Skip to content
Mynahcast
Start free trial

Privacy policy

Effective date: 17 October 2026. Last updated: 17 October 2026.

This policy explains what personal data Mynahcast collects, why, where it is stored, who processes it, how long we keep it, and the rights you have. It applies to the website at https://mynahcast.xyz, the app at https://mynahcast.xyz/app and the API at https://api.mynahcast.xyz (together, "Mynahcast").

1. Who runs Mynahcast

Mynahcast is a social media scheduling and publishing service, currently in private beta. It is operated from Spain (European Union) by the Mynahcast team, which is the data controller for the personal data described in this policy.

Contact: support@mynahcast.xyz. Use this address for any privacy question, to exercise your rights, or to ask us to delete your data.

2. What data we collect

a) Account data. When you create an account: your email address, your name, and, if you sign up with a password, a salted hash of that password (we never store the password itself). We also record when the account was created and when you last signed in.

b) Data from Google Sign-In. If you choose "Sign in with Google", we request only the openid, email and profile scopes. From Google we receive your Google account identifier, your email address (and whether Google has verified it), your name and your profile photo URL. We use this data only to create your Mynahcast account, sign you in and show your name and photo inside the app. We do not request access to Gmail, Google Drive, Google Calendar, Contacts, YouTube or any other Google service, and we cannot read any of that data.

c) Connected social channels. When you connect a channel (for example Bluesky, Mastodon, Telegram, Discord or others), we store the credentials needed to post on your behalf: access and refresh tokens, app passwords, bot tokens or webhook URLs, plus the account handle, display name and channel identifiers the platform returns. These credentials are encrypted before they are stored (see section 6).

d) Your content. Brands, brand voice profiles, posts and drafts, scheduled times, approvals and comments, media files you upload (images and videos), and the delivery history of each post (when it was sent, the platform's post ID and link, and whether it was verified as live).

e) API keys. For keys you create for AI agents or scripts, we store only a one-way hash and a short prefix, the key's name, its permissions, and when it was last used. The full key is shown to you once and never stored.

f) Usage and log data. Our servers and hosting providers record technical data when you use Mynahcast: IP address, browser user agent, the page or API endpoint requested, timestamps, response status, and an audit log of actions in your workspace (for example "post approved" or "channel connected"). We use this for security, abuse prevention, rate limiting, debugging and to show you your own activity history.

g) Cookies and similar technologies. We use only cookies that are strictly necessary: a session cookie that keeps you signed in to the app, and security cookies set by Cloudflare (including Cloudflare Turnstile, which helps us block automated sign-up abuse). We do not use advertising cookies, cross-site tracking or third-party analytics cookies. Because these cookies are strictly necessary, they do not require consent under EU rules; you can block them in your browser, but signing in will then not work.

h) Waitlist. If you join the waitlist on our website, we store your email address, the page you signed up from and the time.

i) Payments. Paid plans and their free trials are billed through Stripe, which collects your card details directly. We receive only limited billing information (such as your plan, subscription status, billing country, invoices and the last four digits of your card), never your full card number.

3. How we use your data

We use personal data only to:

  • create and secure your account and sign you in (including with Google Sign-In);
  • provide the service: store your brands, drafts and media, run approvals, schedule posts and publish them to the channels you connected, and read posts back to verify they are live;
  • send you service emails: email verification, password reset and sign-in links, invitations, and important notices about your account or the service;
  • protect Mynahcast and its users: prevent abuse, spam and fraud, enforce rate limits, and investigate security incidents;
  • fix problems and keep the service working;
  • comply with legal obligations.

We do not send marketing emails without your consent. We do not make automated decisions that have legal or similarly significant effects on you.

4. Google user data: Limited Use

Mynahcast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data we receive through Google Sign-In (your name, email address and profile photo):

  • is used only to provide and improve user-facing features of Mynahcast (signing you in and identifying your account);
  • is not sold, and is not transferred to anyone except as necessary to provide the service, to comply with law, or as part of a merger or acquisition with notice to you;
  • is not used to serve advertising, including retargeting or personalised or interest-based ads;
  • is not used to train, develop or improve generalised artificial intelligence or machine learning models;
  • is not read by humans, unless you give us permission, it is needed for security purposes (such as investigating abuse), or it is required by law.

5. We don't sell your data

We do not sell, rent or trade your personal data, and we do not share it with data brokers or advertisers. We do not use your content, your channel data or your Google data for advertising, and we do not use it to train AI models.

6. Where your data is stored and how it is protected

  • Database: account data, content and encrypted channel credentials are stored in a Supabase-hosted PostgreSQL database in the European Union.
  • Hosting and network: the website, app and API run on Cloudflare (Pages and Workers), which processes requests at its global edge network.
  • Encryption: all traffic uses HTTPS (TLS). Channel credentials and OAuth tokens are encrypted with AES-GCM envelope encryption before they are written to the database, with keys kept separately from the data. Passwords are stored as salted hashes and API keys as SHA-256 hashes. Database access is restricted, and row-level security is enabled on our tables.
  • Access: only the operator can access production systems, and only when needed to run, secure or support the service.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the competent authority as required by the GDPR.

7. Who processes your data (third parties)

We use these service providers ("processors") to run Mynahcast. Each receives only the data it needs and may use it only to provide its service to us:

  • Supabase (database and storage, EU region): your account, content, media and encrypted credentials.
  • Cloudflare (hosting, CDN, Workers, Turnstile bot protection): request data such as IP address and user agent, and the content passing through the service.
  • Resend (transactional email): your email address and the content of service emails we send you.
  • Stripe (payments, only if paid plans are introduced): billing details for paying customers.
  • Google (only if you use Google Sign-In): authenticates you and returns the profile data described in section 2b.

When you connect a social channel and publish, the content you choose to publish is sent to that platform (for example Bluesky, Mastodon, Telegram or Discord), which handles it under its own privacy policy. When you connect your own AI agent, that agent sends requests to Mynahcast with your API key and receives the data its key is allowed to read; the agent's provider handles that data under its own terms.

Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

We may also disclose data if required by law or a valid legal request, or to protect the rights, safety and security of our users and the service.

8. Legal bases (GDPR)

  • Performance of a contract (Art. 6(1)(b)): to provide your account and the service you signed up for, including Google Sign-In and publishing to your channels.
  • Legitimate interests (Art. 6(1)(f)): to secure the service, prevent abuse, keep logs and improve reliability.
  • Legal obligation (Art. 6(1)(c)): where we must keep or disclose data by law.
  • Consent (Art. 6(1)(a)): for any optional communication you opt into; you can withdraw consent at any time.

9. How long we keep data

  • Account data, content and channel credentials: for as long as your account exists. Disconnecting a channel deletes its stored credentials; revoking an API key disables it immediately.
  • After you delete your account or ask us to: we delete your personal data within 30 days, and it disappears from backups within a further 30 days, unless we must keep something to meet a legal obligation.
  • Waitlist emails: until you receive an invite or ask to be removed.
  • Server and security logs: for up to 90 days, unless needed longer to investigate a specific security incident.
  • Delivery and audit history is deleted together with the workspace it belongs to.

10. Deleting your data

To delete your account and all associated data, email support@mynahcast.xyz from the address on your account and ask for deletion. We will confirm when it is done (within 30 days). You can also disconnect channels and revoke API keys yourself in the app at any time. If you signed in with Google, you can additionally remove Mynahcast's access at https://myaccount.google.com/permissions.

11. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and get a copy;
  • rectify inaccurate data;
  • erase your data ("right to be forgotten");
  • restrict or object to certain processing, including processing based on legitimate interests;
  • data portability: receive your data in a structured, machine-readable format;
  • withdraw consent at any time, where we rely on consent.

Email support@mynahcast.xyz to exercise any of these rights. We will answer within one month. You also have the right to lodge a complaint with a supervisory authority, in Spain the Agencia Española de Protección de Datos (www.aepd.es), or the authority in the EU country where you live or work.

12. Children

Mynahcast is not intended for children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as Mynahcast changes. We will post the new version on this page with a new "last updated" date, and for material changes we will notify signed-up users by email before they take effect.

14. Contact

Mynahcast, Spain. Email: support@mynahcast.xyz.