Plinth Privacy Policy
Plinth stores the content you upload, the accounts you connect and the instructions you give it so you can prepare and manage posts. Connected platforms receive content when you authorize publishing through an enabled integration. We do not sell your personal information or use your private content to train AI models.
Information you provide
- Your account and workspace. Email address, a securely hashed password, workspace name, timezone, membership roles and team invitations. If you contact support, we receive your message and the details you choose to include.
- Your content. Uploaded images and videos, filenames, file types and sizes, media dimensions and duration, titles, captions, descriptions, hashtags, links and edits for each platform.
- Your publishing instructions. Selected accounts, groups, tags, schedules, campaign settings, previews and approvals.
- Integration credentials. Authorization tokens from connected platforms and any provider credentials you explicitly supply. These secrets are encrypted in server storage. Workspace API keys are stored as hashes, with their names, permissions and usage timestamps.
Information from connected platforms
Connecting an account takes you to that platform's authorization screen. The permissions shown there determine what Plinth can access. You do not give Plinth your social account password through these connections.
- TikTok. The current Login Kit integration requests basic profile access and retrieves your account identifier and display name. It stores access and refresh tokens and their expiry information to identify the connected account. This connection does not currently enable TikTok publishing or analytics, and does not request access to your private messages, contacts or video library.
- Instagram and Facebook. Depending on the connection you choose and permissions you approve, we receive account or Page identifiers, names and authorization tokens. Enabled publishing integrations send the media and post details you authorize. Insights are requested only for a connection with the relevant permission and analytics enabled.
- YouTube. If you enable the Google connection, we receive authorized channel identifiers, names and tokens. An enabled publishing integration uploads the video and metadata you authorize. Plinth's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use this data for advertising or training general AI models.
Integration availability depends on configuration, platform approval and your permissions. A listed platform is not a promise that every feature is available. The platform's own privacy policy also applies to information it receives.
Google and YouTube data
Plinth requests the YouTube channel-read permission
(youtube.readonly) and video-upload permission
(youtube.upload) through Google's authorization screen.
You choose the Google account and approve these permissions before Plinth
can access its YouTube channel. Plinth does not receive your Google password,
Gmail messages, Google Drive files or contacts through this connection.
- Data accessed and stored. Plinth retrieves the authorized channel's identifier and title. It stores these with encrypted access and refresh tokens and token expiry information in your workspace. After an upload, it stores the returned video identifier, link and publishing status. Where supported analytics are enabled, it retrieves aggregate view, like and comment counts for the videos published through Plinth.
- How the data is used. Channel details identify the destination shown in Connections and the post composer. Tokens authorize customer-approved uploads and supported metrics refreshes. Plinth sends your selected video, title, description and hashtags to YouTube only when you approve publishing through an enabled integration. The current upload adapter creates private videos.
- Storage, access and sharing. Google-derived channel, token, video and metrics records are stored with your Plinth workspace. Workspace permissions restrict access, and tokens are encrypted in server storage. Hosting, database, storage and key-management providers process the information needed to operate these features. Your selected video and metadata are transferred to YouTube for the upload you authorize. We do not sell Google user data, share it with data brokers, use it for targeted advertising, or use it to train general AI models.
- Retention and deletion. These records remain stored while needed to operate your workspace, subject to the retention rules below. Revoking Plinth in your Google account stops its authorization but does not erase existing Plinth records or videos on YouTube. Request deletion of stored Google connection tokens, channel details, metrics or workspace records at support@humuli.com; we verify your identity and workspace authority before acting. Videos already uploaded to YouTube are managed through YouTube.
Plinth's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Publishing records and technical information
Plinth stores publishing status, attempts, errors, resulting post identifiers and links. Where you authorize supported analytics, it stores metrics such as views, likes, comments and shares. Workspace audit records include who performed an action, the object affected and the time.
Our hosting services process technical information such as IP addresses, request times, browser information and errors to deliver and protect the service. Optional managed-device features can also record task parameters, results and screenshots when enabled for a workspace and configured with a device provider.
How we use information
We use this information to authenticate you, control workspace access, store and validate media, prepare drafts, carry out authorized publishing instructions, report results, provide support and investigate errors or abuse. Draft formatting suggestions in the current Plinth service are generated by its own software; that feature does not send your drafts to an external AI service.
We do not sell or rent personal information, share it with data brokers, or use connected-platform data for targeted advertising. Private drafts, uploaded media and connected-account data are not used to train general AI models.
Who can receive information
- Your workspace. Members can see information permitted by their roles. Workspace administrators manage access and connections. Only invite people you trust with that workspace's content.
- Connected platforms. They receive the content, account identifiers and instructions needed for actions you authorize. Published content is visible according to the platform and audience settings.
- Infrastructure providers. Providers supporting hosting, databases, media storage, key management and account email process data needed to operate Plinth. The service supports Microsoft Azure media storage, AWS key management and Postmark account email when configured. Development installations may store media locally.
- Tools you choose. If you connect an API client, MCP tool or device provider, it can receive information allowed by its credentials and the actions you request. Its own privacy terms apply.
- Legal and security needs. We may disclose information where required by law, to protect people's rights or safety, or in a business transfer subject to appropriate privacy obligations.
Browser storage and cookies
The Plinth console stores a session token and the selected workspace in your browser's local storage. Sign-out removes those values. Account connection flows use temporary cookies to bind the authorization response to the browser that started it. These are needed for authentication and security; they are not advertising cookies.
The Humuli pages describing Plinth, including this policy and the terms, do not load third-party analytics, advertising scripts or remote fonts.
Retention, revocation and deletion
Drafts, uploaded media, account connections and publishing history remain stored while needed to provide the workspace, until removed through a supported process or a verified support request. Signing out or revoking a platform connection does not by itself erase this stored information.
You can revoke Plinth's access in the connected platform's app or account permissions. For deletion of stored connection tokens, media, workspace content or your Plinth account, contact support@humuli.com. The current console does not provide a complete account-and-workspace deletion button. We verify your identity and workspace authority before acting on a request.
We may retain limited records where needed for security, legal obligations or resolving disputes. Residual backup copies may remain until those backups expire. Content already published on a social platform must be managed there; deleting Plinth data does not delete that platform's posts.
Security and processing locations
Plinth restricts access by workspace and role, hashes passwords and API keys, and encrypts stored social tokens and provider secrets. You remain responsible for keeping your login and issued API keys private. No service can guarantee absolute security.
Information may be processed in countries where Humuli or its providers operate, which may differ from your country. Where applicable law requires safeguards for international transfers, those requirements apply.
Your choices and rights
Depending on where you live, you may have rights to access, correct, receive a copy of or delete your information, restrict or object to processing, or withdraw consent. Send requests to support@humuli.com. We respond in accordance with applicable law. You may also contact your local data protection authority where that right applies.
Children
Plinth is intended for adults managing content and is not directed at children under 13. We do not knowingly collect children's personal information. Contact us if you believe a child has provided information.
Changes and contact
We update the date above when this policy changes and provide appropriate notice of material changes. New uses requiring consent will be disclosed before that information is used for the new purpose.
Humuli LLC — support@humuli.com