Clear connections.
Clear privacy.

99Posts is provided by STRICS IT GmbH, Florian-Gmainer-Strasse 4, 4240 Freistadt, Austria. This policy covers the 99Posts iPhone app, the 99Posts web app and website at 99posts.app, and their supporting cloud services.

For support or a privacy request, email hello@strics.at. STRICS IT GmbH is the controller for data handled to operate 99Posts. Apple, Google, Meta, TikTok, and other services can act as separate controllers for their own accounts and platforms under their policies.

You can sign in to own your 99Posts workspace with Apple, Google, or an optional email/password account. These owner accounts are independent; 99Posts does not link owner identities across sign-in methods. We process the name and email you provide or make available through sign-in, the authentication provider, a Firebase user identifier, and account state. Apple can provide a private relay address when you choose Hide My Email. Firebase Authentication handles email/password credentials, email verification, and password-reset requests when you use that sign-in option. The web app offers Apple, Google, and email/password sign-in.

We also process authentication and device-security identifiers, including Firebase Authentication identifiers and App Check assertions. On iPhone, App Check uses Apple App Attest. In the web app, App Check uses Google reCAPTCHA Enterprise, which evaluates browser and device signals and can set a security cookie so automated abuse can be told apart from real use. Workspace, Profile, post, and connection records are associated with your owner account through these identifiers.

Connecting a publishing destination is a separate action. A Profile can hold one connected account for each supported platform. For a connected YouTube, Instagram, or TikTok account, we process the account or channel identifier, username, profile image, granted scopes, connection status, and encrypted access or refresh credentials needed to perform the actions you request. Signing in with Google does not automatically connect a YouTube channel.

Saved drafts and optional working copies are stored locally in the app, scoped to the signed-in owner and Profile. A draft can include the selected video, cover, title, description, caption, hashtags, first comment, publishing time, and platform-specific options. Local drafts are not uploaded merely because they were saved.

In the web app, saved drafts with their video and cover files, and an upload that has not finished yet, are kept in your browser's storage (IndexedDB) for that browser profile until you delete the draft, the upload completes, or you clear the site's data. Drafts do not move between devices or browsers. When a video needs converting for a destination, the conversion runs in your browser before upload. So the web app opens quickly, your browser also keeps a copy of your Profiles, posts, platform states, and insights (IndexedDB), the account and plan state it loaded last, and a sign-in hint: your account identifier in local storage and a cookie that only says you are probably signed in. Signing out removes them from that browser.

When you schedule or publish, 99Posts uploads the selected video, selected or uploaded cover, target choices, post text, and relevant platform settings to its Firebase-backed service so the request can be delivered later. Depending on your choices, this can include chosen-place data described below, sponsored or commercial-content disclosures, AI-altered-content disclosures, YouTube audience and visibility settings, Instagram collaborator usernames or account tags, and TikTok privacy or disclosure controls.

Do not include personal data, private material, music, images, or other content unless you have the rights and authority to use and publish it.

You can manually choose a place for a post. Place information can include a name, a platform place identifier, and full-precision latitude and longitude from place-search results, including Apple MapKit. Chosen-place data is sent through Firebase for supported location features and can be sent to the publishing destinations you select. For example, YouTube can receive those coordinates as recording metadata. This data can identify a precise location and is associated with your account and post.

In the web app, place search uses Instagram's place search through 99Posts instead of Apple MapKit, and the same chosen-place details can be sent with the post.

Choosing a place is optional. 99Posts does not request device GPS or browser location permission or read your device's current GPS location. A manually selected place can still contain precise coordinates, even though the app does not access device GPS.

We process publication time, provider post identifiers, delivery state, warnings, errors, and normalized post metrics such as views, likes, comments, and shares when a provider returns them. These records support scheduling history, delivery status, and publication and engagement analytics in Insights. They are associated with your account and posts. Provider metrics can be delayed, incomplete, changed, or unavailable.

For reliability, security, abuse prevention, support, and aggregate service-quality analytics, our infrastructure can process IP address, endpoint, request time, app and operating-system version, user agent, response status, duration, warnings, and limited error details. Operational diagnostic records can be linked to your account or device. Firebase Authentication and Firestore also declare analytics purposes in their SDK privacy manifests.

These engagement and diagnostic analytics exist without the Firebase Analytics or Firebase Crashlytics SDKs, neither of which is included in the app. The app does not include AdSupport, use IDFA, or use the collected data for ad targeting or cross-app tracking.

The web app keeps your Firebase sign-in session and a few settings, such as the selected Profile and whether you have seen the welcome tour, in your browser's local storage. It does not use advertising cookies or third-party analytics.

If you turn on notifications on iPhone or in the browser, we store a push token with the platform, language, time zone, and app version so 99Posts can send post-status notices through Firebase Cloud Messaging. Signing out of the web app removes that browser's token, and unused tokens are removed after 90 days. You can also block notifications in your iPhone or browser settings.

Apple processes App Store payments. STRICS IT GmbH does not receive your complete payment-card details. StoreKit can provide product, transaction, original-purchase, renewal, expiration, refund, revocation, and subscription status so 99Posts can verify access and restore purchases.

A StoreKit account token and transaction identifiers link purchase and entitlement records to your owner account. We retain limited entitlement, transaction-link, restore-claim, and replay-protection records needed to prevent duplicate grants, resolve billing state, and support disputes or legal obligations.

On 99posts.app, Stripe processes payments for web plans. Stripe Checkout and the Stripe billing portal collect your payment details and, where needed, your name, email, and billing address; STRICS IT GmbH does not receive your complete payment-card details. To give you the same access as your billing state, we store a Stripe customer identifier, subscription and price identifiers, the plan, its status, the date it is paid through, whether it is set to end, and records of Stripe billing events. The Stripe customer is linked to 99Posts with a hashed account reference instead of your raw account identifier. Stripe also handles this data under its own privacy policy and legal obligations.

Relevant recipients and processors include Apple for App Store, StoreKit, Sign in with Apple, MapKit place search, and device services; Google Firebase and Google Cloud for authentication, App Check, database, storage, functions, and logs; Google and YouTube for Google sign-in and YouTube publishing; Meta, Facebook Login, and Instagram for Instagram account connection and publishing; TikTok for TikTok account connection and publishing; Stripe for web payments and billing management; Google reCAPTCHA Enterprise for App Check in the web app; and Vercel for hosting 99hq.dev and 99posts.app.

Data is sent to a publishing provider when you connect that provider or use its supported publishing features. Each provider also handles data under its own privacy policy and account settings. Processing locations and any applicable international-transfer safeguards depend on the provider and service used. Contact hello@strics.at for information about the arrangements applicable to your data.

We process account, content, connection, scheduling, publishing, insights, and subscription data to provide the functions you request and perform our contract under Article 6(1)(b) GDPR. We process proportionate security, diagnostics, fraud-prevention, revocation, replay-protection, and service-protection data for our legitimate interests under Article 6(1)(f). Records required for tax, accounting, consumer, or other legal duties are processed under Article 6(1)(c). Where a specific choice legally requires consent, you can withdraw it for the future without affecting earlier lawful processing.

Original uploaded video is scheduled for removal after all selected destinations have published, been cancelled, or reached a completed test state. A cancelled original is queued for immediate deletion. A failed original is scheduled for removal after seven days. Cleanup retries failed deletions. An unattached upload reservation expires within 24 hours or when the related subscription access expires, whichever comes first. A reduced JPEG cover can remain with schedule and history data until account deletion.

Webhook summaries are retained for seven days and Meta deletion receipts for 30 days. Narrow StoreKit, purchase-restore, replay-protection, and exhausted publication-failure records can remain for at least 90 days, or longer where reasonably required for subscription expiry, dispute handling, accounting, fraud prevention, or a legal duty. Stripe billing-event records are kept for about 90 days. Data the web app keeps in your browser stays there until you remove it or clear the site's data. Operational logs follow configured platform retention periods.

You can disconnect a publishing account in 99Posts and can also revoke access in the provider's account settings. Disconnecting stops future 99Posts requests for that connection but does not delete posts already published on the provider. A provider may retain its own records under its policy.

The in-app Delete Account action starts removal of the owner's Profiles, scheduled posts, uploaded media, provider connections, and insights from active 99Posts systems. Cleanup can be retried while a provider operation is still completing or after a deletion attempt fails. 99Posts attempts provider-token revocation; credentials needed for a failed revocation remain encrypted in a retry queue until that revocation is resolved. Narrow records may remain for the retention purposes described above. Deleting the 99Posts account also deletes its Stripe customer, which ends a web subscription immediately. Deleting the app or account does not cancel an Apple subscription; manage billing separately in Apple Account settings. In the web app, Delete 99Posts Account is in Settings.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection by contacting hello@strics.at. We may need to verify that a request belongs to the relevant account. You may complain to the Austrian Data Protection Authority at dsb.gv.at or the supervisory authority where you live or work.

We use encrypted transport, encrypted server-side provider credentials, Firebase access controls, App Check with Apple App Attest or reCAPTCHA Enterprise, Apple platform security, signed StoreKit verification, validation, and restricted secret access. No system is completely secure. 99Posts is not intended for anyone who cannot lawfully hold the relevant platform accounts or provide valid consent in their country.

We may update this policy when the product, providers, or law changes. The version and effective date on this page identify the current product-specific policy.