Skip to main content
Publish MCP

Privacy

Publish MCP (publishmcp.com) lets you connect your own accounts on YouTube, Instagram, Facebook Page, Threads, TikTok, X, LinkedIn, Pinterest, Bluesky and Mastodon and publish to them from an AI agent. This page explains what we store and why.

What we store

  • Your Google account id and email address, used to sign you in and to identify you if you ask for account deletion.
  • The portfolio names you create.
  • For each social account you connect: the account id, name and username, and its access and refresh tokens. Tokens are encrypted with AES-256-GCM, are never shown to your AI agent and are never written to logs.
  • Identifiers and status of posts made through Publish MCP. For carousel posts the caption text is also kept in the post record's metadata.
  • Media you upload through your agent for any platform other than YouTube is held temporarily in a private store, only so the platform can fetch it. It is deleted when the post finishes or fails, and an automatic purge removes anything left after about 25 hours.
  • YouTube video files go from your agent directly to YouTube. They do not pass through or get stored on our servers.

What we use it for

We use this data to sign you in, to keep your connections working, and to publish what you or your connected agent ask us to publish. We do not sell your data, do not show ads and do not use your data to train AI or machine-learning models. We share it with nobody except the platforms you publish to and Cloudflare, which hosts the service.

Retention and deletion

  • Tokens and connection records are deleted when you disconnect an account, delete a portfolio or delete your account, and when Meta sends us a deauthorize or data-deletion callback.
  • Post records are kept until you delete the portfolio or your account.
  • Temporary media is deleted as described above.

See data deletion for the steps.

Google user data

Publish MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access: your Google account identifier, email and name (for sign-in and to label the connected YouTube account) and the permission to upload videos you ask your agent to upload (scope youtube.upload only; we do not read your channel, videos, playlists, comments or analytics).

How we use it: only to provide and improve these user-facing features inside Publish MCP. We do not use Google user data for advertising, including retargeting or interest-based ads. We do not sell it. We do not transfer it to anyone except as needed to provide the service, to comply with law, or as part of a merger, with your consent where required. Humans do not read it unless you ask for support and agree, it is necessary for security or abuse investigation, or the law requires it. We do not use it to develop, improve or train generalised AI or machine-learning models.

How we store it: your Google tokens are stored encrypted (AES-256-GCM) and are never shown to your AI agent. Video files go from your agent directly to YouTube and are not stored by us. We store only the identifiers and status of uploads.

Your control: disconnect your YouTube channel in the app at any time (this deletes the stored tokens and revokes access at Google), or delete your portfolio or account. You can also revoke access at https://myaccount.google.com/permissions. See the data deletion page for account deletion.

YouTube: by using the YouTube features you are also bound by the YouTube Terms of Service and the Google Privacy Policy.

How we protect Google and YouTube data

  • Tokens are encrypted at rest with AES-256-GCM. The key is held only as a Cloudflare Worker secret, never in code or in the database.
  • All traffic uses TLS (HTTPS only).
  • Access is limited to the service itself. No staff browse tokens, and tokens are never shown to AI agents or written to logs.
  • We do not sell Google or YouTube data and do not share it with third parties, except Cloudflare as hosting and the platform you publish to.
  • We do not use YouTube or Google data to train AI or machine-learning models.
  • Retention: tokens and connection records are kept only while the account is connected. They are deleted immediately when you disconnect (the token is revoked at Google), when you delete a portfolio or your account, or on request via the data deletion page.
  • We follow the Google API Services User Data Policy, including the Limited Use requirements stated above.

Meta data (Instagram, Facebook Page, Threads)

  • Instagram: we read your professional account's id, name and username when you connect, and store its access token (encrypted). We use it to publish the posts you confirm.
  • Facebook Page: we read the list of Pages you manage so you can pick one, and store the chosen Page's id and name and its token (encrypted). We use it to publish posts to that Page.
  • Threads: we read your Threads account id and username when you connect, and store its token (encrypted). We use it to publish the posts you confirm.

We do not read your feed, messages, followers or comments. If you remove Publish MCP in your Meta or Threads settings, Meta calls our deauthorize callback and we delete the connections linked to that account. Meta's data-deletion callback does the same and returns a confirmation code. See data deletion.

TikTok data

When you connect TikTok we read your open id, display name and profile picture, and store the tokens (encrypted). We use the tokens only to post the videos you confirm on the TikTok posting page. We do not read your videos, messages, followers or comments. Disconnecting removes the tokens and revokes them with TikTok.

Contact

Questions or requests: hello@pingappslab.com.