Privacy policy

Your email address. You sign in with a link we email you. Your address identifies your workspace and is where sign-in links go.

The social accounts you connect. When you connect Instagram, a Facebook Page or TikTok, the platform gives us an access token for that account. We keep the token with the account's id and its username, Page name or TikTok display name. We use the token only to do what you ask in Okay Otto.

What you post. The photos and videos you upload, your captions, each platform's version of them, when you scheduled them, and what each platform reported back (whether it posted, a link to the post, or the reason it didn't).

API keys. If you create a key for the API or Claude, we store only a fingerprint of it (a SHA-256 hash), never the key itself.

We do not use analytics, advertising or tracking scripts. The only cookies are the one that keeps you signed in and two short-lived ones that protect the moment you connect an account.

We use it only to run Okay Otto for you: to sign you in, show your accounts and posts, prepare each platform's version, publish when you press Post or at the time you chose, and show you the result. A TikTok profile picture is shown on the posting screen and not stored.

We never post anything you didn't ask for. Posts created through the API or Claude wait for your okay in the app. We never sell your data, use it for advertising, or share it with anyone except the services below that run the app.

Instagram (Instagram API with Instagram Login): your account's basic profile, permission to publish the posts you send, and to manage comments on them (used to post a first comment you wrote).

Facebook (Facebook Login): the list of Pages you manage, permission to publish to the Page you choose, and to read that Page's basic details.

TikTok (Login Kit and Content Posting API): your basic profile (display name and avatar), and permission to upload and publish the posts you send. Before each TikTok post we ask TikTok for your account's current settings, such as who can see your posts and the longest video you can post.

We read nothing else from your accounts: not your messages, followers' data, or other people's posts.

• Supabase: sign-in.
• Cloudflare: the database, media storage (served from media.okayotto.com, where the platforms fetch your posts) and sign-in email.
• Vercel: hosting the app.
• Anthropic: only when you press “Draft a version for each platform”, your caption and brand name are sent to Claude to write the drafts. Nothing else is sent.
• Instagram, Facebook and TikTok: your posts go to them when you publish.

We keep your data while your workspace is active. Disconnecting an account on the Accounts page deletes its access token at once. You can delete your whole workspace yourself at any time; Delete your data says how.

You can ask us for a copy of your data, to correct it, or to delete it, by emailing hello@okayotto.com from the address you sign in with. You can also remove Okay Otto's access at any time from Instagram, Facebook or TikTok's own settings.

Okay Otto is not meant for anyone under 18.

If we change this policy, we will update this page and the date at the top, and email you about any change that matters.