RatedStackPrivacy Policy
Last updated: 4 September 2026
RatedStack ("the Service", "we", "us") is a social media publishing and scheduling tool operated by Digital Cliqs. This policy explains what data we collect, why we collect it, how long we keep it, and how you can have it deleted.
The short version: we store the minimum needed to publish the content you tell us to publish. We never sell your data, we never post anything you did not write or schedule, your platform credentials live in an encrypted vault, and the images and videos you attach are deleted as soon as your post goes out.
1. Who we are
Digital Cliqs is the data controller for information processed through RatedStack. For any privacy question, correction, or deletion request, contact digitalcliqsmarketplace@gmail.com.
2. What we collect and why
| Data | Why we hold it | How long |
|---|---|---|
| Google account basics (name, email address, account identifier) | To sign you in and identify your workspace. We never receive your Google password. | Until you ask us to delete your account |
| Early-access list entry (email address, name) | If you sign in before the Service is open to you, we record your address so we can tell you when your workspace is ready. | Until you ask to be removed, or until we contact you and you decline |
| Social platform credentials (access and refresh tokens) | To publish the posts you schedule and read back engagement figures for your own posts. | Until you disconnect that account, then destroyed immediately |
| Content you create (post text, links, schedule times, publishing records) | To schedule, publish, and report on your posts. | Until you delete it or your account |
| Media you attach (images, video) | To transfer the file to the platform you are publishing to. | Deleted immediately after publishing — for scheduled posts, held only until the scheduled time (maximum 90 days) |
| Engagement and traffic figures | To show you how your own posts performed. | With your publishing records |
| Operational logs | To keep the Service running and diagnose failures. Credentials and cookies are redacted from logs. | Short-term, rolling |
We do not use cookies for advertising or third-party tracking. The Service sets one essential, encrypted session cookie so you stay signed in.
3. Google user data — Limited Use disclosure
RatedStack uses Google sign-in to authenticate you. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- We request only your basic profile and email address, and use them solely to authenticate you and contact you about the Service.
- We do not transfer this data to third parties except as necessary to provide the Service, comply with law, or as part of a merger or acquisition.
- We do not use this data for advertising, and we do not sell it.
- We do not allow humans to read this data unless you explicitly ask us to (for example, to resolve a support issue), we need it for security or legal reasons, or it has been aggregated and anonymised.
Where RatedStack reads Google Analytics figures, it does so only for properties you connect, only to report traffic to your own site, and under the same limitations.
3a. YouTube API Services
RatedStack uses YouTube API Services. When you connect a YouTube channel, we act on your behalf through the YouTube Data API — we list your channel to label the connection, upload the videos you compose to your own channel, read view, like and comment counts for those uploads, and delete an upload at your request. One video is uploaded per action you take; we never upload in bulk or without you composing and confirming the video.
- By using these features you are also bound by the YouTube Terms of Service.
- Google's handling of your data is described in the Google Privacy Policy.
- Revoking our access: as well as disconnecting the channel inside RatedStack — which destroys the stored credential and revokes our token with Google — you can revoke our access at any time from the Google security settings page.
- What we keep, and for how long: we store the like and comment counts for videos you published through RatedStack so you can compare performance across your networks over time. These figures are refreshed regularly — every 30 days we also re-check that our access is still authorised and that each video still exists on YouTube, and we delete the stored counts when either is no longer true — and they are retained for no longer than 36 months in any case. Your channel's name is kept only to label your connection in the app, and is refreshed from YouTube. We do not store YouTube video titles, descriptions, thumbnails or comment text. Deleting a post in RatedStack, or your account, removes the associated figures — see Deleting your data.
- Questions or complaints about how we handle your data: digitalcliqsmarketplace@gmail.com.
4. Social platforms we connect to
When you connect an account, that platform issues us a credential scoped to the permissions you approve. We use it only to perform the actions you asked for — publishing your content, and reading engagement for your own posts.
| Platform | What we do with the connection |
|---|---|
| Facebook & Instagram (Meta) | Publish posts, images and video to the Page or professional account you select; read engagement counts for those posts; delete a post at your request. |
| Threads | Publish posts and media; read post insights; delete at your request. |
| TikTok | Read your basic profile to label the connection; publish videos you compose to your own account; or, if you choose “Send to TikTok drafts” instead, upload the video to your TikTok inbox so you can finish and post it yourself in the TikTok app. |
| Publish posts to your member profile; delete at your request. | |
| List your boards; create pins you compose; read analytics for those pins. | |
| YouTube (Google) | List your channel to label the connection; upload the videos you compose to it; read view/like/comment counts for those videos; delete a video at your request. |
| Bluesky, Mastodon, Telegram | Publish posts to the account or channel you connect; read public engagement counts where the platform provides them; delete at your request. |
Content you publish becomes subject to that platform's own terms and privacy policy. We are not responsible for how a platform processes content once it is published there.
5. How your data is protected
- Platform credentials are stored write-only in an encrypted secrets vault (Google Cloud Secret Manager) — never in our application database and never in logs.
- All traffic is encrypted in transit over HTTPS.
- Media is held transiently and in a private, non-public store; it is removed on every outcome — published, failed, or cancelled.
- Access to production systems is restricted to the operator.
6. Deleting your data
You are always in control:
- Disconnect a platform — destroys the stored credential immediately and, where the platform supports it, revokes our access on the platform side.
- Delete a published post — removes it on the platform (where that platform's API allows deletion) and retires its analytics record.
- Delete your account — do it yourself in RatedStack under Settings → Account. Deletion is scheduled rather than instant: your account is locked straight away so nothing further is published — anything you had scheduled is paused, not cancelled, and if you change your mind you choose what happens to it — and everything is permanently deleted after a 14-day grace period during which you can still change your mind. One exception runs sooner: all Google/YouTube data — the connection, the stored credential and the stored counts — is deleted within 7 calendar days of your request, as YouTube's API policies require; if you cancel after that, you simply reconnect your channel. We revoke our access on each connected platform first, then destroy the stored credentials, your scheduled and published-post records, your media projects and your sign-in. You are given a confirmation code that stays checkable at api.ratedstack.com/data-deletion/status even after the account is gone. To keep that code checkable, one small record of the deletion survives — the confirmation code, the date, and a note of what was removed. It does not contain your name, email address, or Google account identifier; those are erased from it when the deletion completes, so the record cannot be traced back to you. Posts already published stay on the platforms you published them to — we cannot remove those for you.
- Leave the early-access list, or ask us to delete your data by hand — email digitalcliqsmarketplace@gmail.com from the address you signed up with, with the subject "Delete my data". We will action it within 30 days and confirm by reply.
Deleting data connected through Facebook, Instagram or Threads
If you connected a Facebook Page, an Instagram account or a Threads profile, you can have everything we hold from that connection deleted without contacting us at all. Either:
- Remove RatedStack from your Meta account — in Facebook go to Settings & privacy → Settings → Apps and websites (for Threads, Settings → Account → Website permissions), find RatedStack and remove it, choosing the option to delete your data. Meta notifies us automatically and the deletion happens straight away.
- Or disconnect the account inside RatedStack, which does the same thing immediately.
Either route deletes the access tokens for those accounts, the connections themselves, anything they had scheduled, and the record of posts published through them. We keep no copy. When the request comes from Meta you are given a confirmation code — you can check what happened to it at any time at api.ratedstack.com/data-deletion/status.
Deleting data for one connected account does not delete your RatedStack account itself; use the email route above for that.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, restrict, or delete the personal data we hold about you, and to object to processing. Exercise any of these by emailing us at the address above; we will respond within 30 days. You also have the right to complain to your local data protection authority.
Our lawful bases for processing are: performance of a contract (running the Service you signed up for), consent (joining the early-access list, connecting a social account), and legitimate interests (keeping the Service secure and working).
8. Data sharing and location
We do not sell personal data and we do not share it for others' marketing. We share data only with the infrastructure providers needed to run the Service — cloud hosting and the encrypted secrets vault — and with the social platforms you explicitly connect, at your instruction. Data may be processed in the United States and the European Union.
9. Children
RatedStack is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.
10. Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change affects you meaningfully, notify you by email.
11. Contact
Digital Cliqs — digitalcliqsmarketplace@gmail.com