Privacy policy — Shorts Poster

Who we are

Shorts Poster is a product operated by RT Empire Pty Ltd (ABN 99 616 445 099), 2 Able Street, Sadliers Crossing QLD 4305, Australia. In this policy, “we” and “us” mean RT Empire Pty Ltd.

This policy covers personal information we handle through shortsposter.com and through the Shorts Poster application at app.shortsposter.com.

We are an Australian Privacy Principles entity under the Privacy Act 1988 (Cth). If you are in the European Economic Area or the United Kingdom, we are the controller of personal information we decide the purposes of. The social networks you connect are separate controllers of their own services.

Plain-language summary

If you email us, we collect that address and whatever you write.
If you create an account, we store the videos you upload, the posts you schedule, and tokens for social accounts you connect.
We use YouTube API Services, Meta platform data and TikTok data only to provide Shorts Poster to the person who connected the account.
We do not sell personal information, and we do not use platform data to advertise to other people.
You can ask us to delete it by emailing privacy@shortsposter.com. The steps are on the data deletion page.

The rest of this policy is the detail. If the summary and the detail ever differ, the detail is what we follow.

What we collect

If you use this website

Email you send us: your address, and whatever you write, including attachments.
Server logs: IP address, user agent, the page requested, the time, and a status code. We keep these to operate and protect the site.

When you have a Shorts Poster account

Identity and account: name, email address, a password hash (we do not store the password itself), and the brands and settings you create.
Content you upload: video files, captions, cover images, and the schedule you set.
Connected accounts: the account identifier, the display name the platform returns, the permissions you grant, and the OAuth access token and refresh token.
Publishing and analytics: the posts you ask us to publish, their status, and the metrics the platform returns for those posts.
Support: correspondence with us about the account.
Billing: the details in the Stripe section below. We do not store a full card number.

We do not ask for the password of your YouTube, Instagram, Facebook, TikTok or other social account. Connections use the platform’s own sign-in.

Connected accounts and OAuth tokens

When you connect a social account, the platform gives us a token instead of your password. We store that token so we can publish at the time you chose, refresh the connection, and read the analytics the platform makes available for posts you published through Shorts Poster.

Tokens are stored separately from any password, encrypted at rest, and available only to the systems and people who need them to run the service. We delete a token when you disconnect the account or delete your Shorts Poster account, on the timetable in the retention section.

You can revoke a token at the platform as well as inside Shorts Poster. Revoking access stops us from retrieving new data. Ask us to delete what we already stored if you want that copy removed too.

YouTube API Services

Shorts Poster uses YouTube API Services. We use them so you can connect a YouTube channel you control, schedule and publish YouTube Shorts you set up, read the channel identity needed to show that connection, and show you analytics for videos published through Shorts Poster.

By connecting a YouTube account to Shorts Poster, you are also agreeing to be bound by the YouTube Terms of Service:

https://www.youtube.com/t/terms

Google’s privacy policy is here:

http://www.google.com/policies/privacy

You can revoke Shorts Poster’s access to your Google account at any time on the Google security settings page:

https://security.google.com/settings/security/permissions

Our use of YouTube API Services is also subject to the YouTube API Services Terms of Service at https://developers.google.com/youtube/terms/api-services-terms-of-service.

We refresh stored YouTube data on a regular cycle and do not keep it for longer than we need to show you your scheduled posts and the analytics for them. If you revoke access or disconnect YouTube, we delete the YouTube data we stored for that connection within 30 days, except for a backup copy which is removed within 90 days, and except for records we must keep to meet a legal duty.

We do not use YouTube API Services to scrape YouTube, to collect data about viewers who are not our users, or to train general-purpose machine-learning models.

Google API Services User Data Policy (Limited Use)

Shorts Poster’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

https://developers.google.com/terms/api-services-user-data-policy#limited-use

In practice, that means:

We use Google user data only to provide or improve the user-facing features you asked for: connecting a channel, scheduling and publishing, and showing you analytics for that activity.
We do not sell Google user data.
We do not use it or transfer it for serving advertisements. That includes retargeting, personalised advertising and interest-based advertising.
We do not allow humans to read Google user data unless you give us affirmative agreement to do so for a support request, it is necessary for security (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and used for internal operations and does not identify you.
We do not transfer Google user data to others, except as needed to provide or improve those user-facing features, for security, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.

Meta platform data

If you connect Instagram or Facebook, we receive the account identity, the permissions you grant, the content you ask us to publish (video, caption, cover and schedule), and insights Meta returns for that content. We use Meta platform data only to provide Shorts Poster: to show you the account you connected, to publish the Reels you scheduled, and to show you insights for those posts.

We do not sell Meta platform data. We do not use it to build advertising profiles, and we do not use it for purposes unrelated to the features you turned on.

You can disconnect Instagram or Facebook inside Shorts Poster, and you can remove Shorts Poster from your Facebook or Instagram settings (look for Apps and websites, or Business integrations). You can also ask us to delete the data, using the data deletion instructions. If Meta sends us a deletion request for your account, we handle it the same way.

TikTok data

If you connect TikTok, we receive the profile identity, the permissions you grant, the videos and captions you ask us to publish, and analytics TikTok returns for content published through Shorts Poster. We use that data only to provide those features to you.

We do not sell TikTok data, and we do not use it for advertising to other people. You can disconnect TikTok inside Shorts Poster, remove Shorts Poster from TikTok’s app permissions, and ask us to delete what we stored.

Other platforms

X posting is a paid add-on. LinkedIn, Pinterest and Threads are next. If we add a platform, we will update this policy before we ask you to connect it, and we will use the data from that connection only to provide the scheduling, publishing and analytics features you turn on. You will need to comply with that platform’s terms. See the terms of service.

How we use personal information

To create and administer your account, brands, seats and settings.
To store, schedule and publish content you (or an approver you appointed) told us to publish.
To show you analytics the platforms return for that content.
To take payment and keep tax records.
To reply to you, and to investigate abuse, fraud and security incidents.
To meet law, including Australian tax and privacy law, and a lawful request from a regulator or a platform.

We do not sell personal information. We do not use it to train foundation models. We do not use platform data for advertising.

Legal bases if the GDPR applies

Contract: providing the account and the publishing features you asked for.
Consent: connecting a social account, and any optional message you opt into. You can withdraw consent by disconnecting the account, unsubscribing, or writing to us. Withdrawal does not make earlier processing unlawful.
Legitimate interests: keeping the site and the application secure, preventing abuse, and understanding failures in our own logs. You can object. We will stop unless we have a compelling reason that overrides your interests, or we need the data for a legal claim.
Legal obligation: tax, accounting, and responding to a lawful request.

Who we disclose it to

We disclose personal information to the processors below, and to a platform when you instruct us to publish there. We do not authorise a processor to use the information for their own advertising.

Hosting. The website and the application run on a virtual private server we control, served by software such as Caddy or nginx. The server processes IP addresses and request logs in order to serve the site and resist abuse.
Cloudflare R2. Video files and related media you upload are stored in Cloudflare R2, provided by Cloudflare, Inc. Cloudflare’s privacy policy is at https://www.cloudflare.com/privacypolicy/.
Stripe. Stripe, Inc. processes card payments for paid plans. We receive your name, email, billing country, the last four digits of a card, and the status of a subscription. We do not receive the full card number. Stripe’s privacy policy is at https://stripe.com/privacy.
Platforms you connect. Google (YouTube), Meta (Instagram and Facebook) and TikTok receive the content you schedule, because publishing is the point of the connection. They handle that data under their own terms and privacy policies.

We will update this policy before we add another processor that handles personal information. We may also disclose information if the law requires it, to protect someone from serious harm, or if the business is sold, in which case the buyer will be bound by this policy or we will tell you about a replacement.

Overseas disclosure

Some recipients are outside Australia. Cloudflare, Stripe, Google, Meta and TikTok operate in the United States and in other countries. Our own server will be in the region we select when we deploy; email privacy@shortsposter.com if you need the country it is in today.

Where Australian Privacy Principle 8 applies, we take reasonable steps so that an overseas recipient handles personal information in line with the Australian Privacy Principles, usually through the provider’s data-processing terms. Where the GDPR requires a transfer tool, we use the provider’s standard contractual clauses or another mechanism the law allows. An overseas recipient may not be subject to the same privacy law as an Australian one. You can ask us for the safeguards that apply to a particular transfer.

Retention

Account profile: for the life of the account, then deleted from active systems within 30 days of account deletion. Backup copies are removed within 90 days.
OAuth tokens and platform data for a connection: deleted within 30 days of disconnection or account deletion. Backup copies within 90 days.
Uploaded media and scheduled posts: deleted from active storage within 30 days of you deleting the post or the account. Backup copies within 90 days.
Analytics we stored for a post: kept with that post, for no longer than the analytics history on your plan, and deleted with the account.
Server logs: up to 90 days.
Billing and tax records: generally five years after the transaction, or longer if a law requires it.
Support email: up to 24 months after the last message in the thread, unless we need it for a legal claim or a platform inquiry.

Deletion

You can ask us to delete personal information, or to disconnect a social account, by following the data deletion instructions. The short version: email privacy@shortsposter.com from the address on the account, say what you want removed, and we will complete the deletion within 30 days unless a law requires us to keep something.

Disconnecting a platform stops new access. It does not, by itself, delete files we already stored. Say so in the email if you want those deleted as well.

Cookies

This marketing site does not set tracking cookies, advertising cookies, or analytics cookies. It does not load a third-party font host, a Meta pixel, or Google Analytics. Fonts are files we serve ourselves.

When the application opens, a sign-in session will use a strictly necessary cookie so you stay signed in. That cookie is required to provide the account. We will not add a non-essential cookie without updating this section, and without asking where the law requires a choice.

You can block cookies in your browser. Blocking a future session cookie will stop you staying signed in. We do not respond to “Do Not Track” signals, because this site does not track you across other websites.

Security

We use HTTPS, access control, and encryption at rest for OAuth tokens. Access to personal information inside the company is limited to people who need it to operate the service. No method of transmission or storage is perfect. Please use a unique password for Shorts Poster when accounts open, and do not send us a social-network password. We will not ask for one.

If a breach is likely to result in serious harm, and the Privacy Act requires it, we will notify affected people and the Office of the Australian Information Commissioner.

Your rights in Australia

You can ask for access to the personal information we hold about you, and you can ask us to correct it if it is wrong, out of date, or misleading. Email privacy@shortsposter.com. We will respond within 30 days. We do not charge for an ordinary access request. If we refuse, we will tell you why, unless the law says we should not, and we will tell you how to complain.

Your rights in the EEA and the United Kingdom

You can ask to access, correct, erase, or restrict personal information, to receive a portable copy of information you provided, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. Email privacy@shortsposter.com. We have not appointed a representative in the EEA or the UK. You can also lodge a complaint with your local data protection authority.

Your rights in California

If the CCPA / CPRA applies to you, this section is the notice. In the last 12 months, depending on whether you only visit the site or also hold an account, we collect these categories: identifiers (such as name, email and IP address); commercial information (such as a subscription, once billing exists); internet or network activity (such as log data); audio and visual information (videos you upload); and professional information (brand and account names you give us).

We collect them from you, from your browser, from platforms you connect, and, once billing exists, from Stripe. We use them for the purposes in this policy. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We do not use sensitive personal information to infer characteristics about you.

You have the right to know, delete and correct personal information, and the right to opt out of sale or sharing (we do not sell or share). You will not be discriminated against for exercising these rights. Email privacy@shortsposter.com. We will verify the request by matching the email on the account. An authorised agent may write to us with proof of authority.

Children

Shorts Poster is not for children. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If you believe we have, email privacy@shortsposter.com and we will delete it.

Changes

We will post changes on this page and update the effective date. If a change is material and we have your email, we will also email you. The effective date of this version is 15 November 2026.

Contact and complaints

Privacy questions, access, correction and deletion: privacy@shortsposter.com