Legal

Privacy policy

Last updated 26 July 2026

This policy covers Vuala, a service for scheduling and publishing posts to social platforms. It sets out exactly what we store, where we store it, who it is sent to and how long we keep it — in the same plain terms we would want to read.

Questions, or a request to export or delete your data: privacy@vuala.bio. We answer within 30 days.

What is stored

The database holds only what publishing requires:

Your account: email address, a bcrypt hash of your password, an optional display name, and your timezone.
Connected platform accounts: the account identifier the platform gives us (Pinterest user id, TikTok open_id, Reddit user id), your handle, display name and avatar URL, the granted scopes, and encrypted access and refresh tokens.
Cached platform settings: your Pinterest board names and ids, your TikTok creator settings, and your Reddit subscribed/moderated subreddit list.
Your content: uploaded images and videos, captions, titles, links, scheduled times, and per-destination publish results including the error text a platform returned on failure.

There is no analytics tracking, no advertising identifier, no session recording and no third-party script on any page of this application.

How platform tokens are protected

Access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held in our server environment and never stored alongside the data. Tokens are decrypted in memory only for the duration of an API call.

Tokens are never sent to any destination other than the platform that issued them, and are never included in logs, error messages or the JSON returned by this application's own API.

Who your data is shared with

Only the platform you are publishing to. When you schedule a post, the media, caption and options you selected are transmitted to that platform so it can be published:

Pinterest — api.pinterest.com (or their sandbox host), plus the Amazon S3 endpoint Pinterest itself supplies for video uploads. Subject to the Pinterest privacy policy.
TikTok — open.tiktokapis.com and the upload URL it returns. Subject to the TikTok privacy policy.
Reddit — oauth.reddit.com. Subject to the Reddit privacy policy.

Nothing is sold, and nothing is shared with anyone else. There is no intermediary posting service between this application and the platforms.

Where it is stored

In our database and file storage. Uploaded media is served only to your authenticated session, with one exception: TikTok photo carousels require publicly reachable file URLs, because TikTok fetches those files without credentials.

How long it is kept

Posts, media and publish history remain until you delete them or your account is deleted.
Disconnecting a platform account deletes its stored tokens immediately, and for TikTok and Reddit also asks the platform to revoke the token.
Short-lived OAuth state records expire after 10 minutes and are deleted on use.
Deleting your account cascades to every connected account, post and uploaded file.

Your choices

Disconnect a connected account at any time from the account panel in the app. Scheduled posts to it will then fail rather than publish.
Revoke from the platform side in your Pinterest, TikTok or Reddit app settings. The next refresh fails and the account is flagged for reconnection.
Request deletion or a copy of your data by writing to the address at the top of this page.

Cookies

One cookie, sched_session. It holds a signed session token, is httpOnly and sameSite=lax, and expires after 30 days. It exists to keep you signed in. There are no analytics or advertising cookies.

Changes

Material changes will be reflected in the date at the top of this page. If you disagree with a change, disconnect your accounts and close your account.