BandCoins Social
Privacy policy
BandCoins Social (bandcoins-social.vercel.app) is a private desk we use to draft, approve, and publish our own posts. It is separate from the main BandCoins product. This page says what the desk stores, and what it does not.
What this app does
The desk publishes BandCoins' own posts to BandCoins' own accounts on X, Facebook, Instagram, TikTok, and YouTube. Each post goes out through that platform's official API, and only after someone at BandCoins has approved it. The app does not post for anyone else.
The public pages are the blog, the terms, and this policy. Anyone can read them. We do not ask visitors to make an account, sign in, or connect a social account.
What we do not collect
We do not collect personal information from fans, site visitors, or other people's followers. There is no signup, no comment box, no mailing list, and no advertising or analytics tracker on this site. We do not buy, sell, or share visitor information. We do not collect third-party user data.
We do not connect, read, or post to an X, Facebook, Instagram, TikTok, or YouTube account that is not BandCoins' own. We do not pull private messages, contact lists, or follower lists to build a profile of anyone.
What the desk stores
The database holds our own working material:
- Drafts and approved posts we wrote: the text, media links, platform, time, and whether the post went out.
- Blog essays we chose to make public.
- A short record of each publish attempt, including the id the platform hands back.
- OAuth access tokens and refresh tokens for BandCoins' own accounts. Those tokens are encrypted (AES-256-GCM) before they are saved. We use them only to publish a post we already approved, and to refresh access when the platform requires it.
- The account id, display name, and granted scopes for each account we connected.
- A short-lived code while a connection is in progress. It is discarded when the connection finishes or expires.
The desk password is a secret we set on the host. It is not an account system for the public, and visitor names are not stored.
The one cookie
Public pages do not set a cookie. After the desk password is accepted, the browser stores one cookie named bc_session. It is httpOnly, lasts 12 hours, and only tells our server that this desk session is still valid. It does not identify someone reading the blog.
How each platform is used
We send a post only to the official API, and only to our own account:
- X, to publish a post we approved on our own account.
- Facebook, to publish a post we approved on our own Page.
- Instagram, to publish a post we approved on the professional account linked to that Page.
- TikTok, scope
video.upload, to send a video we approved to our own inbox. We finish it in the TikTok app. It does not go live from this desk. - YouTube Data API, scope
youtube.upload, to upload a video we approved to our own channel. We do not use that scope to read or manage anyone else's channel. Google API data is used only for that upload. We follow the Google API Services User Data Policy, including the Limited Use requirements.
Where it is hosted
The site runs on Vercel. Drafts, essays, and the encrypted tokens sit in a Postgres database. Those companies process that material so the desk can run. We do not give them a list of fans, because we do not have one.
Children
This desk is not for children. We do not knowingly collect personal information from anyone under 13. The blog is something to read, not a place to sign up.
Questions and deletion
Write to wes@taskbullet.com. If a BandCoins account was connected by mistake, say so and we will disconnect it and delete the encrypted token. A public essay can be taken down the same way.
Changes
If this policy changes, the date at the top changes with it.