Privacy Policy

Mallary ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, application, and services (collectively, the "Service"). The Service allows users to connect their social media accounts, schedule and post content, view analytics and audience growth, and use Mallary through its dashboard, API, and integrations.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Eligibility

Our Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

2. Information We Collect

a. Information You Provide to Us

• Account Creation: When you create an account using Google Sign-In, we collect your name and email address provided by Google.
• Social Media Connections: When you connect a social media account, we receive the account details and permissions that you approve. This may include an account ID, display name, username, profile image, and access token. The access token lets Mallary perform the actions you approve, such as posting content or reading account statistics. We do not receive or store your social media password.
• Social Media Audience Data: If you approve this access, we read the follower or subscriber count from your connected social media account. For TikTok, Mallary uses the user.info.stats permission to read your follower count. We save a new count about once each day so you can see your current audience and growth over time. We may show this data in your dashboard, weekly report, and authenticated Audience API. We do not use this permission to change or delete your TikTok content.
• Posted Content and History: We store records of the content you post through our Service, the destination (connected social media accounts), timestamps, and status (e.g., successful or failed) to display your posting history in your dashboard.
• Connected Apps and AI Tools: When you connect Mallary to an approved app or AI tool, we process the permissions you approve. We return only the Mallary data needed for the action you request, such as posts, comments, analytics, profile settings, or publishing results. We do not give the connected app your Mallary password, social media access tokens, API keys, or payment details.
• Images and Videos from ChatGPT: When you ask ChatGPT to upload an image or video to Mallary, ChatGPT gives Mallary a short-lived link to that file. Mallary downloads the file, checks its type, and stores it with our media provider. It receives a public files.mallary.ai URL. Anyone with that URL can view the file, even if you have not posted it to a social account. We do not save the short-lived OpenAI link or OpenAI file ID in your post record.

b. Information Collected Automatically

We use PostHog for analytics to understand how users interact with our Service. This may include usage data such as page views, features used, device information, IP address, and browser type. PostHog may collect this data anonymously or pseudonymously where possible.

When you use the Mallary API, MCP server, CLI, or an integration, we may record the client or AI tool name, version, request channel, and basic request results. For example, this can tell us that a request came from OpenClaw, Hermes, Claude, n8n, Make, or the Mallary CLI. We use this information to understand usage, fix problems, and keep the Service safe. These client-usage records do not include your prompts, post text, uploaded files, passwords, API keys, or access tokens.

We also use Google Ads, Google Tag Manager, and related Google advertising technologies to measure the effectiveness of our advertising and understand how visitors interact with Mallary after clicking an ad. These technologies may use cookies, pixels, tags, ad click identifiers, or similar technologies to help us measure events such as account creation, connecting a social media platform, and subscription activity.

We do not intentionally send Google sensitive personal information, social media access tokens, social media account credentials, private posted content, payment card details, or platform authorization secrets through our advertising tags.

c. Payment Information

We use Stripe to process payments for premium features or subscriptions. We do not collect or store your payment card details or other sensitive payment information. All payment processing is handled securely by Stripe.

d. Data You Must Not Send Through the ChatGPT Plugin

The Mallary ChatGPT plugin is made for social post text and approved social media images and videos. Do not use it to send payment card data, health records, government ID numbers, biometric records, account passwords, access tokens, API keys, or private customer files. Mallary may block a request when it finds this kind of data.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain the Service, including enabling social media posting and displaying your dashboard.
• Show your current follower or subscriber counts and how your audience changes over time.
• Complete actions you request through connected apps, AI tools, the Mallary API, or the Mallary MCP server.
• Store an image you chose or made in ChatGPT so it can be used in the social post you requested.
• Process payments and manage subscriptions.
• Improve the Service, troubleshoot issues, and perform analytics.
• Detect, prevent, and investigate spam, abuse, policy violations, platform-risk activity, security incidents, and excessive or unauthorized use of the Service.
• Measure the effectiveness of our advertising, attribute signups and activation events to advertising campaigns, and improve our marketing.
• Communicate with you, including sending service-related emails (e.g., posting confirmations, account updates).
• Comply with legal obligations.

4. How We Share Your Information

We do not sell, rent, or share your personal information with third parties for their independent marketing purposes. We may share information with:

• Trusted Service Providers:
  • Google (for sign-in, YouTube features, Google Ads, Google Tag Manager, conversion tracking, and campaign reporting).
  • Social media providers, including Meta services such as Facebook, Instagram, and Threads; X; Microsoft LinkedIn; Google YouTube; TikTok; Pinterest; Reddit; and Bluesky (to complete actions you approve, such as publishing content, reading comments, or reading account statistics).
  • Connected apps and AI tool providers, including Meta Muse and OpenAI, when you connect them and ask them to read Mallary data or perform an action. OpenAI also processes the content needed to create an AI auto reply when you turn on that feature.
  • Cloudflare (for edge security, traffic delivery, Cloudflare R2 media storage, and serving media from files.mallary.ai).
  • DigitalOcean (for application, API, and database hosting).
  • PostHog and DataFast (for limited product and connector usage analytics).
  • Sentry, operated by Functional Software, Inc. (for error monitoring; default personal-information collection is turned off).
  • Stripe (for payment and subscription processing; Mallary does not receive or store payment card details).
  • Plunk (for transactional and service-related email).
• Legal Requirements: If required by law, such as to comply with a subpoena or similar legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

Third-party providers are permitted to use your information only for the services they provide to us and in accordance with their applicable terms, privacy policies, and data protection obligations.

5. YouTube API Services and Google Data

Mallary uses YouTube API Services. When you connect a YouTube channel, you authorize Mallary to access and process the YouTube data allowed by the permissions you approve. Depending on the features you use, this may include your channel ID, channel name, profile image, OAuth access and refresh tokens, approved scopes, subscriber count, video IDs and metadata, video statistics, playlist information, comments, and replies.

We use this data to connect the YouTube channel you choose, publish or schedule videos and Shorts, set video details and thumbnails, add videos to playlists, show analytics and audience information, and read or reply to comments when you request those features. We store connection details, publishing records, YouTube identifiers, analytics or audience snapshots, and records of supported comment actions only as needed to provide, secure, and support these features. When you ask an app or AI tool that you connected to Mallary to perform an action, Mallary may return the YouTube data needed to complete that request. We do not share YouTube API data for another company's independent advertising or marketing.

Your use of YouTube through Mallary is also subject to the YouTube Terms of Service. You can learn how Google handles information in the Google Privacy Policy. Mallary's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect YouTube from the Platforms area in Mallary. This removes the saved YouTube connection and stops Mallary from collecting new YouTube data for it. You can also revoke Mallary's access from your Google security settings.

To ask us to delete YouTube API data stored by Mallary, email [email protected]. We will delete the authorized YouTube API data connected to a valid request or revoked connection as soon as possible and within seven calendar days. We may keep limited Mallary security and audit records that do not contain authorized YouTube API data when needed for legal or security purposes. Deleting data from Mallary does not delete videos, comments, or other information stored by YouTube. To delete information from YouTube, use YouTube or another authorized service that supports deletion.

6. Cookies and Similar Technologies

We and our service providers may use cookies, local storage, pixels, tags, and similar technologies to operate the Service, remember preferences, perform analytics, measure advertising performance, and detect or prevent abuse. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

You may also manage certain Google advertising preferences through Google's advertising controls.

7. Data Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction. This includes encryption where appropriate and secure access controls. However, no method of transmission over the internet or electronic storage is 100% secure.

8. Your Data Rights

Depending on your location, you may have rights to access, correct, delete, or restrict the use of your personal information. To exercise these rights, contact us at [email protected]. We will respond within a reasonable timeframe.

You can also revoke access to connected social media accounts at any time through your account settings or the respective social media platform.

Disconnecting a social media account in Mallary stops Mallary from collecting new audience counts for that connection.

9. Data Retention

We retain your personal information only as long as necessary for the purposes described in this policy, or as required by law. Posting history may be retained for dashboard functionality unless you request deletion.

OAuth grants for connected apps are retained while the connection is active. You can revoke a connection at any time. We may retain limited security and audit records after revocation to prevent abuse and investigate incidents.

We may keep past follower or subscriber count snapshots while your Mallary account is active so you can see audience growth over time. You may ask us to delete this history.

Images and videos uploaded for social posts may be kept while your account and posting history need them. You may ask us to delete them. Short-lived ChatGPT download links and OpenAI file IDs are used only to copy the file during the request and are not stored in the post record.

Operational API, MCP, and CLI request metrics are kept on a rolling schedule for no more than 12 months. The current default is 30 days. OAuth security audit events are normally kept for up to 180 days, and revoked OAuth grants are normally kept for up to 90 days. We may keep limited records longer when required by law or needed to investigate abuse or a security incident.

10. International Data Transfers

Your information may be processed in the United States or other countries where our service providers operate. We use appropriate safeguards for such transfers.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the "Last Updated" date. Continued use of the Service constitutes acceptance of the changes.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].