a voice (how the brand sounds, and what it never does) and a set of playbooks for kinds of posts. BlastCP seeds a starter set; you and your agent edit it, and we store what you write.

Connected channels. When you connect a LinkedIn, Substack, Facebook Page, Instagram, Threads, YouTube, TikTok, Gmail, Resend or Slack account so BlastCP can post on your behalf, we store the credentials needed to do that. Some channels also send us back the statistics of your published posts (YouTube, TikTok, Instagram) or the comments on them (YouTube, and the comment notifications Meta sends for Facebook, Instagram and Threads). Section 3 says what each one involves.

Link previews. When a post promotes a URL, we fetch that page's public OpenGraph tags on our server to build the preview card, unless you fill the card in yourself. We don't record what you browse — only the URL you attach to a post.

Usage data. On blastcp.com, Google Analytics and PostHog record the pages you visit and how you use them, and PostHog records sessions; inside BlastCP we record events such as a channel connected or a post published. Section 7 says exactly what.

Support and feedback. If you email support, or send a feature request, bug report or channel request from the app, we store your email address and what you send. Feedback reaches our team by email and in our own Slack.

2. How we use information

• To provide, operate, and maintain BlastCP and your account.
• To authenticate you and keep your session secure.
• To publish or draft your posts at the time you or your agent set, through the channels you connect, via scheduled jobs that run on a timer.
• To build link-preview cards for posts that promote a URL.
• To give your writing library to whatever writes for you — your agent, the copilot in the post editor, and the voice check — so posts sound like you.
• To check each saved post against your voice and suggest edits, to rewrite text when you ask the copilot, and to generate an image when you or your agent ask for one. These use the AI providers in section 6.
• To read your published posts' statistics back from YouTube, TikTok and Instagram, show them to your workspace, and suggest posting times from your own past posts.
• To collect the comments on your YouTube videos in your inbox, draft a reply in your voice, and send the replies you approve.
• To send the notifications and reminders you set up, in Slack or by email.
• To understand how BlastCP is used and to find and fix problems (section 7).
• To respond to support requests and feedback.

3. Connected accounts: LinkedIn, Substack, Facebook, Instagram, Threads, YouTube, TikTok, Gmail, Resend and Slack

LinkedIn. Connecting LinkedIn uses OAuth. We receive an access token, valid for 60 days and not automatically renewed, with the scopes openid profile email w_member_social. We store that token encrypted at rest and use it only to publish the posts you or your agent schedule through BlastCP — never to read your LinkedIn activity, and never to post anything you didn't queue. Disconnecting revokes the token at LinkedIn and removes it from our database.

Substack. Substack has no OAuth, so connecting it means pasting your own Substack session cookie. We store that cookie on our server and send it only to substack.com, and we use it only to create draft posts in your publication — BlastCP never publishes to Substack itself, only drafts. This is plainly full access to your Substack account, equivalent to being signed in as you, so treat it with the same care as a password. You can end this access at any time, either by disconnecting in BlastCP or simply by signing out of that session on Substack, which invalidates the cookie. Disconnecting deletes the stored cookie. Importing your publication's past posts reads its public archive and doesn't use the cookie.

Facebook Pages and Instagram. Both connect through one Facebook Login screen, because BlastCP publishes to an Instagram professional account through the Facebook Page it is linked to. Each permission has one job:

• pages_show_list, business_management — to list the Pages you manage, including Pages owned by a business portfolio, so you can pick which to connect.
• pages_read_engagement — to read each Page's name, picture and the Instagram account linked to it.
• pages_manage_posts — to publish the posts you or your agent schedule to the Page you picked.
• pages_manage_metadata — to receive Meta's notifications about that Page, such as a new comment on one of its posts.
• instagram_basic — to identify the Instagram account you connected (its ID, username and picture), and to read its most recent posts when we need to confirm whether a post went out.
• instagram_content_publish — to publish the photos, carousels, Reels and stories you or your agent schedule, and to check that account's daily publishing limit.
• instagram_manage_insights — to read the statistics of your own Instagram posts, such as views, reach, likes, comments, shares and saves, which BlastCP shows to the members of your workspace.

We store the Page tokens Meta issues and use them only on the Pages and Instagram accounts you picked, for those purposes. Facebook Login also gives us an identifier for your Facebook account; we never read your personal profile, friends or messages, or anyone else's Pages. Instagram fetches each image or video from our storage provider by its address, and we make temporary JPEG copies of PNG and WebP images because Instagram accepts only JPEG. If Meta notifies us of a new comment on your Page's or account's posts, we store it and draft a suggested reply with our AI provider; BlastCP doesn't reply on Facebook or Instagram. Disconnecting deletes the stored tokens and the statistics we read; to end the grant at Meta too, remove BlastCP from the business integrations in your Facebook settings. Meta can also ask us to delete your data on your behalf (see Deleting your data). Meta's handling of your data is described in the Meta Privacy Policy.

Threads. Connecting Threads uses Threads' own login with threads_basic, to identify the profile you connected (its ID, username, name and picture), and threads_content_publish, to publish the posts you or your agent schedule, with the topic tag you chose. Where location tagging is offered, BlastCP also asks for threads_location_tagging, to search Meta's places when you look for a location and attach the one you pick to a post. We store the token Threads issues, renew it before it expires, and use it only for those purposes — we never read your feed, followers or messages. Threads fetches each image or video from our storage provider by its address. Disconnecting deletes the stored token; to end the grant at Threads too, remove BlastCP from the website permissions in your Threads settings. Meta's handling of your data is described in the Meta Privacy Policy.

YouTube. BlastCP uses YouTube API Services. Connecting a YouTube channel uses Google OAuth, and each permission BlastCP asks for has one job:

• youtube.upload — to upload the videos you or your agent schedule to your channel, with the privacy, tags and category you choose, and set their thumbnails.
• youtube.readonly — to identify which channel you connected (its ID, name and picture) and to read the public statistics of your own videos, such as views, likes and comment counts.
• yt-analytics.readonly — to read analytics for your own channel's videos, such as thumbnail impressions and click-through rate, which BlastCP shows to the members of your workspace.
• youtube.force-ssl — to add a published video to the playlist you chose for it, upload the caption file you attached, and post the first comment you wrote for it; and, if you use comment management, to read the comments on your own videos and post, edit, delete or moderate replies for you. Nothing is posted to your comments except a post's own first comment, which goes out with the post you approved, or a reply you approve — even when your agent drafts it.

We store the refresh token Google issues and use it only for those purposes, and only on the channel you connected. We never read your viewing history, subscriptions or other people's channels, and never upload or comment anything you didn't approve. The analytics and comments we read are shown only to your workspace and to the AI agents that act for you (section 4). They are never sold or used to train AI models, and are shared with no one else except our AI provider, Puku AI, which receives a comment's text to draft a suggested reply for you to review and, when you use BlastCP's assistant in Slack, what the assistant reads to answer you. They are deleted when you disconnect the channel. A video you attach to a post is stored with our storage provider until it is sent to YouTube at its scheduled time. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke BlastCP's access at any time by disconnecting in BlastCP — which revokes the grant at Google and deletes the stored token — or from your Google Account's security settings. BlastCP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok. Connecting TikTok uses TikTok Login Kit, and each permission has one job:

• user.info.basic — to show which account you connected: its display name and picture, and TikTok's identifier for it.
• video.upload — to send the videos you or your agent schedule to that account's TikTok drafts. This is how BlastCP posts to TikTok by default: each video lands in your TikTok inbox as a draft, without a caption, and you finish and post it in the TikTok app.
• video.list — to list your public videos (their IDs, captions, lengths and dates) and read their view, like, comment and share counts, so BlastCP can tell which video a draft became and show its numbers to your workspace. Drafts and private videos have nothing to read.
• video.publish — only where BlastCP offers Direct Post: to post a video straight to your profile with its caption and the privacy and interaction settings you chose. Only a person can do this, by confirming exactly that caption and video on the post's TikTok panel in BlastCP. An agent can draft a TikTok post but can't confirm one, and any later edit voids the confirmation. Before each Direct Post, BlastCP asks TikTok which privacy options and settings your account allows, as TikTok requires.

We store the tokens TikTok issues and use them only for those purposes — we never read your followers, messages or other people's videos. When you post a draft, TikTok tells us that it happened and the post's ID, so BlastCP can link to it. The counts we read are shown only to your workspace and are deleted when you disconnect. A video you attach is stored with our storage provider until it is sent to TikTok at its scheduled time. You can revoke BlastCP's access at any time by disconnecting in BlastCP — which revokes it at TikTok and deletes the stored tokens — or by removing BlastCP from the connected apps in your TikTok settings; BlastCP then stops sending anything. TikTok's handling of your data is described in the TikTok Privacy Policy.

Gmail. Connecting Gmail uses Google OAuth with the permission gmail.send, plus Google sign-in's email permission, which tells BlastCP which address you connected. BlastCP uses them only to send the emails you approve — or that your agent sends after you confirm them — from your address to the recipients on that post. That permission can't read, search or delete your email, and BlastCP never does. We store the refresh token Google issues and use it only for that. An email's subject, text and recipients are part of the post you wrote and are stored like any other post. You can revoke BlastCP's access at any time by disconnecting in BlastCP — which revokes the grant at Google and deletes the stored token — or from your Google Account's security settings. BlastCP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Resend. Connecting Resend means pasting an API key from your own Resend account, with full access. We store it on our server and send it only to api.resend.com, and we use it only to read your segments and verified domains; to create draft broadcasts to the segment a post is for — BlastCP never sends a broadcast, you send it from Resend; and, when a post is addressed to specific people, to send each of them their own copy of the email you approved. When you or your agent pick people from a segment, BlastCP reads that segment's names and addresses from Resend to show them, and doesn't keep them; your list stays in your Resend account. The key is full access to that account, so treat it like a password. Disconnecting deletes the stored key; deleting the key in Resend ends its access everywhere.

Slack. Connecting Slack installs the BlastCP app in your Slack workspace, on Slack's own consent screen, where you also pick a channel. Each permission has one job:

• chat:write, chat:write.public, channels:join — to post your scheduled posts, and the notifications you turn on for a property (a post published or failed, an approval needed, a lost connection), to the channel you picked, and to answer you.
• incoming-webhook — only so Slack's consent screen lets you pick that channel. BlastCP doesn't keep or use the webhook it creates.
• app_mentions:read, im:history, im:read, im:write — so you can @mention the BlastCP bot or send it a direct message, and it answers. It reads only the messages that mention it or are sent to it directly, never your other channels or conversations.

Before the bot does anything for you, you link your Slack account to your BlastCP account with a one-time link you open while signed in to BlastCP; we never match accounts by email address. Once linked, the bot acts as you, with your access and nothing more: it uses the same tools as an AI agent connected over MCP (section 4), and it runs on our AI provider, Puku AI. We store the workspace's bot token, which Slack account is linked to which BlastCP account, and the plain text of your last 20 messages with the bot in each conversation, so it can follow the thread. Once linked, BlastCP can also send you direct messages, such as a reminder to post a manual post at its time or an update on feedback you sent. Removing the BlastCP app from your Slack workspace ends its access there. Slack's handling of your data is described in the Slack Privacy Policy.

Any edit you or your agent makes to a scheduled post is applied before it publishes; nothing is sent to a connected account until the scheduled time, or until you or your agent publish it now.

4. AI agents, MCP and Slack

BlastCP is built to be used by an AI agent on your behalf, over a protocol called MCP. Connecting an AI client issues it an OAuth 2.1 access token scoped to your account. We store only a one-way hash of that token, never the token itself, and you can revoke it at any time from your workspace settings. While connected, the agent acts as you: it can draft and schedule posts, and — if your workspace allows agents to publish without a person's approval — publish them, exactly as if you had done it yourself.

Whatever the agent reads through BlastCP — your posts, your writing library, statistics, comments — goes to that AI client, and its provider handles it under its own privacy policy. You can also reach the same tools from Slack: once you link your Slack account, BlastCP's assistant there acts as you in the same way, and runs on our AI provider, Puku AI (section 3, Slack).

5. AI training

We do not use anything you create or connect in BlastCP — post text, links, or content from a connected account — to train AI models, ours or anyone else's.

6. Third-party services

We rely on the following processors to operate BlastCP:

• Supabase — authentication, database, and workspace storage, hosted in Singapore.
• Vercel — application hosting and the scheduled jobs that publish your posts, hosted in Singapore.
• Google — OAuth sign-in ("Sign in with Google"), YouTube API Services when you connect a YouTube channel, and the Gmail API when you connect Gmail (section 3); Google Analytics (section 7); and the Gemini API, which receives a post's text and your voice when you choose a Gemini model for the voice check, and your prompt when you generate an image with a Google model.
• Puku AI — the AI model gateway behind the copilot, the voice check (by default), suggested comment replies and the Slack assistant. It receives what each needs: the post you're working on and your property's voice; a comment, the start of the post it is on, and your voice; your messages to the Slack assistant and what it reads through BlastCP to answer you.
• Cloudflare — storage for the images and videos you attach to posts; and Workers AI, which receives your prompt when you generate an image with one of its models.
• OpenAI, Replicate and Alibaba Cloud — image-generation models. Each receives only your prompt and the image settings, and only when you generate an image with one of its models.
• Meta — Facebook Pages, Instagram and Threads, publishing channels you connect (section 3).
• LinkedIn, Substack and TikTok — publishing channels you connect (section 3).
• Resend — sends BlastCP's own emails, such as workspace invitations; and, when you connect your own Resend account, a publishing channel (section 3).
• Slack — a channel and an assistant you connect (section 3); and our own team's Slack, which receives notices such as a new sign-up or a failed publish, with the account's email and workspace, but never the text of a post.
• PostHog — product analytics and session recordings (section 7).

Each of these providers processes data under its own privacy policy and only to the extent necessary to provide their service to us.

7. Cookies and analytics

We use a session cookie to keep you signed in, managed by Supabase Auth, and short-lived cookies that protect sign-in and channel connections from forgery. On blastcp.com itself — not on preview builds or in development — we also run two analytics tools:

• Google Analytics sets its own cookies and records the pages you visit, how you arrived, and your device and approximate location. We don't send it your name or email address.
• PostHog keeps an identifier in a cookie and in your browser's local storage, and records the pages you visit, what you click, your device, and your IP address. Once you sign in to the app, it is linked to your email address and name. PostHog also records sessions: a replay of how the pages looked and changed while you used them, which can include what was on screen, such as your posts. Text typed into form fields is masked. Recordings are kept for 30 days.

Our servers also send PostHog events about what happens in BlastCP — a channel connected, a post published or failed, which tool an agent called — linked to your email address. Those events never contain the words of your posts, the links you schedule, or error messages. We use all of this only to understand how BlastCP is used and to fix problems. We don't run advertising cookies.

8. Data retention

We retain account and content data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us (below); we will delete it within a reasonable period, except where retention is required by law.

Deleting your data explains exactly what a connected publishing account stores, the difference between disconnecting one and deleting it, how to request either, and what happens to your posts when you do.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent to processing. To exercise any of these rights, contact us at the email below, or follow Deleting your data.

10. Security

We use industry-standard measures — encrypted transport (HTTPS), encryption at rest for connected-account credentials, access-controlled databases, and secure session cookies — to protect your data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children

BlastCP is not directed at children under 13, and we do not knowingly collect personal information from them.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

13. Contact

Questions about this policy or your data? Email support@blastcp.com.