Privacy policy

Last updated 4 November 2026

AllSocials lets you connect your social accounts and send what you post on one to the others. This page says what data that takes and how to get rid of it.

Who we are

AllSocials is run by Bedroom Traders Ltd, trading as Boring Mods, company no. 14369814, registered in England & Wales, of 20-22 Wenlock Road, London N1 7GU. We are the controller of your personal data under UK GDPR and the Data Protection Act 2018.

What we keep

• Your account: your email address and a hash of your password, never the password itself. If you sign in with Google or Apple, we get your email address from them (with Apple it can be a Hide My Email address) and an ID that only means something to this app, and no password is kept.
• Sessions: a sign-in cookie on the web, or a sign-in token on the phone app, lasting up to 30 days. We keep only a hash of it.
• Logins for the apps you connect: the tokens each app gives us and the account name and ID that go with them. They're encrypted before they're stored, in a private folder outside the public website.
• What you post: the files you upload, and the files we fetch back from Instagram or Threads to send on, plus captions, your routes, which accounts you chose, and the post ID and result each app gives back. Location (GPS) data is removed from uploaded photos and videos as they arrive. A finished post and its file are deleted 14 days after it goes out, one that never finished after 60 days. An upload you never posted is deleted after 3 days.
• Your plan, once billing is open: how many accounts were connected each month, and the customer and subscription IDs our payment provider gives us. Your card details go to Stripe, never to us.
• Limits: your IP address is used to slow down repeated sign-in and sign-up attempts. It's stored only as a hash, for about a day.
• Web server logs: our web host keeps standard logs, such as IP address and pages requested, for as long as its settings say.

Everyone's data is kept in their own folder. No other user can see yours.

How we use it

Only to run AllSocials: to sign you in, to send your posts to the accounts you chose, and to show you what happened. We don't sell data, we don't show adverts, we don't use tracking cookies, and we don't use your connected-app data for advertising or to train AI. Our legal reasons are providing the service you asked for (contract), your consent when you connect an app (which you can withdraw at any time), and our legitimate interest in keeping the service secure.

Connected apps

When you press Connect you sign in on that app's own page. We never see your password for that app. We read your account's ID and name, to show which account is connected, and before each new post we check the login is still the same account.

• Instagram: you sign in on Instagram's own page (Instagram Login, for Business and Creator accounts). We ask for instagram_business_basic to read your account's ID, username and your latest posts, and instagram_business_content_publish to post. Accounts connected earlier through Facebook's sign-in page (Meta's business login) use the same two permissions under their older names, instagram_basic and instagram_content_publish, for the same things. With Follow what I post on, we read your latest items about every 5 minutes and fetch new ones to send on. It only sees what's posted after you turned it on.
• Facebook: pages_show_list to let you pick a Page, pages_read_engagement and pages_manage_posts to post to that Page.
• Threads: threads_basic to read your account's ID, username and, with Follow what I post on, your latest posts (the same way as Instagram), and threads_content_publish to post. A Threads login lasts 60 days and we renew it about once a week while connected. Instagram logins made with Instagram Login work the same way.
• TikTok: user.info.basic to show your display name, and video.upload to send a draft to your TikTok inbox. You add the caption and post it in TikTok. We read a draft's status to know it arrived.
• YouTube: youtube.upload to upload a Short, and youtube.readonly only to read your channel's name. We don't read your videos, comments or stats. AllSocials uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of data is covered by the Google Privacy Policy. AllSocials's use of information from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Instagram, Facebook, Threads and TikTok fetch your file from our website using a private link that lasts a day.

Who else handles data

• Our web host (Hostinger) runs the website and stores the private folders.
• Stripe takes payments, once billing is open. It gets your email, your card details (entered on Stripe's own page) and how many accounts your plan covers. Its privacy policy applies.
• The apps you connect get what you send them, and their own policies apply.

We may share data if the law requires it, or with a buyer if the business is ever sold, and we'd tell you first. Some of these companies work from outside the UK, including the US, and we rely on the transfer safeguards in their terms.

How to delete your data

• One app: press Disconnect on its card. We tell the app to end the permission where it lets us (Facebook, TikTok and YouTube) and our copy of the login goes straight away. For Instagram and Threads, also remove AllSocials in that app's settings. You can remove it from your Google account at security.google.com/settings/security/permissions.
• Everything: in the app, open You, then Delete account. Your logins, files, history and account go straight away, and your plan ends. Payment records Stripe must keep by law stay with Stripe. Copies in our host's backups go as those backups expire.
• Can't sign in? Use our contact form, say "delete my AllSocials data" and give the email on the account. We'll confirm within one month.

Posts already out on other apps stay there. Delete them in those apps.

Your rights

Under UK GDPR you can ask to see your data, correct it, delete it, limit or object to how we use it, and get a copy to take elsewhere. Use our contact form. You can also complain to the UK regulator, the Information Commissioner's Office.

AllSocials is for people aged 18 or over, and we don't knowingly collect children's data.

Security

The site uses HTTPS. Passwords are stored as hashes and app logins are encrypted, with the key kept apart from them. No system is perfectly secure. If a breach puts you at risk, we'll tell you and the regulator as the law requires.

Changes

When this policy changes we update the date at the top. If we start using data in a new way, we'll tell you first.

Contact

Use our contact form, or write to Bedroom Traders Ltd, 20-22 Wenlock Road, London N1 7GU.