01
Official platform access
Every post goes through each platform’s official API, to accounts you connect yourself with the platform’s own sign-in. We never see or store your social media passwords.
- TikTok has audited the Reelspan app, so posts can go out publicly.
- Meta approved it for Facebook, Instagram and Threads.
- Google verified it for YouTube, and LinkedIn approved it.
You can disconnect an account any time; its token is deleted at once. You can also revoke Reelspan from each platform’s own settings.
02
Encryption
- Platform tokens are encrypted at rest with AES-256-GCM, each bound to its own connection, and are only decrypted to publish or read what you asked for.
- API keys are stored only as SHA-256 hashes and shown to you once. A lost key can be replaced, never recovered.
- All traffic to the site, the dashboard and the API uses TLS.
03
Your account
- Sign in with Google or a one-time code sent to your email: there is no Reelspan password to steal or reuse.
- A sign-in from a new device sends you an email, and Settings → Security lists every session, with one click to sign the others out.
- AI apps you connect (Claude, ChatGPT) are listed there too, and can be disconnected at once.
- Every change to your account is kept in an activity log you can read.
04
The API
- Keys can be limited to some scopes (publish, read, profiles, analytics, webhooks) and to some profiles, and can expire.
- Rate limits apply per workspace, and repeated failed keys from one address are blocked for a while.
- Webhooks are signed with HMAC-SHA256 and a timestamp, so your server can check each one came from Reelspan. See Webhooks.
05
Your content and data
- Uploaded videos and images are kept only while they’re needed to publish and retry, then deleted (7 days after publishing by default).
- We don’t sell your data and don’t use your content to train AI models.
- You can have a copy of your data emailed to you, or delete your account and everything in it, from Settings in the dashboard.
- Payments are handled by Lemon Squeezy as merchant of record; we never see your card. More in the privacy policy.
06
Running the service
- Access to production systems is restricted to key-only SSH, and admin access needs a second factor.
- The database is backed up every day to separate storage.
- Errors are reported to us as they happen, and the site, the dashboard and the API are checked from outside every minute.
- Live status: reelspan.com/status.
07
Report a vulnerability
Found something? Email [email protected] with the details and how to reproduce it. We reply within two working days, keep you posted while we fix it, and won’t take action against good-faith research that avoids other people’s data and doesn’t disrupt the service. The full disclosure policy has the scope, the rules and rewards; it is also in security.txt.