Privacy Policy

Service: Incubator · Operated by DeadBread
Effective date: 7 July 2026 · Last updated: 7 July 2026

This Privacy Policy explains what information the Incubator ("the Service", "we", "us") collects, how it is used, and the choices you have. The Incubator is a self-hosted tool that publishes content to social-media accounts that the operator owns or is authorized to manage, using each platform's official API.

1. Who operates the Service

The Incubator is operated by DeadBread. It is a self-hosted application; each deployment is run and controlled by its operator, who is the data controller for the accounts they connect. Contact: admin@deadbread.space.

2. Information we collect

• Authentication credentials for connected accounts. When you connect a social account, we store the access/refresh tokens (for OAuth platforms) or bot tokens (for platforms such as Telegram and Discord) needed to act on that account. These are provided by you or by the platform's authorization flow.
• Account identifiers. Public identifiers of the connected account, such as the username/handle, display name, and platform account id, retrieved via the platform API.
• Content you create. The posts, schedules, and content queues you enter in order to publish them.
• Operational logs. Minimal technical logs (timestamps, actions, errors) used to run and debug the Service. We do not log credential values.

We do not collect your social-account password. We request the minimum API permissions (scopes) necessary to publish content and read basic account identity.

3. How we use information

Information is used solely to operate the Service you asked for: authenticating to the platforms you connect, checking that a connection is healthy, and publishing the content you schedule to the accounts you connect. We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

4. Sharing and third parties

To publish content, the Service transmits your content and the relevant token to the platform you are posting to (for example TikTok, Telegram, Discord, Reddit, or other connected platforms). That processing is governed by each platform's own terms and privacy policy. We do not otherwise disclose your information except where required by law.

5. Storage and security

Connected-account tokens are encrypted at rest (AES-256-GCM) with a key held only in the operator's environment, never stored alongside the encrypted data. Tokens are transmitted only to the issuing platform over HTTPS and are never exposed in API responses or logs. Because the Service is self-hosted, the operator is responsible for the security of the server it runs on.

6. Data retention and deletion

Tokens and account data are retained only while an account remains connected. Disconnecting an account removes its stored credentials. Content and schedule records are retained until you delete them or the operator removes the deployment's data. To request deletion of data associated with your account, contact admin@deadbread.space.

7. Your choices and rights

You may disconnect any connected account at any time, which revokes the Service's stored access to it (you may also revoke access directly in the platform's own app settings). Depending on your jurisdiction, you may have rights to access, correct, or delete personal data; contact us to exercise them.

8. Platform-specific note (TikTok and others)

Where the Service integrates with a platform's developer API, we comply with that platform's developer terms and use platform data only as permitted by the scopes you grant. Platform data is used exclusively to provide the posting features you enable and is not repurposed.

9. Children

The Service is not directed to individuals under the age required to hold an account on the connected platforms, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy; material changes will be reflected by the "Last updated" date above.

11. Contact

admin@deadbread.space