Privacy Policy

Broadside is a writing and publishing tool that lets users create content, upload media, manage team workspaces, connect social media accounts, and publish posts to third-party platforms including LinkedIn, X, Bluesky, Threads, Instagram, Mastodon, GitHub, and Pinterest.

Broadside collects the following categories of information:

Information you provide directly

• Account information, such as your name, email address, and password.
• Profile and workspace information, such as your team name and team membership.
• Content you create in Broadside, including drafts, post text, rich text content, uploaded media, and media alt text.
• Information you provide when connecting third-party social media accounts.
• Mention handle groups you configure, including the per-platform handles you save for reuse when publishing.
• Email addresses of people you invite to your team.
• Communications you send to Broadside, including support requests or other correspondence.

Information collected automatically

• Session information used to keep you signed in.
• Device and network information associated with your sessions, including IP address and user agent.
• Scheduled publish times when you schedule content for future delivery.
• Basic service logs generated when you use the application.

Information from third parties

When you connect a third-party account, Broadside receives information needed to complete the connection and publish on your behalf. Depending on the provider, that may include:

• Account or user identifier.
• Display name and handle or username.
• Profile picture or avatar URL.
• Access tokens and refresh tokens.
• Token expiration data.
• Engagement metrics retrieved from the platform after publishing, such as likes, reposts, replies, quotes, views, and shares, where the platform exposes them.

Broadside uses personal information to:

• Create and manage your account.
• Authenticate users and maintain active sessions.
• Send sign-in links when you choose passwordless authentication, and team invitation emails to addresses you specify.
• Send account-related emails, including email verification and password reset messages.
• Store, display, edit, and organize your content and uploaded media.
• Support team workspaces and team switching.
• Connect and maintain third-party publishing accounts.
• Publish content you ask Broadside to send to LinkedIn, X, Bluesky, Threads, Instagram, Mastodon, GitHub, and Pinterest.
• Schedule and publish content at the time you choose.
• Fetch and display engagement metrics for content you have published through Broadside.
• Troubleshoot issues, secure the service, prevent misuse, and improve reliability.
• Comply with legal obligations and enforce terms or other policies.

If you connect LinkedIn, X, Bluesky, Threads, Instagram, Mastodon, GitHub, or Pinterest, Broadside stores the credentials needed to maintain that connection and publish content on your behalf. In the current application, access tokens and refresh tokens, when applicable, are encrypted at rest in the database.

When you choose to publish through Broadside, the content you select for publication, along with any attached media, is sent to the relevant third-party platform. Your use of those platforms is also governed by their own terms and privacy policies.

Broadside may also fetch basic profile data such as your display name, handle, and avatar URL from connected platforms, and may retrieve engagement metrics for content you have published through Broadside. Broadside also stores the provider-specific account ID, token expiration time, and publication status or error information related to publishing attempts.

Broadside uses a signed session cookie to keep you authenticated. This cookie is necessary for core product functionality.

Broadside does not currently include advertising cookies in the application codebase.

In production, Broadside uses Google Analytics 4 ("GA4") to measure traffic and understand product usage. GA4 sets cookies (including _ga and _ga_*) and processes information such as IP address, device, browser, and pages viewed. This data is processed by Google as a service provider; for more information, see Google's privacy policy. You can limit or block analytics cookies through your browser settings, or install the Google Analytics opt-out browser add-on. If additional analytics or cookies are added later, this policy will be updated accordingly.

Broadside also uses Ahrefs Web Analytics to measure site traffic. Ahrefs Web Analytics is cookieless and does not collect personal data or use cookies to track individual visitors; it collects aggregated, anonymized usage information such as page views and referring sites. This data is processed by Ahrefs as a service provider; for more information, see Ahrefs' privacy policy.

Broadside does not sell personal information.

Broadside may share information:

• With service providers that help operate the service, such as infrastructure and file storage providers.
• With Postmark, which Broadside uses to deliver transactional email, including sign-in links, team invitations, email verification, and password reset messages.
• With third-party platforms when you connect an account or ask Broadside to publish content on your behalf.
• If required by law, legal process, or a valid governmental request.
• To protect the rights, safety, security, or property of Broadside, its users, or others.
• In connection with a merger, acquisition, financing, or sale of some or all assets.

In the current production configuration, uploaded media is stored using Amazon S3.

Broadside retains information for as long as needed to provide the service, maintain account functionality, comply with legal obligations, resolve disputes, and enforce agreements.

Examples include:

• Account information retained while your account remains active.
• Session records retained to support account security and session management until deleted or no longer needed.
• Content and uploaded media retained until you or your team delete them, or until your account or workspace is deleted.
• Connected account credentials retained until you disconnect the account or the related data is otherwise deleted.

Retention periods may change if Broadside has to preserve information for legal, security, or operational reasons.

Broadside uses administrative, technical, and organizational measures designed to protect personal information.

Examples in the current application include:

• Password hashing.
• Signed HTTP-only session cookies.
• Encryption of stored third-party platform tokens.
• Access controls based on authenticated sessions and team membership.

No method of transmission or storage is completely secure, and Broadside cannot guarantee absolute security.

Depending on your location, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing.

Broadside currently allows users to:

• Update account profile information.
• Update email address and password.
• Sign in with a passwordless email link.
• Review and manage active sessions.
• Accept or decline team invitations.
• Disconnect connected third-party accounts.
• Delete content they control within the product.
• Delete their account, subject to any operational or legal retention requirements.

To exercise privacy rights not available directly in the product, contact Broadside at [email protected].

Broadside is not intended for children under 13, and Broadside does not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact Broadside so the information can be reviewed and removed if appropriate.

Broadside is operated from the United States. Broadside may process and store information in the United States and, depending on the service providers used to operate the service, in other countries. Those countries may have data protection laws that differ from the laws where you live.

Broadside may update this Privacy Policy from time to time. If Broadside makes material changes, it may provide notice through the service or by other appropriate means. The effective date above shows when this Privacy Policy was last updated.

If you have questions about this Privacy Policy or Broadside's privacy practices, contact: