Clear connections.Clear privacy.

99Posts is provided by STRICS IT GmbH, Florian-Gmainer-Strasse 4, 4240 Freistadt, Austria. This policy covers the 99Posts iPhone app, its supporting cloud services, and the 99Posts pages on 99hq.dev.

For support or a privacy request, email hello@strics.at. STRICS IT GmbH is the controller for data handled to operate 99Posts. Apple, Google, Meta, TikTok, and other services can act as separate controllers for their own accounts and platforms under their policies.

You can sign in to own your 99Posts workspace with Apple, Google, or an optional email/password account. These owner accounts are independent; 99Posts does not link owner identities across sign-in methods. We process the name and email you provide or make available through sign-in, the authentication provider, a Firebase user identifier, and account state. Apple can provide a private relay address when you choose Hide My Email. Firebase Authentication handles email/password credentials, email verification, and password-reset requests when you use that sign-in option.

We also process authentication and device-security identifiers, including Firebase Authentication identifiers and App Check/App Attest assertions. Workspace, Profile, post, and connection records are associated with your owner account through these identifiers.

Connecting a publishing destination is a separate action. A Profile can hold one connected account for each supported platform. For a connected YouTube, Instagram, or TikTok account, we process the account or channel identifier, username, profile image, granted scopes, connection status, and encrypted access or refresh credentials needed to perform the actions you request. Signing in with Google does not automatically connect a YouTube channel.

Saved drafts and optional working copies are stored locally in the app, scoped to the signed-in owner and Profile. A draft can include the selected video, cover, title, description, caption, hashtags, first comment, publishing time, and platform-specific options. Local drafts are not uploaded merely because they were saved.

When you schedule or publish, 99Posts uploads the selected video, selected or uploaded cover, target choices, post text, and relevant platform settings to its Firebase-backed service so the request can be delivered later. Depending on your choices, this can include chosen-place data described below, sponsored or commercial-content disclosures, AI-altered-content disclosures, YouTube audience and visibility settings, Instagram collaborator usernames or account tags, and TikTok privacy or disclosure controls.

Do not include personal data, private material, music, images, or other content unless you have the rights and authority to use and publish it.

You can manually choose a place for a post. Place information can include a name, a platform place identifier, and full-precision latitude and longitude from place-search results, including Apple MapKit. Chosen-place data is sent through Firebase for supported location features and can be sent to the publishing destinations you select. For example, YouTube can receive those coordinates as recording metadata. This data can identify a precise location and is associated with your account and post.

Choosing a place is optional. 99Posts does not request device GPS permission or read your device's current GPS location. A manually selected place can still contain precise coordinates, even though the app does not access device GPS.

We process publication time, provider post identifiers, delivery state, warnings, errors, and normalized post metrics such as views, likes, comments, and shares when a provider returns them. These records support scheduling history, delivery status, and publication and engagement analytics in Insights. They are associated with your account and posts. Provider metrics can be delayed, incomplete, changed, or unavailable.

For reliability, security, abuse prevention, support, and aggregate service-quality analytics, our infrastructure can process IP address, endpoint, request time, app and operating-system version, user agent, response status, duration, warnings, and limited error details. Operational diagnostic records can be linked to your account or device. Firebase Authentication and Firestore also declare analytics purposes in their SDK privacy manifests.

These engagement and diagnostic analytics exist without the Firebase Analytics or Firebase Crashlytics SDKs, neither of which is included in the app. The app does not include AdSupport, use IDFA, or use the collected data for ad targeting or cross-app tracking.

Apple processes App Store payments. STRICS IT GmbH does not receive your complete payment-card details. StoreKit can provide product, transaction, original-purchase, renewal, expiration, refund, revocation, and subscription status so 99Posts can verify access and restore purchases.

A StoreKit account token and transaction identifiers link purchase and entitlement records to your owner account. We retain limited entitlement, transaction-link, restore-claim, and replay-protection records needed to prevent duplicate grants, resolve billing state, and support disputes or legal obligations.

Relevant recipients and processors include Apple for App Store, StoreKit, Sign in with Apple, MapKit place search, and device services; Google Firebase and Google Cloud for authentication, App Check, database, storage, functions, and logs; Google and YouTube for Google sign-in and YouTube publishing; Meta, Facebook Login, and Instagram for Instagram account connection and publishing; TikTok for TikTok account connection and publishing; and Vercel for 99hq.dev hosting.

Data is sent to a publishing provider when you connect that provider or use its supported publishing features. Each provider also handles data under its own privacy policy and account settings. Processing locations and any applicable international-transfer safeguards depend on the provider and service used. Contact hello@strics.at for information about the arrangements applicable to your data.

We process account, content, connection, scheduling, publishing, insights, and subscription data to provide the functions you request and perform our contract under Article 6(1)(b) GDPR. We process proportionate security, diagnostics, fraud-prevention, revocation, replay-protection, and service-protection data for our legitimate interests under Article 6(1)(f). Records required for tax, accounting, consumer, or other legal duties are processed under Article 6(1)(c). Where a specific choice legally requires consent, you can withdraw it for the future without affecting earlier lawful processing.

Original uploaded video is scheduled for removal after all selected destinations have published, been cancelled, or reached a completed test state. A cancelled original is queued for immediate deletion. A failed original is scheduled for removal after seven days. Cleanup retries failed deletions. An unattached upload reservation expires within 24 hours or when the related subscription access expires, whichever comes first. A reduced JPEG cover can remain with schedule and history data until account deletion.

Webhook summaries are retained for seven days and Meta deletion receipts for 30 days. Narrow StoreKit, purchase-restore, replay-protection, and exhausted publication-failure records can remain for at least 90 days, or longer where reasonably required for subscription expiry, dispute handling, accounting, fraud prevention, or a legal duty. Operational logs follow configured platform retention periods.

You can disconnect a publishing account in 99Posts and can also revoke access in the provider's account settings. Disconnecting stops future 99Posts requests for that connection but does not delete posts already published on the provider. A provider may retain its own records under its policy.

The in-app Delete Account action starts removal of the owner's Profiles, scheduled posts, uploaded media, provider connections, and insights from active 99Posts systems. Cleanup can be retried while a provider operation is still completing or after a deletion attempt fails. 99Posts attempts provider-token revocation; credentials needed for a failed revocation remain encrypted in a retry queue until that revocation is resolved. Narrow records may remain for the retention purposes described above. Deleting the app or account does not cancel an Apple subscription; manage billing separately in Apple Account settings.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection by contacting hello@strics.at. We may need to verify that a request belongs to the relevant account. You may complain to the Austrian Data Protection Authority at dsb.gv.at or the supervisory authority where you live or work.

We use encrypted transport, encrypted server-side provider credentials, Firebase access controls, App Check and Apple platform security, signed StoreKit verification, validation, and restricted secret access. No system is completely secure. 99Posts is not intended for anyone who cannot lawfully hold the relevant platform accounts or provide valid consent in their country.

We may update this policy when the product, providers, or law changes. The version and effective date on this page identify the current product-specific policy.