Privacy Policy

We collect the following categories of information:

• Account data. Your name, email address, password (stored only as a salted hash — we never store or see your plain password), and an optional profile image.
• Workspace data. Workspace names and slugs, membership records and roles, and invitations (the invited email address, assigned role, and invitation status).
• Content data. Post text, media links you attach, scheduled times, post status, authorship, and the channels a post is targeted at.
• Connected channel data. When you connect a social account, we store the provider, account handle, avatar URL, external account ID, OAuth access token and expiry, and whether the connection is live or simulated. For Threads, this data comes from Meta’s Threads API.
• Technical data. Session identifiers and expiry, IP address and browser user agent recorded with sessions, short-lived OAuth state cookies, standard server logs, and aggregated, non-identifying performance metrics.

We do not collect payment card details. Paid plans are not currently sold through the Service. If paid plans are introduced, payments will be processed by a payment provider and we will store only the identifiers and status needed to manage your subscription.

• Create and secure your account, sessions, and workspaces.
• Store, schedule, and deliver the posts you create to the channels you select.
• Enforce plan limits (channels, members, scheduled posts, and media per post) and prevent abuse.
• Provide support and respond to your requests.
• Maintain reliability, diagnose errors, and protect the Service against fraud, spam, and unauthorized access.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal data, and we do not use your content for advertising.

Where data protection law requires a legal basis, we rely on: performance of a contract (providing the Service you requested); legitimate interests (securing and improving the Service); consent (connecting a third-party account such as Threads, which you can withdraw at any time by disconnecting it); and legal obligations (records we must keep).

Micassa uses only cookies that are necessary to operate the Service: a session cookie that keeps you signed in and a short-lived cookie that protects the Threads OAuth flow. We do not use advertising cookies or cross-site tracking cookies.

We share data only with service providers that help us run the Service, under contracts that limit their use of it:

• Supabase — managed PostgreSQL database, hosted in the European Union (Ireland).
• Vercel — application hosting, serverless functions, and aggregated performance metrics.
• Meta Platforms (Threads) — only if you choose to connect a Threads account, so that posts can be published and profile data retrieved.
• Professional advisers, auditors, or authorities where required by law, or to protect rights and safety.

If you connect a social account, your use of that platform is also governed by its own privacy policy. For Threads and Meta, see the Meta Privacy Policy.

Some providers process data outside the EEA or UK, including in the United States. Where required, transfers are covered by Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

• Account, workspace, content, and channel data are kept while your account is active.
• Access tokens are kept until you disconnect the channel or delete your account. Expired or revoked tokens are removed when we detect them.
• When you request deletion, we delete the associated data within 30 days, except where we must retain specific records for legal, security, or accounting reasons.
• Server logs and backups are retained for a short period (normally no more than 30 days) and then overwritten.

We use TLS in transit, hashed passwords, scoped database access, and restricted access to production secrets. No system is completely secure; if you believe your account has been compromised, contact us immediately at privacy@micassa.online.

Depending on where you live, you may have the right to access, correct, export, restrict, or object to the processing of your data, and to request its deletion. You may also withdraw consent for a connected channel by disconnecting it. To exercise a right, email privacy@micassa.online. We may need to verify your identity and will respond within the time required by law (normally 30 days). You can also lodge a complaint with your local data protection authority.

For step-by-step deletion instructions, see our Data Deletion page.

The Service is not intended for children under 16. We do not knowingly collect personal data from children. If we learn that a child has created an account, we will delete it.

We may update this policy as the Service changes. We will revise the “Last updated” date above and, if changes are material, provide notice in the app or by email before they take effect.

Privacy questions and requests: privacy@micassa.online. General support: support@micassa.online.