Privacy
Last updated 9 September 2026
Repost is a tool for writing and scheduling social posts. This page says plainly what it stores, who else sees it, and how to get it back or delete it. It is written to be read, not to be survived.
Who controls your data
Repost is a product of Blackbridge Solutions LLC, and that company is the controller of everything described below — the one deciding what is collected and why, and the one answerable for it. Questions, requests or complaints go to hello@getrepost.app.
What Repost stores
| What | Why |
|---|---|
| Your email, name and a hashed password | To sign you in. Passwords are hashed with PBKDF2-SHA256 and never stored in a readable form — nobody at Repost can see yours. |
| Your brands: names, colours, logos, voice notes, hashtags, posting windows | To write posts that sound like you. |
| Your posts, drafts, ideas and uploaded media | To schedule and publish them, and to show you what worked. |
| Access tokens for accounts you connect | To publish on your behalf. Stored per workspace and used for nothing else. Disconnecting an account removes them. |
| Credit usage and billing records | To meter AI generations and run your subscription. |
What Repost does not do
- No advertising, and no advertising trackers.
- No analytics or tracking scripts of any kind — the site loads none.
- Your data is never sold, rented or shared for anyone else’s marketing.
- Your posts are not used to train anyone’s models by Repost.
Support access
One person runs Repost. To answer a question about your account, they can open it and see what you see — your brands, posts and queue. This is not automatic and it is not silent: every time it happens, a line is written into your own account history, which you can read. It is used to help you, never to browse.
Your passwords are not readable by anyone, including us — they are stored as hashes that cannot be reversed. Support access never requires your password, and nobody will ever ask you for it.
Who else processes your data
Repost runs on other companies’ infrastructure. These are the only ones that touch your data, and only for the job named:
| Service | What it handles |
|---|---|
| Vercel | Hosting, and storage of media you upload. |
| Neon | The database: your account, brands, posts and credit records. |
| Anthropic | The AI that writes. When you generate a post, the text and the brand context it needs are sent to Anthropic’s API to produce a result. |
| Stripe | Payments. Card details go straight to Stripe — Repost never receives or stores them. |
| Resend | Sending the few emails Repost sends: confirm your address, reset your password. |
| Networks you connect | X, LinkedIn, Bluesky, Meta (Instagram and Facebook), Discord and others receive the posts you tell Repost to publish. Nothing is sent to a network you have not connected. |
Each of these has its own privacy policy governing what it does with what it receives.
Competitor research
The Analyzer and Discover read public information: a website you name, posts you paste, and public search results from YouTube, Bluesky and Twitch. Repost does not access private accounts, and it does not scrape anything behind a login.
Google Drive and Dropbox
If you connect your own Google Drive or Dropbox, Repost uses it for one thing: fetching a file you picked so it can be posted. Repost reads — it never writes to, edits or deletes anything in your account, and it does not scan or index what is there.
Google access uses the drive.file scope, which is granted per file: Repost can see only the files you choose in Google’s own picker, and nothing else in your Drive. Dropbox access is read-only. A file you import is copied into Repost so the networks can be given the bytes, and that copy is deleted once the post has published everywhere — the same rule as a file uploaded from your computer, unless you ticked “keep these files”. Your original is never touched.
Disconnecting in Settings → Connections deletes the stored token immediately. You can also revoke Repost yourself at myaccount.google.com/permissions or in your Dropbox connected-apps settings.
Repost’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Nothing from your Drive is used to train any AI model, sold, or shared with anybody beyond the network you asked Repost to publish to.
How long it is kept
For as long as your account exists. Cancelling does not delete anything — your brands, posts and history stay where they are and stay readable. Publishing and the AI stop until you subscribe again.
Getting your data, or deleting it
Email hello@getrepost.app and ask for a copy of your data or for your account to be deleted. Deletion removes your account, brands, posts, media and connected-account tokens. Billing records are kept where tax law requires it.
If you are in the UK, EU or another region with equivalent law, you also have the right to correct your data, object to processing, and complain to your data protection authority.
Security
- Passwords are hashed, never stored in readable form.
- Sign-in cookies are signed, HTTP-only, and unreadable to scripts.
- Password-reset links are stored only as a hash, expire in an hour, and work once.
- Everything travels over HTTPS.
Changes
If what Repost collects changes, this page changes with it and the date at the top moves. Questions: hello@getrepost.app.