Privacy Policy

Last updated 10 August 2026. yellit is a service of Parts Supplies and Services LLC.

yellit publishes video and images to social platforms on your behalf. You connect your accounts once; after that you can publish from a command-line tool or from this site. This policy describes exactly what that requires us to store.

What we collect

Only what publishing requires. There is no analytics SDK, no advertising pixel, and no third-party tracker on this site.

What we do not collect

• We do not read your existing posts, your comments, your direct messages, your followers, or your audience insights. The permissions we request are publishing permissions, and the app never calls a read endpoint for that content.
• We do not collect your platform password. Authentication happens on Meta's, Google's, and X's own consent screens; we only ever receive a token.
• We do not use cookies for tracking or advertising. The only cookie set is the session cookie that keeps you logged in.

How your media is handled

This is the part most worth being precise about.

When you publish a local file, yellit uploads it to a Cloudflare R2 bucket under a key prefix scoped to your account, gives the platforms that URL, and deletes the object once the post has been created. The upload exists because Instagram's publishing API fetches media server-side from an HTTPS URL — it does not accept a direct file upload. Keeping the object after publishing would serve no purpose and would slowly accumulate a public archive of everything anyone ever posted, so we delete it.

If you publish media that is already at a public URL, we pass that URL through and store no copy at all.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect your information. The most sensitive data yellit holds is the set of OAuth tokens that let it publish on your behalf. We treat those tokens, and the Google user data reached with them, as the highest-sensitivity records in the system. The specific security measures are set out below rather than left as a general assurance.

Encryption in transit

• Every connection to yellit is served over HTTPS. TLS is terminated at our hosting provider's edge, which serves the site on a managed certificate over TLS 1.2 or higher.
• Every call we make to Meta, Google, X, TikTok, and our own storage provider is made to an https:// endpoint. The application makes no unencrypted outbound request carrying user data.
• The application reaches its Postgres database over our hosting provider's private network rather than the public internet.

Encryption at rest

• OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, with a distinct random initialization vector per record and an authentication tag that makes undetected tampering fail closed.
• The encryption key is held only as a deploy-environment secret. It is never committed to source control, never present in a container image, and never sent to a third party.
• The underlying database and object storage volumes are additionally encrypted at rest by our infrastructure providers.

Access control

• Tokens are decrypted only in memory, only for the duration of a publish request you initiated, and are never returned to any client, API response, or web page.
• Every request is scoped to the authenticated account, so one user's connected accounts, media, and publish history are never readable by another user.
• Administrative access to the production database and secrets is limited to the operator named at the top of this page, protected by multi-factor authentication, and used only to keep the service running or to investigate a fault. We do not browse user content.
• A decrypted token is never written to a log, an error message, an exception report, or an analytics event — not even truncated.

Data minimization and retention

• We request the narrowest platform permissions that the publishing features require, and we store only the fields listed in the table above.
• Media staged for publishing is deleted from our storage as soon as the destination platforms have fetched it. Tokens are deleted immediately when you disconnect an account or delete your account.
• Deletion is a real delete of the stored record, not a hidden flag, and it removes the encrypted token rather than merely revoking our use of it.

Purpose limitation

• Tokens are used for exactly one thing: publishing the content you explicitly asked to publish, at the moment you ask for it. Nothing publishes on a schedule, and nothing publishes without an action you took.
• We do not use Google user data, or any other platform data, to train machine learning models, for advertising, or for any purpose other than providing the publishing feature you invoked.

Incident response

• If we become aware of a breach affecting your credentials or personal data, we will invalidate the affected tokens, require reconnection of the affected accounts, and notify affected users by email at the address on the account without undue delay, along with any regulator that applicable law requires us to inform.
• You can end our access yourself at any time and independently of us, by revoking yellit in your Google, Meta, X, or TikTok account settings. See your choices and rights below.

Compliance with Google API Services User Data Policy

yellit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

What we never do

• We do not sell, rent, or trade your personal data.
• We do not share your data with advertisers or data brokers, and we run no advertising.
• We do not use your content, captions, or media to train machine learning models, and we do not provide them to anyone else for that purpose.
• We do not post anything you did not ask us to post.

Who else sees your data

We use a small number of service providers, and only for the function described:

• Meta Platforms (Instagram), Google (YouTube), and X Corp. — the destinations you chose. We send them the content you asked us to publish. Once published, that content lives on their platform under their own privacy policy and terms.
• Cloudflare R2 — temporary media staging, as described above.
• Railway — runs the application and the Postgres database, in their US East region (Virginia, United States). Both Meta and Google ask where data is stored, so this is stated rather than left general.

We disclose data otherwise only where the law requires it.

Your choices and rights

• Disconnect one account at any time from your account page. Its tokens are deleted immediately, and yellit can no longer post to it.
• Delete your entire account at any time. This removes your email, every connected account and its tokens, and your entire publish history. See deleting your data.
• Revoke access at the source. You can also remove yellit's access from Instagram, Google, and X directly in each platform's own settings; this stops publishing immediately, independent of us.
• Depending on where you live, you may have rights to access, correct, export, or erase your personal data. Contact us and we will act on the request.

Deleting your account is irreversible. Already-published posts remain on Instagram, YouTube, and X — we cannot remove them for you, and you should delete those on the platform itself.

Children

yellit is not directed at children and is not intended for anyone under 13, or under the minimum age required by Instagram, YouTube, and X in your country, whichever is higher.

Changes to this policy

If we change what we collect or how we use it, we update this page and its "last updated" date. Material changes will also be sent to the email address on your account.

Contact

Questions, or a request about your data: support@useyellit.com