Privacy Policy

This policy explains how Site2Social handles information in its free beta, including the optional browser helper. Infrastructure backup and log-retention periods have not been confirmed; the limits below apply.

Information Site2Social receives

Site2Social may receive account identifiers and contact information from the sign-in method you choose; business information that you enter or approve; public content from websites you are authorized to submit; uploaded brand assets; social-account permissions and resource identifiers returned through official provider authorization; and records of proposals, approvals, operations, and support requests.

Website analysis

A preliminary scan reads a limited set of public HTML pages and does not require an account. Full scans require sign-in and confirmation that you own the site or have authority to analyze it. Retrieved content is treated as untrusted evidence. Site2Social limits redirects, pages, response size, time, content types, origins, and network destinations. It does not intentionally access private pages.

Sign-in

Site2Social supports Sign in with ChatGPT and Sign in with Google. Google credentials are verified on the server; Google passwords are never received. Google sign-in uses a one-use challenge that expires after 10 minutes and an opaque, secure browser session that expires after seven days. Site2Social stores a hashed session identifier rather than the browser session value. A separate secure cookie remembers your selected sign-in method or signed-out state for up to one year. It contains no account identifier and does not itself sign you in; if it is missing, Site2Social requires an explicit sign-in choice unless a valid Google session remains. Additional secure cookies and a server-side browser record bind sign-in attempts to the current browser and its latest sign-in choice for up to one year. They prevent delayed responses from reversing sign-out. Account deletion removes the browser record’s account reference and cancels pending sign-ins; unrelated pending sign-ins may need a retry. Expired browser records and session records are cleaned when a new browser context is prepared. Linking another sign-in method requires an authenticated account; matching email addresses do not automatically merge accounts.

Connected accounts

Access tokens are used only to read authorized resources and perform customer-approved operations supported by the applicable provider. Tokens are encrypted at rest and kept out of browser storage, analytics, and ordinary logs. A connection does not itself authorize a profile change or publication.

Facebook, Instagram and LinkedIn setup

For these guided routes, Site2Social saves your editable platform draft, exact approval, selected image references, setup progress, public profile link and your completion confirmations. Opening a platform does not create a profile. Sign-in, passwords, verification, platform terms and final submission take place on the platform. A “ready” label records your confirmation; it is not an independent verification by the platform.

Optional Chrome helper

The optional desktop extension transfers selected public fields from a visible, approved Site2Social setup to the matching platform form when you use its controls. Facebook fields are Page name, category query and bio. Instagram fields are Name and Username. LinkedIn fields are company name, public Page address, website, industry query, organization size and type, and tagline. The helper uses activeTab, scripting and storage permissions without permanent website access. It does not read passwords, cookies, authentication tokens, verification codes or browsing history, and it does not collect telemetry or make network requests.

Approved transfer fields, an internal business identifier, the source tab identifier and an expiry timestamp are stored in the extension’s session storage. A transfer can be used for 10 minutes; expired transfer data is removed when the helper is next opened or used. Restarting the browser or disabling, reloading or removing the extension also clears its session storage. “Clear saved fields” removes the transfer immediately. The helper rereads the original visible approval before filling, stops if it changed or the form is unrecognized, and never submits the form or accepts platform terms. Clearing Site2Social data does not itself clear an extension session; use its clear control or restart the browser. You can remove the helper through your browser’s Extensions settings.

The helper reads the active tab’s URL to identify the supported setup page and inspects visible form labels and verification notices to decide whether filling is safe. It keeps no browsing-history record. Its use of this information is limited to the field-transfer feature. We do not use or transfer helper data for advertising, creditworthiness or lending decisions, and the developer receives no helper data to inspect. The helper’s use and transfer of information follow the Chrome Web Store User Data Policy, including its Limited Use requirements.

New profile creation

When enabled, the Bluesky creation flow sends you to Bluesky to establish your own account and recovery details, accept its terms, and authorize the approved profile operation. Site2Social stores your approved text and image references, the account identifier, creation corroboration, provider readback, and your confirmation of independent access. Temporary authorization state expires after 20 minutes; encrypted saved authorization sessions expire after 30 days unless refreshed. Expired authorization entries cannot be used and are purged when another authorization state or session is saved, or when the associated business or account is deleted. Uploaded images are resized and converted in your browser before storage, and the prepared image is shown for approval.

Mastodon and Google preparation

Mastodon signup, passwords and email verification stay on mastodon.social. After customer authorization, Site2Social retains the approved draft, encrypted account access, signup lookup and customer attestation, account identity, profile readback and completion evidence. New-signup provenance is a customer statement; authorization verifies account control. Google Business Profile preparation saves eligibility answers and proposed listing details in Site2Social only. Google sign-in does not authorize Business Profile access, and listing creation is not enabled.

Unsaved edits

Where available, unsaved intake, profile and business-fact edits are kept in session storage in the current browser tab, separated by Site2Social account and, for saved work, business. They may be offered for explicit recovery for up to seven days. This copy contains editable text, exclusion choices, image references and intake request identifiers, not passwords, provider tokens or approval selections. It is not a cross-device backup. Saving or discarding the matching copy removes it; explicit Site2Social sign-out clears the account’s recovery copies in that tab. Browser storage behavior may remove a copy earlier.

Use and retention

Information is used to provide the service, secure accounts, generate source-grounded proposals, execute approved actions, prevent duplicate operations, troubleshoot failures, and maintain an audit history. Authenticated scan snapshots expire after 30 minutes and are purged on later scans or account deletion. Saved businesses, drafts and approved profile information remain until you delete the business or account; there is no automatic inactivity deletion. Completed deletion removes business content and uploaded objects from active storage. A minimal intake request identifier remains with the account to prevent an old request from recreating a deleted business; its website and business references are removed. These request identifiers are removed on account deletion. Account deletion leaves a receipt containing a random identifier, event type and timestamp, without the deleted account identifier. Backup and infrastructure-log retention are still being verified; Site2Social does not promise a fixed deletion period or recovery window for those systems.

Sharing

Current infrastructure is OpenAI Sites with Cloudflare Workers, D1 database, and R2 object storage. Sign-in is handled by the identity method you select; Google sign-in uses Google Identity Services. Website extraction and draft preparation are deterministic; this version does not send website content to a language-model service. Approved provider actions transmit the selected content and resource identifiers to the applicable provider. Site2Social does not sell personal information or share it for cross-context behavioral advertising. The optional helper makes no network requests; it places approved fields in the platform form at your direction.

Support and service logs

If you contact support, we receive the message and any information you include. Include only what is needed to investigate your issue. Application error records use operation names and support references; hosting infrastructure may also record request information. Its retention and query-string handling have not been confirmed. We do not promise that infrastructure logs are free of personal information.

Your choices

You may correct or exclude business facts, disconnect a platform, revoke provider access, permanently delete a business profile, and permanently delete your Site2Social account through the dashboard. Deleting Site2Social data does not necessarily delete content already published to an external platform or revoke the provider’s authorization grant.

You may email the contact below to request access to, correction of, or deletion of your information. We may need to verify your control of the account without asking for your password or verification codes. Rights and response requirements depend on applicable law. We update this page when practices change and identify the effective date above.

Operator and contact

Site2Social is operated by Brian Miller, an individual. For support, privacy, deletion, copyright or access-review requests, email brian@webassethouse.com.