Privacy Policy

Dual.am ("Dual.am", "we", "us") provides a social media scheduling tool that lets you connect accounts on Facebook, Instagram, X, LinkedIn, TikTok, and Telegram, and publish content to them at a scheduled time. This policy explains what we collect, why, and how you can control it.

1. Information we collect

We collect only what the product needs to function:

• Account information: your name and email address when you register.
• Workspace data: the workspace names you create and which team members belong to them.
• Connected platform credentials: OAuth access and refresh tokens for the Pages, profiles, or channels you explicitly connect, and — for Telegram — the bot token and chat ID you provide.
• Content you create: post text, media URLs, scheduling times, and the publish status and any error returned by each platform.
• Basic technical logs: standard web server and queue logs used for debugging, kept only as long as needed to operate the service.

2. How we use platform data

Access tokens obtained through Facebook, Instagram, X, LinkedIn, or TikTok are used for exactly one purpose: publishing the posts you compose and schedule to the account you authorized, at the time you chose. We do not use these tokens to read your feed, message your contacts, run analytics on your audience, or share data with advertisers. We do not sell platform data, and we do not use it to train machine learning models.

3. Storage and security

All access tokens and bot credentials are encrypted at rest and are never displayed back to you or any other user after they're saved. Only the background job that publishes your scheduled post decrypts a token, and only at the moment it's needed.

4. Data isolation between workspaces

Every workspace's accounts, posts, and connections are isolated from every other workspace on Dual.am, including workspaces belonging to the same user. Content and credentials in one workspace are never visible from another.

5. Data retention and deletion

We retain your data for as long as your account is active. Disconnecting a social account removes its stored access token immediately. You can request full deletion of your account and all associated workspace data at any time by contacting us — see Section 8.

6. Third-party platforms

When you connect an account, the platform itself (Meta, X, LinkedIn, TikTok, or Telegram) governs how it handles the authorization you grant — review their own privacy policies for details on their side of that relationship. Revoking Dual.am's access from within that platform's own settings will stop us from publishing to it, even if the connection still shows in Dual.am until you also remove it here.

7. Cookies and sessions

We use a session cookie to keep you signed in and a CSRF token to protect form submissions. We do not use third-party advertising or tracking cookies.

8. Contact

Questions about this policy, or requests to access or delete your data, can be sent to [email protected].

9. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page. Continued use of Dual.am after a change means you accept the revised policy.