Privacy Policy

1. About This Policy

This Privacy Policy describes how Outpost ("we," "us," or "our") collects, uses, stores, shares, and protects personal information when you use the Outpost mobile application, our website at https://outpost.app, and related services (collectively, the "Service"). It also describes the rights and choices available to you.

By using the Service, you acknowledge that you have read and understood this policy. If you do not agree with our practices, please do not use the Service.

This policy does not apply to third-party platforms you connect through Outpost (such as Instagram, Facebook, X, LinkedIn, TikTok, or YouTube). Those platforms have their own privacy policies that govern how they handle your information.

2. Information We Collect

Account and Identity Information: When you register, we collect your email address. If you sign in with Google or Apple, we receive the identity information those providers share with us (typically your name, email address, and profile picture). We assign you a unique user ID when your account is created.

Connected Social Account Data: When you connect a third-party social media account (Instagram, Facebook, X, LinkedIn, TikTok, or YouTube), we receive and store: the platform's unique account ID for that connection; your display name, username/handle, and avatar URL on that platform; OAuth access tokens and refresh tokens used to authenticate requests to the platform on your behalf; token expiry timestamps; and your connection and default account preferences.

Content You Create: We store all content you create within Outpost, including text captions (shared and platform-specific), uploaded images and videos (including file name, size, duration, and type), scheduled publication dates and times, timezone preferences for scheduling, platform selections for each post, and draft and post status metadata.

Usage and Onboarding Data: During onboarding, we collect information you choose to provide about your role (creator, freelancer, agency, or brand), the number of accounts you manage, your typical posting frequency, which social platforms you use, and how you discovered Outpost.

App Settings and Preferences: We store your in-app settings, including your preferred timezone, auto-save draft toggle, confirmation dialog preferences, theme preference (light/dark), and notification preferences.

Plan and Usage Tracking: We track your monthly published post count against the free plan limit and your current subscription status via RevenueCat.

Technical and Device Information: We may automatically collect device identifiers, operating system version, app version, IP address, log data, crash reports, error messages, and timestamps of interactions necessary to operate, maintain, and secure the Service.

Analytics Data: We use Mixpanel to collect event-level usage data including which features you use, onboarding steps, funnel progression, and general interaction patterns. Mixpanel may assign a persistent identifier to your device to track events over time.

3. How We Use Your Information

Service Delivery: We use your information to provide the core features of Outpost — creating and storing drafts, authenticating your account, connecting social media accounts, scheduling posts, publishing content to connected platforms on your behalf, and displaying your post history.

Account Management: We use your account information to verify your identity, manage your session, send transactional communications (such as account verification and security alerts), and process subscription management.

Personalization: Onboarding data and in-app preferences are used to tailor your experience, surface relevant tips, and show content or features suited to your usage patterns.

Analytics and Product Improvement: Event data collected through Mixpanel is used to understand how users interact with the Service, identify areas for improvement, prioritize new features, and measure onboarding effectiveness.

Safety, Security, and Compliance: We use technical data, account information, and usage patterns to detect and prevent fraud, abuse, unauthorized access, and violations of our Terms.

Communications: We may use your email address to send important service notifications, security alerts, and (where you have opted in) product updates or promotional messages. You may opt out of non-essential communications at any time.

4. Legal Bases for Processing

For users in the European Economic Area, United Kingdom, and other jurisdictions where applicable law requires a lawful basis for processing, we rely on the following bases:

Contractual Necessity: Processing required to provide the Service under our Terms of Service — including authentication, content storage, connected account management, post scheduling, and publishing — is necessary for the performance of our contract with you.

Legitimate Interests: We process certain technical, usage, and analytics data based on our legitimate interests in operating and improving the Service, preventing fraud and abuse, and ensuring security, provided those interests are not overridden by your rights.

Consent: Where we send optional marketing communications or use analytics beyond strictly necessary operation, we rely on your consent. You may withdraw consent at any time.

Legal Obligation: We may process information as necessary to comply with applicable laws, regulations, court orders, or lawful governmental requests.

5. How We Share Your Information

Infrastructure and Service Providers: We share information with Supabase, which provides our authentication system, database, and backend infrastructure. Supabase processes data on our behalf under appropriate data processing agreements.

Analytics: We share usage event data with Mixpanel to provide analytics services. Mixpanel may process your data in the United States.

Subscription Management: We share your user identifier with RevenueCat to manage subscription entitlements and process in-app purchases through Apple App Store and Google Play.

Connected Social Platforms: When you publish a post, we transmit your content and credentials (via OAuth tokens) to the relevant social media platform APIs. We only send data to a platform when you initiate an action that requires it.

Legal and Safety Disclosures: We may disclose information if required by law, subpoena, court order, or governmental request, or when we have a good-faith belief that disclosure is necessary to protect rights, property, or safety.

Business Transfers: If Outpost is involved in a merger, acquisition, financing, or asset sale, your information may be transferred as part of that transaction with appropriate notice.

We do not sell your personal information to third parties and do not share it for third-party advertising purposes.

6. Analytics and Tracking

We use Mixpanel to collect and analyze in-app usage events. Mixpanel may use device identifiers to track your use of the Service across sessions. This data helps us understand user behavior, improve product features, and measure onboarding effectiveness.

If you wish to opt out of Mixpanel analytics tracking, contact us at support@outpost.app and we will assist you.

We do not use cross-site tracking, behavioral advertising networks, or third-party ad networks within the Service.

7. Data Storage and Retention

Your data is stored on Supabase infrastructure, which may be located in the United States or other jurisdictions depending on Supabase's infrastructure configuration.

We retain your information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where retention is required by law or needed for legitimate security and fraud prevention purposes.

Connected social account tokens are retained for as long as the connection remains active. Crash logs and technical diagnostic data are typically retained for up to 90 days.

8. Security

We implement reasonable administrative, technical, and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include encrypted data transmission (TLS), secure storage of OAuth tokens, and Supabase's built-in security features.

No security system is impenetrable. We cannot guarantee absolute security of data transmitted over the internet or stored in our systems. Notify us immediately if you suspect unauthorized access to your account.

9. International Data Transfers

Outpost is operated from the United States, and information we collect may be transferred to and processed in the United States or other countries where our service providers operate. If you are located in the European Economic Area, United Kingdom, or Switzerland, we take steps to ensure appropriate safeguards are in place for such transfers, such as using service providers that comply with standard contractual clauses or equivalent mechanisms.

10. Your Rights and Choices

Depending on where you live, you may have the following rights regarding your personal information:

Access and Portability: You may request a copy of the personal information we hold about you.

Correction: You may request that we correct inaccurate or incomplete information.

Deletion: You may request deletion of your account and associated personal information. We may retain certain data where required by law or for legitimate security purposes.

Restriction and Objection: You may request that we restrict certain processing or object to processing based on legitimate interests.

Withdrawal of Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

California Residents (CCPA/CPRA): You have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

EEA and UK Residents (GDPR/UK GDPR): You have the rights described above and the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support@outpost.app. We may need to verify your identity before fulfilling your request and aim to respond within 30 days.

11. Device Permissions

Media Library: Outpost requests permission to access your device's photo and video library when you choose to attach media to a post. This permission is requested only when you actively initiate media selection. We access only the specific media you select.

Push Notifications: Outpost may request permission to send you push notifications for alerts such as scheduled post reminders and subscription status updates. This permission is optional and can be revoked at any time through your device's notification settings.

We do not request access to your camera, microphone, contacts, location, or calendar.

12. Children's Privacy

Outpost is not directed to or intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will take prompt steps to delete it.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@outpost.app.

13. Third-Party Platforms and Links

The Service integrates with third-party platforms including Instagram, Facebook, Meta, X Corp, LinkedIn, TikTok, ByteDance, Google, and YouTube, as well as infrastructure services such as Supabase, RevenueCat, and Mixpanel. Each has its own privacy policy and data practices.

We are not responsible for the privacy practices, security, or content of third-party platforms or services. We encourage you to review the privacy policies of any platform you connect to through Outpost.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes through the app, via email, or through other appropriate means at least 30 days before the changes take effect.

The "Last Updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Service after the effective date of a revised policy means you accept the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@outpost.app.

Website: https://outpost.app