Privacy Policy

Draft pilot version — reflects how Nerd Post is actually built. Last reviewed: 2026-10-20.

Pending business details: Charlie’s Nerds has not yet confirmed its legal entity name, support / privacy contact mailbox, business address. This policy will be updated before general availability. Until then, use the support form or the data deletion form to reach us.

Who we are

Nerd Post is operated by Charlie’s Nerds. Privacy requests can be made through our data deletion form or support form.

What Nerd Post is

Nerd Post connects a business’s social media accounts and publishes posts that an authorized person at that business has approved. It does not generate content, read inboxes, or run advertising.

Information we collect and why

Staff account information for Charlie’s Nerds administrators: name, email address, and a salted password hash. Client businesses’ staff do not have Nerd Post accounts.
Approver identity supplied by your website: when your authorized person approves something, your website’s server sends Nerd Post an identifier, optional name and role for that person, plus a digital signature. We store these with the approval and in the audit history to show who approved what. Nerd Post does not independently verify that person’s identity; your website does.
Business information entered by Nerds: business name, authorized return URLs, status, usage limits. Purpose: operating the service.
Platform connection data when you connect an account: the platform’s user identifier and display name, the list of Pages/accounts you can access, which permissions were granted or declined, and OAuth access/refresh tokens. Purpose: to publish only what you approve. Tokens are encrypted before storage and are never shown to your website, browser or automation tools.
Post content you submit: text, a link to media, destination account, and chosen options. Purpose: review, approval and publishing. We store the link to your media, not the media file itself.
Approvals and results: who approved which exact version and when, the platform’s response identifiers, live link when available, and sanitized error messages.
Audit and usage records: sign-ins, connections, approvals, administrative actions, and counts of requests and publishing attempts per business. Purpose: security, support and fair-use limits.
Form submissions: what you type into our support, pilot-access and data-deletion forms. To limit abuse, we count form submissions per visitor using a one-way hash of the network address; the address itself is not stored by the application.
Cookies: an essential session cookie for signed-in Nerds staff, and a short-lived (10 minute) cookie that ties an in-progress platform sign-in to the browser that started it. We do not use advertising or analytics cookies.

Who processes data

Vercel hosts the application and its servers.
Neon (provisioned through Vercel) hosts the database.
Meta (Facebook, Instagram) and TikTok receive the content you approve and the requests needed to authorize and publish, under their own terms and privacy policies.

We do not sell personal information and do not share it with advertisers.

Retention

Charlie’s Nerds has not yet set fixed retention periods. No automatic deletion schedule is currently implemented. Data is kept while a business participates in the pilot and until a deletion request is reviewed and approved. Platform tokens are deleted immediately when an account is disconnected. Audit records may be retained to demonstrate who approved what.

Your choices: revocation and deletion

Disconnect any account at any time from your website dashboard. Future sends stop immediately, stored tokens are deleted, and we ask the platform to revoke access where it supports that.
Remove access on the platform (for example in Facebook or TikTok settings). Nerd Post then treats the connection as revoked and stops sending.
Request deletion of your data at /data-deletion. Requests are reviewed by a person; we do not delete client data automatically without approval.

Security

Tokens are encrypted with AES-256-GCM, connections use HTTPS, and each business can only access its own records. No system is perfectly secure.

Children

Nerd Post is for businesses and is not directed to children.

Changes

We will update this page when the service changes and note the date above.