Privacy policy

We only collect what we need to run the service. Specifically:

• Account details. Your name and email address, and a bcrypt hash of your password if you set one. We never store the password itself.
• Sign-in with Google, GitHub or Apple. If you sign in with one of these, we receive your name, email address, whether the email is verified, and the provider's ID for your account. That is all. See the Google section below for details.
• Workspace content. Workspaces, profiles, team memberships, posts and drafts, schedules, uploaded media, webhook endpoints, and API key metadata. API keys are stored as peppered hashes.
• Connected social accounts. When you connect an account (for example X, LinkedIn, Bluesky, Telegram, Discord or Slack), we store the access tokens or credentials the platform gives us, encrypted with AES-256-GCM. We also store the account's handle and display name, the results of each publish attempt, and the analytics the platform returns for your posts and accounts.
• Billing. Payments are handled by Stripe. We never see or store your full card number. We keep your plan, subscription status and invoice records.
• Technical data. The IP address and browser user agent for each login session, IP addresses on audit log entries for sensitive actions, and per-key API usage counts used for rate limits and billing.
• Referral links. If you arrive through an affiliate link, we record the click using a one-way hash of your IP address and user agent so the same visitor isn't counted twice within 24 hours. The raw IP is not stored with the click.
• Support emails. Whatever you choose to send us.

• To create your account, sign you in, and keep your session secure.
• To publish, schedule and retry posts on the platforms you connected, and to show you their analytics.
• To enforce plan limits and rate limits, and to bill you.
• To send webhook events to the endpoints you configured.
• To detect abuse, investigate security incidents, and keep an audit trail of actions in your workspace.
• To answer support requests and send service notices (for example about billing or a security issue).
• To credit affiliates for the signups they referred.

We do not sell personal data, we do not use it for advertising, and we do not use your content or data from connected platforms to train AI or machine learning models. We don't run third-party analytics or ad trackers on the site.

If you choose "Sign in with Google", we request only the openid, email and profile scopes. From Google we receive your name, email address, whether that email is verified, and your Google account ID. We use this data only to create your Hapi account, sign you in, and link the Google login to an existing Hapi account with the same verified email. We don't request access to Gmail, Drive, Calendar, Contacts or any other Google data, and we don't keep Google access or refresh tokens after sign-in completes.

We do not share Google user data with third parties, except with the infrastructure providers listed below that store our database on our behalf, or when required by law. We do not use it for advertising and we do not sell it.

Hapi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Hapi's access at any time from your Google Account permissions page, and you can ask us to delete the data we received from Google by emailing support@hapi.tools.

We share data only with the services that run Hapi, and only what each one needs:

• Hosting and database (Railway): runs the app and stores the database and uploaded media.
• Payments (Stripe): processes payments and stores card details.
• Social platforms you connect: when you publish, the post content and media go to that platform, under that platform's own privacy policy.
• Your webhook endpoints: event payloads go to the URLs you configure.
• Sign-in providers (Google, GitHub, Apple): only to complete the sign-in you started.

We may also disclose data if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy keeps applying to the data that was transferred.

We use a few first-party cookies and no advertising cookies:

• hapi_session keeps you logged in, for up to 30 days.
• hapi_oauth_login is an encrypted, short-lived cookie that protects the Google, GitHub or Apple sign-in flow and is cleared when it finishes.
• hapi_ref remembers an affiliate referral for 60 days.
• hapi_country stores your country (from your request, not precise location) for 7 days so we can suggest a language.

Your theme preference (light or dark) is kept in your browser's local storage and never sent to us.

We keep account and workspace data while your account is active. Sessions expire after 30 days. If you disconnect a social account, we delete its stored tokens. When you ask us to delete your account, we delete your personal data and workspace content within 30 days, except records we must keep for legal, tax or accounting reasons (such as invoices), and backups, which roll off on their normal schedule.

Traffic is encrypted in transit with TLS. Platform tokens and credentials are encrypted at rest with AES-256-GCM and only decrypted on the server when they're used. Passwords are hashed with bcrypt, API keys and session tokens are stored as hashes, and every workspace's data is isolated from every other. No system is perfectly secure, so if you find a problem please report it to support@hapi.tools.

• Disconnect any social account from the Accounts page, which deletes its stored tokens.
• Revoke API keys at any time.
• Ask for a copy of your data, a correction, or deletion of your account by emailing support@hapi.tools from the address on your account.

Depending on where you live (for example the EU, UK or California), you may have additional rights, such as objecting to processing or complaining to your local data protection authority. We honor these requests regardless of where you are and will reply within 30 days.

Our service providers may process data in the United States and other countries. When data leaves your region, we rely on the safeguards those providers offer, such as standard contractual clauses.

Hapi is a developer tool and isn't meant for anyone under 16. We don't knowingly collect data from children. If you think a child has given us data, email support@hapi.tools and we'll delete it.

If we change this policy we'll update the date at the top, and for meaningful changes we'll tell account owners by email or in the dashboard before they take effect.

Hapi Labs, Inc.. Questions or requests about privacy go to support@hapi.tools.