Data policy
Privacy Policy
Effective and last updated August 28, 2026
VoodooSocial is a private, owner-operated social publishing service. This policy explains the limited information the service processes when its owner connects accounts, prepares content, and publishes through official platform APIs.
Information VoodooSocial processes
Owner authentication records include the configured email address, hashed session identifiers, and a one-way hash of the requesting IP address used for login throttling.
Connected-account records can include the platform name, account or channel identifier, display name, token expiration, and OAuth access or refresh credentials. OAuth credentials are encrypted at rest and are never returned to the browser after authorization.
Publishing records can include captions, titles, links, media references, schedules, selected destinations, platform post identifiers and URLs, sanitized provider errors, and audit timestamps.
How the information is used
Information is used only to authenticate the owner, connect accounts the owner authorizes, validate and schedule content, publish to destinations the owner selects, refresh credentials, prevent duplicate publishing, diagnose failures, and preserve an audit trail.
Sharing and platform access
VoodooSocial sends content and the minimum required account data to a social platform only when the owner requests authorization or publishing for that platform. Hosting and database infrastructure process data solely to operate this service. VoodooSocial does not sell personal information or use it for advertising.
Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Storage, security, and retention
OAuth credentials are protected with AES-256-GCM encryption, sessions are stored as hashes, mutations require an authenticated owner session, and the production service is served over HTTPS. Publishing attempts and provider responses are retained so the owner can verify what was or was not published.
Data remains until it is no longer needed for the owner's publishing history, security, or operations. The owner can revoke provider access from that provider's account settings. Questions and deletion requests can be sent to the user-support address displayed on the VoodooSocial OAuth consent screen.
Children and policy changes
VoodooSocial is not directed to children under 13 and does not knowingly collect their personal information. Material policy changes will be posted on this page with a revised effective date.