Privacy Policy

To provide our services, we collect the following information as necessary:

• Account information: your name, email address, and hashed password provided at sign-up or sign-in; when you use third-party login (e.g., Google), the basic profile that provider returns to us (such as name, email, and avatar).
• Social-platform authorization: when you connect a social account, the OAuth access and refresh tokens issued by each platform with your consent, along with public profile data such as your platform username and avatar. Tokens are used to publish on your behalf and are stored encrypted.
• Facebook Pages: Page profile, the content published on the Page and its engagement metrics, and users’ comments on the Page (used for display and replies).
• Threads: account profile (username, display name, and avatar), follower count, the posts you publish and their engagement metrics (views, likes, replies, reposts, quotes, and shares), and replies to your posts (used for display, replying, and hiding).
• Content data: the text, images, and videos you create, draft, schedule, or publish through the Platform, along with publishing records and analytics.
• Usage and device information: access logs, IP address, browser and device type, timestamps, language and theme preferences, and information generated by cookies and similar technologies.
• Payments: payments are processed by Stripe. We receive the plan, amount, currency, payment status, and a customer reference. We never receive or store full card numbers.
• Contact and feedback: information you voluntarily provide through support, appeals, or surveys.

We do not collect personal information unrelated to the service, nor do we require you to provide unnecessary information.

We use your information only to the extent necessary for the following purposes:

• To create and manage your account and to authenticate and sign you in;
• To publish, schedule, or withdraw content on the social platforms you have authorized, on your behalf;
• To provide core features such as content management, drafts, scheduling, and analytics;
• To operate billing, quotas, refunds, and payment disputes;
• To keep the service secure and to prevent, detect, and handle fraud, abuse, and violations;
• With your consent, to send you service notices, verification emails, or product updates;
• To improve the product and perform necessary statistical analysis (generally in de-identified form);
• To comply with our legal obligations.

If we need to use your information for a purpose not stated in this policy, we will seek your separate consent.

Location and retention: your information is stored on the cloud services we use (our database is Cloud SQL for PostgreSQL). Unless required by law or necessary to fulfill the purposes of this policy, we retain your information only for the duration of your use of the service and for a reasonable period thereafter; beyond that period we delete or anonymize it. Closing an account or deleting a workspace deletes that account’s or workspace’s content and authorization credentials. Records the law requires us to keep, such as payment and tax records, are kept after that. They contain order references, amounts, currencies, and payment status, and never a full card number.

Security measures: we apply industry-standard safeguards, including but not limited to encrypted storage of social-platform tokens, transport-layer encryption (HTTPS/TLS), least-privilege access controls, and keeping secrets only in environment variables isolated from source code.

Despite our reasonable measures, no method of transmission over the Internet is completely secure. Please keep your account and password safe.

We do not sell your personal information. We share it only in the following cases:

• With your authorization: when you choose to publish content to a social platform, that content is sent to the platform per your instruction and becomes subject to that platform’s privacy policy;
• Service providers: third parties necessary to operate the service process data only to provide services to us and under contractual confidentiality obligations. They include cloud computing and databases, email delivery, error monitoring, and Stripe (payment processing);
• AI model services: when you use AI features (such as copy suggestions, cover suggestions, or "Use uploaded media" in AI Assist), the related text and the images or video frames you select are sent to the cloud AI model service we use, solely to generate that result for you;
• Legal requirements: to comply with laws, regulations, or binding requests from judicial or administrative authorities;
• Corporate changes: in a merger, acquisition, or asset transfer, we will require the recipient to continue to honor this policy, or we will seek your consent again.

The Platform integrates via OAuth with third-party services including X, YouTube, TikTok, Instagram, Facebook (Pages), Threads, and Google login. Your authorization of these platforms and the handling of your content on them are also governed by each platform’s own terms and privacy policy. You may revoke authorization at any time in the Platform or in the corresponding platform’s settings.

For Threads, for example: you can remove the Platform under Settings → Account → Website permissions in Threads, and once Threads notifies us we disconnect that account and delete its connection data. You can also submit a data deletion request through Threads; we will then delete that account’s connection data, the content imported from Threads, and the publishing records, engagement data, and comments associated with that account, and provide a confirmation code you can use to check the request’s status.

We use cookies and local storage to maintain your login session, remember your language and theme preferences, and keep the service secure. You can manage or clear cookies through your browser settings, but disabling some cookies may affect functions such as login.

To the extent permitted by applicable law (such as the GDPR, the CCPA, and relevant laws in China), you have the following rights regarding your personal information:

• Access and rectification: to view and correct your account information;
• Deletion: to request deletion of your personal information or closure of your account where conditions are met, except for payment and tax records the law requires us to keep;
• Withdrawal of consent: to withdraw social-platform authorizations or marketing subscriptions at any time;
• Copy and portability: to obtain a copy of the information you provided;
• Restriction or objection: to restrict or object to certain processing where the law allows.

You can act directly in your account settings or contact us at support@loxily.com to exercise these rights. We will respond within a reasonable time.

The Platform is intended primarily for adult users. We do not knowingly collect personal information from minors below the legal age (typically 13/16 depending on local law). If you are a guardian and believe a minor has provided us information without consent, please contact us and we will delete it promptly.

We may update this policy from time to time. We will post the new version and its effective date on this page; for material changes we will notify you by prominent means. Your continued use of the Platform after the changes take effect constitutes acceptance of the revised policy.

“popkit Helper” is an optional Chrome / Edge browser extension that fills the manual-channel kit you prepared on the Platform (title, body, topics, images or video) into the publishing form of a third-party creator platform (currently Xiaohongshu Creator Platform, Douyin Creator Center and the WeChat Official Accounts Platform). Installing and using it is entirely your choice; the Platform works without it.

• What it does: only after you click “Fill in” on the Platform, it opens the creator platform page and fills that post’s material into the form (on the WeChat Official Accounts Platform a video first has to be uploaded to your account’s media library; agreeing to the platform’s upload rules and saving it is confirmed by you). Publishing is always performed by you on that platform; the extension never publishes on your behalf and never schedules or batches actions.
• What it reads: the one-time handoff token you pass from the Platform page (valid for that post only, at most two hours); on the creator platform page, the form elements needed for filling and backfilling, the signed-in account name (on Douyin also the Douyin ID, obtained from the Creator Center’s own account-info API; on the WeChat Official Accounts Platform the account name shown on the page; only to warn if it differs from the target account), the responses of the publish and note / post-list APIs, and the titles, links and publish times of published articles in the WeChat Official Accounts Platform’s publish history (all only to obtain the link of the post you just published).
• What it sends: only the published post’s URL and a “done” flag back to the Platform. It does not read or upload your credentials, cookies, or other page content from the creator platform, and it sends nothing to any server other than the Platform.
• What it stores: the current handoff state in your browser (cleared when the browser closes) and a flag that you have read the usage notice. It stores no creator-platform login state.
• Permissions: access to the Platform’s domains and the creator platform’s domain, solely for the filling and backfilling above; browser storage, solely for the local state above.

You can disable or remove the extension at any time from your browser’s extensions page; removal also deletes its locally stored data.

If you have any questions, comments, or complaints about this policy or our handling of personal information, please contact us:

• Operator: Loxily Network Limited
• Contact email: support@loxily.com