Privacy Policy - Social Publishing & Analytics MCP Server

1. Introduction & Purpose

The Social Publishing & Analytics MCP Server ("we", "our", or "the Service") provides an open-standard Model Context Protocol (MCP) server enabling users and authorized AI assistant clients (such as Claude Desktop, Cursor, and ChatGPT) to publish multimedia posts, schedule queues, optimize post metadata, and analyze engagement metrics across Twitter/X, Instagram (Meta), and YouTube (Google).

We are firmly committed to user privacy. This policy details how our system collects, encrypts, processes, and protects your data.

2. Data We Collect & Process

We collect only the technical data strictly necessary to execute your requested social media actions:

OAuth Credentials: Platform User IDs (Twitter user ID, YouTube channel ID, Instagram business ID) and OAuth 2.0 / 2.1 access and refresh tokens granted during account authorization.
Post Content & Metadata: Text, captions, hashtags, video titles, descriptions, and media URLs provided for publishing or scheduling.
Brand Persona Guidelines: User-defined brand voice, tone parameters, visual aesthetic notes, and forbidden buzzwords.
Engagement Metrics: Post-level impressions, likes, retweets, views, comments, and follower growth retrieved via official platform APIs.
Security Telemetry: Anonymized request IPs and timestamps for rate limiting, DDoS defense, and security auditing.

🔒 What We Do NOT Collect

We never collect, access, or store personal account passwords, credit card or billing details, private Direct Messages (DMs), or unauthenticated browsing history.

3. Cryptographic Storage & Security Vault

We enforce industry-leading security practices across our entire infrastructure:

AES-256-GCM Token Encryption: All OAuth access and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption with unique per-token nonces. Plaintext tokens are never stored in databases.
HTTPS & TLS 1.3 In-Transit: All API communication, OAuth handshakes, and MCP streaming connections occur exclusively over TLS 1.2+ / TLS 1.3 encrypted channels.
Dual-Layer Secret Scrubbing: All logging, exception traces, and metrics streams pass through automated regex scrubbers to redact sensitive tokens ([REDACTED]).

4. Sub-Processors & Infrastructure

Service / Sub-Processor	Role / Purpose	Security Standards
Supabase (PostgreSQL)	Persistent database for scheduled posts, personas, and encrypted token vault	SOC2 Type II, ISO 27001, AES-256 Encrypted Storage
Upstash (Redis)	Ephemeral MCP session management, distributed queue locks, and rate limits	TLS Encrypted Cache, Ephemeral In-Memory Store
Google Gemini API	AI content generation, viral hooks, CTR metadata & SEO tag generation	Google Cloud Enterprise AI Privacy & Security Terms
Render	Hardened cloud container runtime hosting the HTTP / MCP server	TLS 1.3 Termination, Isolated Linux Containers

5. How Google Gemini AI Is Used

When you invoke AI tools (e.g. scout_trending_topics, update_post_metadata, or autonomous scheduling), content drafts and brand guidelines are processed via Google Gemini API (models/gemini-2.5-flash) to produce viral hooks, tailored captions, and SEO tags. Your private data is never used to train public foundation models.

6. Zero Data Selling & Non-Monetization Commitment

We strictly adhere to a zero-commercialization policy: We do NOT sell, rent, monetize, trade, or share your personal data, post content, or OAuth credentials with any third-party advertisers, data brokers, or marketing networks under any circumstances.

7. User Control & Immediate Revocation

You have full ownership of your accounts and can revoke access or delete stored data at any time:

Via the MCP Server: Use the disconnect_platform tool or send a DELETE request to /auth/{platform}/disconnect to delete your tokens immediately.
Via Upstream Platform Settings:

8. Contact Information

For any privacy inquiries, data deletion requests, or technical support, please contact:

Developer & Maintainer: Kuldeep Poonia
Direct Email: kuldeeppoonia20298@gmail.com
GitHub Repository: github.com/kuldeep-poonia/social-publish-mcp-server