One API to publish, engage, and respond across every social platform

Mallary ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, application, and services (collectively, the "Service"). The Service allows users to connect their social media accounts, schedule and post content, view analytics and audience growth, and use Mallary through its dashboard, API, and integrations.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Eligibility

Our Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

2. Information We Collect

a. Information You Provide to Us

Account Creation: When you create an account using Google Sign-In, we collect your name and email address provided by Google.
Social Media Connections: When you connect a social media account, we receive the account details and permissions that you approve. This may include an account ID, display name, username, profile image, and access token. The access token lets Mallary perform the actions you approve, such as posting content or reading account statistics. We do not receive or store your social media password.
Social Media Audience Data: If you approve this access, we read the follower or subscriber count from your connected social media account. For TikTok, Mallary uses the user.info.stats permission to read your follower count. We save a new count about once each day so you can see your current audience and growth over time. We may show this data in your dashboard, weekly report, and authenticated Audience API. We do not use this permission to change or delete your TikTok content.
Posted Content and History: We store records of the content you post through our Service, the destination (connected social media accounts), timestamps, and status (e.g., successful or failed) to display your posting history in your dashboard.
Connected Apps and AI Tools: When you connect Mallary to an approved app or AI tool, we process the permissions you approve. We return only the Mallary data needed for the action you request, such as posts, comments, analytics, profile settings, or publishing results. We do not give the connected app your Mallary password, social media access tokens, API keys, or payment details.
Images and Videos from ChatGPT: When you ask ChatGPT to upload an image or video to Mallary, ChatGPT gives Mallary a short-lived link to that file. Mallary downloads the file, checks its type, and stores it with our media provider. It receives a public files.mallary.ai URL. Anyone with that URL can view the file, even if you have not posted it to a social account. We do not save the short-lived OpenAI link or OpenAI file ID in your post record.

b. Information Collected Automatically

We use PostHog for analytics to understand how users interact with our Service. This may include usage data such as page views, features used, device information, IP address, and browser type. PostHog may collect this data anonymously or pseudonymously where possible.

When you use the Mallary API, MCP server, CLI, or an integration, we may record the client or AI tool name, version, request channel, and basic request results. For example, this can tell us that a request came from OpenClaw, Hermes, Claude, n8n, Make, or the Mallary CLI. We use this information to understand usage, fix problems, and keep the Service safe. These client-usage records do not include your prompts, post text, uploaded files, passwords, API keys, or access tokens.

We also use Google Ads, Google Tag Manager, and related Google advertising technologies to measure the effectiveness of our advertising and understand how visitors interact with Mallary after clicking an ad. These technologies may use cookies, pixels, tags, ad click identifiers, or similar technologies to help us measure events such as account creation, connecting a social media platform, and subscription activity.

We do not intentionally send Google sensitive personal information, social media access tokens, social media account credentials, private posted content, payment card details, or platform authorization secrets through our advertising tags.

c. Payment Information

We use Stripe to process payments for premium features or subscriptions. We do not collect or store your payment card details or other sensitive payment information. All payment processing is handled securely by Stripe.

d. Data You Must Not Send Through the ChatGPT Plugin

The Mallary ChatGPT plugin is made for social post text and approved social media images and videos. Do not use it to send payment card data, health records, government ID numbers, biometric records, account passwords, access tokens, API keys, or private customer files. Mallary may block a request when it finds this kind of data.

3. How We Use Your Information

We use the collected information to:

Provide and maintain the Service, including enabling social media posting and displaying your dashboard.
Show your current follower or subscriber counts and how your audience changes over time.
Complete actions you request through connected apps, AI tools, the Mallary API, or the Mallary MCP server.
Store an image you chose or made in ChatGPT so it can be used in the social post you requested.
Process payments and manage subscriptions.
Improve the Service, troubleshoot issues, and perform analytics.
Detect, prevent, and investigate spam, abuse, policy violations, platform-risk activity, security incidents, and excessive or unauthorized use of the Service.
Measure the effectiveness of our advertising, attribute signups and activation events to advertising campaigns, and improve our marketing.
Communicate with you, including sending service-related emails (e.g., posting confirmations, account updates).
Comply with legal obligations.

4. How We Share Your Information

We do not sell, rent, or share your personal information with third parties for their independent marketing purposes. We may share information with:

Trusted Service Providers:
- Google (for authentication and providing name/email during sign-in).
- Google Ads and Google Tag Manager (for advertising measurement, conversion tracking, and campaign performance reporting).
- Social media platforms (to complete actions you approve, such as posting content or reading account statistics).
- Connected apps and AI tool providers, including OpenAI, when you choose to connect them and request that they read Mallary data or perform an action.
- Cloudflare R2 and the Mallary media domain at files.mallary.ai (for storing and serving the social media images and videos you upload).
- PostHog (analytics data).
- Stripe (payment-related information, but not card details).
- Email service providers (e.g., for sending transactional emails).
Legal Requirements: If required by law, such as to comply with a subpoena or similar legal process.
Business Transfers: In connection with a merger, acquisition, or sale of assets.

Third-party providers are permitted to use your information only for the services they provide to us and in accordance with their applicable terms, privacy policies, and data protection obligations.

5. Cookies and Similar Technologies

We and our service providers may use cookies, local storage, pixels, tags, and similar technologies to operate the Service, remember preferences, perform analytics, measure advertising performance, and detect or prevent abuse. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

You may also manage certain Google advertising preferences through Google's advertising controls.

6. Data Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction. This includes encryption where appropriate and secure access controls. However, no method of transmission over the internet or electronic storage is 100% secure.

7. Your Data Rights

Depending on your location, you may have rights to access, correct, delete, or restrict the use of your personal information. To exercise these rights, contact us at [email protected]. We will respond within a reasonable timeframe.

You can also revoke access to connected social media accounts at any time through your account settings or the respective social media platform.

Disconnecting a social media account in Mallary stops Mallary from collecting new audience counts for that connection.

8. Data Retention

We retain your personal information only as long as necessary for the purposes described in this policy, or as required by law. Posting history may be retained for dashboard functionality unless you request deletion.

OAuth grants for connected apps are retained while the connection is active. You can revoke a connection at any time. We may retain limited security and audit records after revocation to prevent abuse and investigate incidents.

We may keep past follower or subscriber count snapshots while your Mallary account is active so you can see audience growth over time. You may ask us to delete this history.

Images and videos uploaded for social posts may be kept while your account and posting history need them. You may ask us to delete them. Short-lived ChatGPT download links and OpenAI file IDs are used only to copy the file during the request and are not stored in the post record.

9. International Data Transfers

Your information may be processed in the United States or other countries where our service providers operate. We use appropriate safeguards for such transfers.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the "Last Updated" date. Continued use of the Service constitutes acceptance of the changes.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].