Privacy Policy

Last updated: March 18, 2026

1. Information We Collect

When you use Pomelo, we collect:

  • Account information: name, email address, and password (hashed)
  • Social media tokens: OAuth access and refresh tokens for connected platforms, stored encrypted
  • Content data: posts, media URLs, and publishing metadata you create through the Service
  • Usage data: API key usage, audit logs, and basic request information

2. How We Use Your Information

We use your information to:

  • Provide and maintain the Service
  • Connect to and publish content on your social media accounts
  • Authenticate your identity and secure your account
  • Monitor for abuse and enforce our Terms of Service

3. Data Storage and Security

All social media tokens are encrypted at rest using AES-256-GCM encryption. API keys are stored as cryptographic hashes with an encrypted copy for user retrieval. Passwords are hashed using bcrypt. We take reasonable measures to protect your data, but no method of transmission or storage is 100% secure.

4. Third-Party Services

Pomelo connects to third-party social media platforms on your behalf. When you connect an account, we store the authentication tokens needed to act on your behalf. We only access your accounts to perform actions you explicitly request (such as publishing content). Each platform has its own privacy policy that governs how they handle your data.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties, except:

  • When required by law or legal process
  • To protect the rights, property, or safety of Pomelo, our users, or others
  • With your explicit consent

6. Data Retention and Deletion

We retain your data for as long as your account is active. You may disconnect social media accounts at any time, which removes the stored tokens. You may request deletion of your account and all associated data by contacting us.

7. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and data
  • Disconnect any social media account at any time
  • Revoke API keys at any time

8. Contact

For questions about this Privacy Policy, contact us at support@semseospecialist.com.