Privacy Policy

1. Scope and who we are

SocialHub Desktop (“SocialHub”, “the app”) is a Windows application that helps you manage social media accounts you already own. This policy explains how the app and this website (socialhub.vylo.win) handle information.

SocialHub is an independent project. It does not operate a cloud service that receives your app data, and it is not affiliated with or endorsed by Google, YouTube, Meta, Instagram, Threads, LinkedIn, TikTok, or X. This policy does not cover those platforms. When you use them — including through SocialHub — their own privacy policies and terms apply.

Because the app is local-first, most information never reaches us. We cannot read your posts, media, comments, or connected accounts from a server, because we do not have one.

2. Data the app processes

The app processes the following categories of information so that its features work:

Local profile and settings

• A local profile is created automatically on first run. In desktop mode it contains a synthetic local identifier (local@socialhub.local), the display name “Local User”, and a locale. There is no sign-up, no real email address, and no SocialHub password.
• Workspace name, time zone, interface language, and preferences such as close-to-tray, start-minimized, notifications, and autostart.
• If you set an optional PIN, a salted SHA-256 hash of it is stored locally. The PIN locks the interface; it does not encrypt the database.

Connected social accounts

• Provider name, provider account ID, display name, handle, avatar URL, granted scopes, token expiry, connection status, and the last error reported by the platform.
• OAuth access and refresh tokens, stored encrypted (see Storage and security).

Content you create

• Posts, captions, and other text you write; media files you add; the destinations you select; schedules; and the status and history of each post.
• Comments and replies you write, and comments you read from connected accounts.
• Analytics snapshots the app retrieves when you request them.

Platform data you request

• Channel or page information, video or post identifiers, titles, descriptions, and status.
• Comments and their authors' display names, handles, and avatar URLs.
• Aggregate reach and engagement metrics that a connected platform exposes through its API.

Technical records

• A local audit log of actions such as sign-in, account connection, disconnection, and publishing. It records the action, entity, timestamp, and may include an IP field; in desktop mode any IP recorded is the local loopback address 127.0.0.1.
• Local technical logs (for example, startup messages and errors returned by a platform). These may contain error details but are not sent to us.
• A temporary OAuth handshake file (encrypted, with a 10-minute lifetime) used to complete sign-in in your system browser.
• Backup archives that you create (they can contain your database and media, including encrypted tokens), plus automatic pre-restore archives kept in the app's backups folder.

3. Google and YouTube data

Connecting a Google account is optional. If you choose to connect YouTube, SocialHub requests the following Google OAuth scopes and uses them only to provide the features you invoke:

What we receive from Google. Depending on the features you use, the app receives your YouTube channel ID and title, video IDs and metadata, comment threads and the public profile information of comment authors (display name, handle, avatar URL), and aggregate analytics figures if the YouTube Analytics API is enabled for your connection. The app stores this information locally on your PC.

How we use it. Only to display your data, publish or schedule content you create, read and reply to comments, show metrics you request, and keep your connection working (for example, refreshing an expired access token). We do not use Google user data for advertising, to build advertising profiles, to determine creditworthiness, or to train generalized AI or machine-learning models. We do not sell it. Because there is no server copy, no one at SocialHub can read this data; it is accessed only by the app on your device.

Revoking access. Disconnecting YouTube in SocialHub deletes the local account record and tokens and attempts to revoke the token with Google. You can also remove access at any time at myaccount.google.com/permissions. Revoking access stops future API calls; it does not delete videos or comments that were already published to YouTube.

When you use YouTube features, the YouTube Terms of Service and the Google Privacy Policy also apply.

4. How we use data

• Provide the app's features: connect accounts, compose posts, upload media, schedule or publish content, read and reply to comments, and display metrics.
• Authenticate and maintain connections: complete OAuth sign-in, refresh access tokens, and show connection status or errors.
• Keep the app reliable and secure: write local audit records, diagnose failures, and protect against unauthorized local access.
• Respond to you: if you open a GitHub issue, we use the information you choose to include to understand and answer it.
• Comply with the law and enforce our rights where necessary.

We do not send marketing email, run advertising, sell data, rent data, or share it with data brokers. We do not use your content or Google user data for profiling or model training.

5. Storage and security

On Windows, the app stores its data in:

%APPDATA%\com.socialhub.desktop

That folder typically contains:

• socialhub.db — the local SQLite database (accounts, posts, schedules, comments, metrics, audit records, settings).
• storage\ — media files you add to the app.
• logs\ — local technical logs.
• backups\ — automatic pre-restore archives; backups you export are saved wherever you choose.
• settings.json, providers.json, oauth-pending.json, and window-state files.

Encryption

• OAuth access and refresh tokens are encrypted with AES-256-GCM using a random initialization vector and an authentication tag.
• The encryption key is generated on your device and stored in Windows Credential Manager under SocialHub.Desktop. If Credential Manager is unavailable, the app falls back to a local secrets file in its data folder and logs a warning.
• Desktop session tokens are stored as SHA-256 hashes in the local database; the raw session token is held in memory.
• Provider client secrets you enter, if any, are kept in Windows Credential Manager rather than in the database.

Network connections

The app runs a local server bound to 127.0.0.1:43123 and protects it with a per-install token; it is not exposed to your local network or the internet. Outbound HTTPS connections go to the platforms you connect (for example Google, Meta, LinkedIn, TikTok, or X) for OAuth, token refresh, API calls, and media upload. The app may load profile images from a platform's servers. It does not contact a SocialHub cloud server, and Next.js telemetry is disabled.

6. Sharing and disclosure

• With platforms you connect. When you publish, schedule, upload, refresh a token, or read comments, the relevant data is sent to that platform's API. The platform then handles it under its own policy.
• With GitHub. If you open an issue in the project's public tracker, GitHub and anyone who can view the issue receive whatever you write there. Do not include tokens, passwords, or personal data in a public issue.
• For legal reasons. We may disclose information if required by law, or to protect the rights, safety, and security of users or the public. Because we do not hold your app data, any such disclosure would be limited to information you sent us directly.
• No sale or advertising. We do not sell, rent, trade, or share personal data with advertisers, data brokers, or other third parties for their own purposes.

Google user data is not transferred to third parties except as necessary to provide the feature you requested (for example, uploading a video to YouTube), to comply with law, or as part of a merger, acquisition, or sale of assets with notice to you.

7. Retention and deletion

The app keeps your data on your device until you delete it. There is no server-side copy for us to retain, and no account to close on our side.

Disconnect one account

1. Open the account in SocialHub and choose disconnect.
2. The app deletes the local account record, including its encrypted access and refresh tokens.
3. The app attempts to revoke the token with the platform. If you are offline or the provider does not support revocation, the local deletion still happens.
4. You can also revoke access in the platform's own settings — for Google, at myaccount.google.com/permissions.

Published posts and comments remain on the platform until you delete them there. Local audit entries about the disconnection remain in the database until the data folder is deleted.

Delete everything

1. Export a backup first if you want a copy of your data.
2. Quit SocialHub completely (including the tray icon).
3. Delete %APPDATA%\com.socialhub.desktop. This removes the database, media, logs, settings, and automatic backups.
4. Remove the SocialHub.Desktop entries from Windows Credential Manager, which deletes the encryption key and any provider secrets.
5. Delete any backup archives you exported to other folders.

Uninstalling the application removes its program files but does not delete your data folder. Backups are ordinary ZIP archives that you control; delete them wherever you saved them.

8. Your choices and rights

• Access and export. Use the app's backup feature to obtain a copy of your local database and media.
• Correct your data. Edit or delete posts, media, and account details inside the app.
• Withdraw consent. Disconnect an account, decline the Google consent screen, or revoke access in your platform account settings.
• Delete your data. Follow the steps in Retention and deletion.
• Ask a question. Use the project's issue tracker; see Contact.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including rights to access, correct, delete, or port personal data, and to object to certain processing. Because SocialHub does not hold your app data on a server, you can exercise most of these rights directly in the app and in your file system. If you need help, contact us and we will explain what we can and cannot do.

9. This website

This website is a static site served by GitHub Pages. It does not use cookies, analytics, advertising pixels, tracking scripts, third-party fonts, or external JavaScript. The only thing it stores in your browser is your language preference, in localStorage under the key socialhub.lang; you can clear it through your browser settings at any time.

GitHub, as the hosting provider, may process technical information such as IP addresses and user agents to serve the site and protect its service, as described in the GitHub Privacy Statement. We do not receive or analyze those logs. Links to external sites (for example GitHub, Google, or YouTube) are governed by those sites' policies.

10. Children

SocialHub is a productivity tool for managing social media accounts and is not directed to children under 13 (or the minimum age required in your country). Do not use the app or connect accounts if you are below that age. If a child has used the app on your device, delete the data folder and any backups to remove the information.

11. International users

The app processes and stores data locally on your device, in the country where you use it. When you publish or retrieve data through a connected platform, that platform may transfer information internationally under its own policy. This website is hosted by GitHub Pages, which may process technical request data in the United States and other countries.

12. Changes to this policy

We may update this policy when the app's behavior changes or when the law requires it. The effective date at the top of this page will change, and material updates will be described on this page. Because the app has no mailing list, we cannot notify you by email; check this page before relying on a specific detail.

13. Contact

For Google API compliance questions, use the subject “Google API compliance” in your issue so it can be routed correctly.

This policy is available in English and Arabic. The English version is the authoritative version; the Arabic text is a translation provided for convenience. SocialHub is an independent project and is not affiliated with or endorsed by Google, YouTube, Meta, Instagram, Threads, LinkedIn, TikTok, or X. All names and trademarks belong to their owners.