Application policy

Privacy policy

Last updated: 3 November 2026

Agent Social Publisher is a local publishing tool operated by Marc Oliveau for his own brands and authorized collaborators. This policy explains the current tool and this information website.

Data the tool handles

• Account identity and authorization. Brand aliases, platform usernames or channel IDs, OAuth access and refresh tokens, granted scopes, expiry times and applicable developer-app credentials.
• Media and copy you select. Local video or image files, captions, thumbnails, titles, descriptions, tags, subtitle files, comments and other publishing settings.
• Data read from a platform on request. Authorized account identity, video metadata and publication status; and, when the relevant management command is used, playlists, captions, comments or statistics. For YouTube, the tool uses YouTube API Services.
• Operational records. File paths and hashes, requested operations, upload progress, resource IDs, permalinks and returned status or disclosure observations. These support resuming interrupted tasks and detecting earlier submissions.

Google authorization currently requests the YouTube permission used to view and manage videos, captions, playlists and comments. The CLI uses that grant only for the publishing and management commands the operator runs. It does not request Gmail, contacts, payment details or a Google account password.

Purpose and sharing

The data is used to select and verify the intended account, carry out the requested publishing or account-management action, check the result and avoid repeating an uncertain submission. Platform actions use official APIs. Selected media is sent to the destination platform; Instagram's URL-fetch workflow uses the temporary media transport described below.

The publisher itself has no advertising, data-broker, analytics or model-training integration. Information received from Google APIs is used for the requested publishing and channel-management functions, subject to the Google API Services User Data Policy, including its Limited Use requirements. Google's own handling of data is described in the Google Privacy Policy.

Commands display account information and results to the operator. If an authorized collaborator or AI assistant runs the tools, or the operator saves command output in another application, that person or application may receive the displayed information under the operator's chosen workspace settings and that application's policies. The tool does not control those external applications or their retention settings.

Temporary Instagram media transport

To let Instagram fetch a selected local video, the tool can copy that one approved file into a private temporary snapshot and serve it through a Cloudflare Quick Tunnel. The snapshot's SHA256 is checked before exposure. Cloudflare carries the temporary HTTPS connection and media traffic; social-platform OAuth tokens are not sent through this staging route.

The source URL has an unguessable path and acts as a bearer secret: anyone holding the complete URL can fetch the single file while the source is active. It is not an account login or a public directory. Only that snapshot is available, including byte-range reads; other workspace files are not served.

The staging context remains open while Instagram fetches and processes the video, then closes when preparation reaches FINISHED. It also closes on failure, context exit or the configured lifetime limit. Cleanup stops the helper's own tunnel and local server and removes its temporary snapshot; it does not remove a copy already fetched by Instagram.

The helper disables its local request logs, captures and discards tunnel output, and does not persist the source URL or tunnel logs in its publication records. These controls do not determine Cloudflare's own logging or retention. Cloudflare Quick Tunnels are development/test infrastructure with no SLA, not a permanent media-hosting service.

Local storage and safeguards

Credentials and resumable upload URLs are stored in protected local files. New credential files use owner-only filesystem permissions; they are not encrypted by the tool itself. Platform requests use HTTPS. Secrets are redacted from normal command output and are not intentionally written to the publication ledgers.

Original media stays in the folders chosen by the operator. The tool also writes local drafts, upload state and append-only delivery records. It does not operate a central publishing database or copy this workspace to a third-party scheduler. Device security, backups, shared folders and access granted to assistants remain under the operator's control.

Retention and local removal

The current version retains local credentials and operational records until they are removed by the operator; it does not run an automatic expiry or deletion worker. Some records contain platform-returned status data and identifiers. The operator is responsible for reviewing, refreshing or removing retained API data as required by the platform's rules.

To request removal of data associated with an account, email marc.oliveau@gmail.com with the platform and account identifier. Do not send passwords, tokens or authorization codes. Local removal is handled manually and may include credentials, upload state, saved API results and associated delivery records. Work for that account must be stopped and any uncertain publication reconciled before related task history is discarded.

Local deletion does not remove a video, Reel, post, comment or other data already held by a platform. Manage or delete that content through the platform's own applications or an explicitly authorized supported management action. Backups or copies made outside the tool need separate removal.

Revoke account access

You can revoke this application's Google access through Google Account connections. Other platforms provide their own connected-app settings. Revocation stops the authorization from being used for future requests; it does not automatically erase the local files or remote posts. Request local cleanup separately using the contact below.

This website

These pages are static. They contain no login forms, upload controls, analytics scripts, advertising, external fonts or embedded media, and they do not set tracking cookies. The server or hosting provider serving the pages may receive normal connection details such as an IP address, requested URL and user agent. Visiting this website does not grant access to a social account.