Privacy

The SDK package

Importing @opencoredev/social-sdk makes no network request and sends no telemetry. Every call to a platform or managed backend is one your application makes with its own credentials. When you run the package on your own server, we never see your tokens, posts, or account data.

The social-sdk command-line tool that ships with the package, including social-sdk mcp, sends one anonymous event per command: the command name, the built-in adapter name, the SDK version, the runtime, and the operating system and CPU architecture, keyed by a random ID stored on your machine. It never sends arguments, file contents, credentials, account IDs, or post content. It shows a notice before the first event, is off in CI, and stops with social-sdk telemetry disable, SOCIAL_SDK_TELEMETRY_DISABLED=1, or DO_NOT_TRACK=1. The CLI telemetry reference lists every field.

What the website records

The site uses a product analytics service to learn which documentation helps people. Requests go through our own address, y.social-sdk.dev, and are stored in the service's US cloud. Analytics start after the page has loaded and record:

• pages viewed and left, with the referring page
• JavaScript errors that happen on the page
• session replays of how the page was used, with every form input masked before it leaves your browser
• which platform, integration, install, and quickstart pages you open, so we know which guides to improve

Query strings are removed from every URL and referrer before an event is sent. Clicks are not captured automatically, and we don't identify visitors, so the analytics service keeps no named profile for you. It stores a random visitor ID in a cookie and local storage to tie your page views together.

Other storage and hosting

Your light or dark theme choice is saved in local storage as blume-theme. The site is hosted on Vercel, which processes standard request data such as your IP address and user agent to serve pages. There are no accounts, ads, or third-party ad trackers on the site. The only form is the Social SDK Cloud early-access form, covered next.

The Social SDK Cloud early-access list

When you join the list on the Social SDK Cloud page, we store the email address you enter, your answers about platforms, connected accounts, and what you use today, the page on this site that linked you to the form, and when you signed up. The list is kept in a Postgres database run by Neon in the United States, connected through Vercel, and only the maintainers can read it.

We use it only to contact you about Social SDK Cloud and to decide which platforms to build first. We don't add you to a newsletter, and we don't sell or share the list. The analytics service gets a signup event with your platform and account answers, never your email, and session replays mask the form's fields like every other input.

To keep bots off the list, the form checks that your email's domain can receive mail, and counts signup attempts per network for an hour. The count is stored under a keyed hash of your IP address, never the address itself. Counts older than a day are deleted the next time anyone uses the form. We also count blocked attempts per hour and reason, with nothing that identifies the visitor. With each entry we keep how long the page was open before the form was sent, and we mark entries that look automated (for example a link in an answer, or a form sent within seconds of opening the page) so we can review them.

We keep your entry until you ask us to remove it or we close the list. To be removed, email leo@social-sdk.dev from the address you signed up with, and we delete it within 7 days.

What we don't do

We don't sell visitor data, share it with advertisers, or combine it with other sources. Analytics are used only to improve the documentation and the site.

Social SDK Cloud

Social SDK Cloud is a hosted version of Social SDK. It is in early development and not open yet: you can join its early-access list, and no accounts are connected to it. When an app built on it asks you to connect a social account, you sign in on the platform's own page and approve an app named Social SDK Cloud. This section and the ones after it set the rules the service follows from the first connected account.

For a connected account, Social SDK Cloud stores:

• the access and refresh tokens the platform issues, encrypted at rest
• the account's platform ID, username, and display name, so the app can show which account is connected
• the posts, replies, messages, and media the app asks it to send for you, while they are being delivered
• a record of each delivery: the destination, the time, the result, and the platform's post ID or link

For developers who use the service, it also stores an account email and API key metadata. Paid access isn't available yet; this page will say how billing data is handled before it is.

How Social SDK Cloud uses that data

Only to do what the app you connected asks, on the account you connected, and to show you and that app the results. We don't read your account for any other purpose, sell the data, use it for advertising, or use it to train AI models.

• Tokens are kept until you disconnect the account or revoke access on the platform.
• Account details (ID, username, display name) are refreshed from the platform or deleted within 30 days.
• Post content and media are deleted once delivery finishes, and within 7 days at most.
• Delivery records are deleted after 30 days.

Social SDK Cloud runs on Cloudflare, which stores its data. Each platform you post to receives the content you send it and handles it under its own privacy policy.

Disconnecting and deleting your data

Disconnect the account in the app you connected it through, or remove Social SDK Cloud from the connected apps in the platform's own settings. When an account is disconnected or its access is revoked, we delete everything stored for it, including its tokens, account details, queued content, and delivery records, within 7 days.

To have everything tied to an account deleted, email leo@social-sdk.dev with the platform and the username. We delete it within 7 days and confirm by email. Deleting our copy doesn't remove anything already published: posts stay on the platform until you delete them there.

Google and YouTube

Social SDK Cloud uses YouTube API Services. By connecting a YouTube account, you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. You can revoke Social SDK Cloud's access at any time in your Google account connections.

Social SDK Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children

The site and Social SDK Cloud are not directed at children under 13, and we don't knowingly collect their data. If you think a child's data reached us, email us and we will delete it.

Your choices

A tracker blocker, or blocking y.social-sdk.dev, stops the analytics without breaking the site. To ask about data tied to your visits or to request its deletion, email leo@social-sdk.dev, or open an issue at github.com/opencoredev/social-sdk/issues without including personal details and we'll arrange a private reply. The terms cover how the site, the package, and Social SDK Cloud may be used.