OnceToAll Privacy Policy
What changed — 1.7: OnceToAll can also be used in a web browser at oncetoall.com; this policy now covers the web app (crash reports and usage analytics in the browser, what the browser stores, see §2 and §2g) and the privacy-friendly visitor statistics of our website. 1.6: LinkedIn can be connected directly through LinkedIn's official sign-in for posting to your personal profile (see §2f); Pinterest is no longer supported. 1.5: YouTube can be connected directly with Google sign-in through YouTube API Services (see §2e). 1.4: X can be connected directly through X's official sign-in (see §2d). 1.3: Bluesky can be connected directly through Bluesky's official sign-in (see §2c). 1.2: TikTok can be connected directly through TikTok's official APIs (see §2b). 1.1: Instagram, Facebook and Threads are connected directly through Meta's APIs (see §2a).
OnceToAll ("the App": the iOS and Android apps and the web app at oncetoall.com) lets you write a post once and publish it to the social networks you connect. This policy explains what personal data we process, why, where it goes, and what rights you have. It is written to satisfy the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Who is responsible
The data controller is Semih Soyer, a sole proprietorship registered in Türkiye, Kartepe / Kocaeli, Türkiye (tax ID 7760651471). Privacy requests: privacy@oncetoall.com · Support: support@oncetoall.com
2. What we collect and why
| Data | Source | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|---|
| Account data: e-mail address, display name, sign-in identifier from Apple or Google, time zone, language | You / Apple / Google | Create and secure your account, send service e-mails (verification, password reset, delivery failures, token expiry warnings) | Contract (Art. 6(1)(b)) / KVKK Art. 5(2)(c) |
| Connected social accounts: network, username, display name, avatar, account ID, connection status and expiry; for Facebook, the Pages you choose to connect | Instagram, Facebook and Threads directly through Meta's APIs; TikTok, Bluesky, X, YouTube and LinkedIn (personal profiles) directly through their own APIs where available; other networks via our publishing partner | Publish on your behalf, show connection health, warn before a connection expires | Contract / KVKK Art. 5(2)(c) |
| OAuth authorization tokens for your social accounts | Social networks | Publish on your behalf and keep the connection alive. Instagram, Facebook, Threads and directly connected TikTok, Bluesky, X, YouTube and LinkedIn accounts: stored by us, encrypted (AES-256-GCM) in our EU database; the encryption key is kept separately on the server and never leaves it. Other networks: held by our publishing partner bundle.social (see §4) under a data processing agreement | Contract / KVKK Art. 5(2)(c) |
| Content: captions, images, videos, per-network settings, schedule times, drafts | You | Publish and schedule your posts, show your calendar and history | Contract |
| Delivery records: per-network status, error codes and messages, attempt log, permalinks | Our systems and the networks | Show you exactly what happened to each post, retry failures, notify you | Contract; legitimate interest in service reliability (Art. 6(1)(f)) |
| Subscription data: plan, purchase and renewal status, store transaction identifiers (never your card number) | Apple App Store / Google Play, via RevenueCat once paid plans launch | Manage your subscription and quota | Contract; legal obligation for invoices |
| Device and diagnostic data: device model, OS version, app version, crash reports, error traces; on the web: browser type and version and the page where an error happened | Your device or browser | Fix crashes and errors | Legitimate interest (Art. 6(1)(f)) / KVKK Art. 5(2)(f) |
| Usage analytics: screens viewed, features used, coarse events (e.g. "post scheduled") tied to a random identifier | Your device or browser | Understand which features are used and improve the App | Legitimate interest; you can turn this off in the mobile app under Notifications → Share usage analytics or in the web app under Settings → Share usage analytics (one setting for both) |
| Push notification token | Your device | Send delivery-failure alerts and reminders you enabled | Contract / consent for optional notifications |
| Support messages | You | Answer your requests | Contract; legitimate interest |
| Website visitor statistics: page views, referring site, country, browser and device type, counted without cookies and without identifying you | Your browser, when you visit oncetoall.com | Know how many people visit the website and which pages they read | Legitimate interest (Art. 6(1)(f)) |
2a. Data we receive from Meta (Instagram, Facebook, Threads)
When you connect Instagram, a Facebook Page or Threads, you sign in on Meta's own screen and choose what to grant. We then receive:
- your account ID, username, name and profile picture (Instagram, Threads) or the name, ID and picture of the Facebook Pages you select, plus the list of permissions you granted;
- an access token for each account or Page;
- for posts you published through OnceToAll only: their view, reach, like, comment, share and save counts, read for 30 days after publishing.
We use this data only to publish the posts and first comments you create in OnceToAll, to show you the statistics of those posts, to show which accounts are connected and whether they still work, and to renew access before it expires. We do not read your feed, messages, followers, other people's comments or account-level audience data, we do not use Meta data for advertising or profiling, and we do not sell or share it with anyone except the processors in §4 that run our service. Our use of this data follows the Meta Platform Terms and Developer Policies.
You can stop this at any time: disconnect the account in OnceToAll (Profile → Connected accounts), which deletes its tokens immediately, or remove OnceToAll in your Instagram, Facebook or Threads settings — Meta then notifies us and we delete the tokens. If you also ask Meta to delete your data from OnceToAll, we additionally delete the profile data we received (name, username, picture, Page list) and Meta gives you a status link with a confirmation code. Deleting your OnceToAll account removes all of it.
2b. Data we receive from TikTok
When you connect TikTok directly, you sign in on TikTok's own screen (TikTok Login Kit) and approve two permissions: basic profile information (user.info.basic) and publishing posts to your profile (video.publish). We then receive:
- your TikTok account identifier (open ID), username, nickname and profile picture;
- an access token and a refresh token for your account;
- each time you prepare a TikTok post: the publishing options TikTok allows for your account (who can view the post, whether comments, Duet and Stitch are available, the longest video you can post);
- for posts you published through OnceToAll only: their publishing status and, for public posts, the post ID used to link to them.
We use this data only to show which TikTok account a post will go to, to offer the publishing options TikTok allows for it, to publish the videos and photos you create in OnceToAll with the settings you choose, to show you whether each post went live, and to renew access before it expires. We do not read your videos, followers, comments, messages or other activity on TikTok, we do not use TikTok data for advertising or profiling, and we do not sell or share it with anyone except the processors in §4 that run our service. Our use of this data follows TikTok's Developer Terms of Service.
To publish, TikTok fetches the video or photos from a temporary copy at pull.oncetoall.com (Cloudflare R2, EU jurisdiction). The copy has an unguessable address and is deleted automatically, normally within one day and at the latest within two days.
You can stop this at any time: disconnect TikTok in OnceToAll (Profile → Connected accounts), which revokes our access on TikTok and deletes the tokens immediately, or remove OnceToAll in TikTok under Settings and privacy → Security and permissions → Apps and services permissions, which ends our access at once; the tokens are then deleted when you disconnect TikTok or delete your OnceToAll account.
2c. Data we receive from Bluesky
When you connect Bluesky directly, you sign in on the screen of your Bluesky hosting provider (for most people bsky.social) using the AT Protocol's official sign-in; you never give us your password or an app password. You approve only these permissions: creating and deleting posts, setting who can reply to and quote your posts, and uploading images and videos. We then receive:
- your Bluesky account identifier (DID), handle, display name and profile picture, and the address of your hosting provider;
- the permissions you granted, an access token and a refresh token, and a signing key tied to that sign-in;
- for posts you published through OnceToAll only: their like, repost, reply and quote counts, read from Bluesky's public API for 30 days after publishing.
We use this data only to show which Bluesky account a post will go to, to publish the posts, first comments and settings (replies, quotes, content warnings, image descriptions) you create in OnceToAll, to show you whether each post went live and its statistics, to delete a post from Bluesky when you ask us to, and to renew access before it expires. To turn @mentions into links we look up the handles you mention in Bluesky's public directory. We do not read your feed, follows, likes, messages or other people's posts, we do not use Bluesky data for advertising or profiling, and we do not sell or share it with anyone except the processors in §4 that run our service.
To publish, our servers send your images directly to your Bluesky hosting provider and your videos to Bluesky's video service; no temporary public copy is created. Photos larger than Bluesky's 1 MB limit are resized on our servers, and the smaller copy is stored with your post's media and deleted with it. Bluesky is an open network: posts there are public and can be seen and copied by other services built on the AT Protocol, even after you delete them.
You can stop this at any time: disconnect Bluesky in OnceToAll (Profile → Connected accounts), which ends our sign-in session on Bluesky and deletes the tokens immediately, or remove OnceToAll from the connected apps in your Bluesky account settings (for bsky.social accounts: bsky.social/account), which ends our access at once; the tokens are then deleted when you disconnect Bluesky or delete your OnceToAll account. The temporary data of an unfinished sign-in is stored encrypted and deleted within an hour.
2d. Data we receive from X
When you connect X directly, you sign in on X's own screen (OAuth 2.0); you never give us your X password. You approve these permissions: reading posts and your profile, creating posts, uploading photos and videos, and staying connected until you revoke access. We then receive:
- your X account identifier, username, display name and profile picture, and whether your account is verified or subscribed to X Premium (this decides which X limits apply to your posts);
- an access token and a refresh token for your account;
- for posts you published through OnceToAll only: their view, like, repost, reply, quote and bookmark counts, read about one day, one week and 30 days after publishing.
Although X's permission screen describes reading posts broadly, we use this data only to show which X account a post will go to, to publish the posts and first comments (as a reply to your own post) and settings (who can reply, image descriptions, "Made with AI" and "Paid partnership" labels) you create in OnceToAll, to show you whether each post went live and its statistics, to delete a post from X when you ask us to, and to renew access before it expires. If a publishing attempt is interrupted, we read your latest few posts once to check whether it already went live, so the same post is not published twice. We do not read your timeline, followers, likes, messages or other people's posts, we do not use X data for advertising or profiling or to train AI models, and we do not sell or share it with anyone except the processors in §4 that run our service. Our use of this data follows the X Developer Agreement and Policy.
To publish, our servers send your photos and videos directly to X; no temporary public copy is created. Photos larger than X's 5 MB limit are resized on our servers, and the smaller copy is stored with your post's media and deleted with it. When we see that one of your posts was deleted on X, we delete the statistics we stored for it.
You can stop this at any time: disconnect X in OnceToAll (Profile → Connected accounts), which revokes our access on X and deletes the tokens immediately, or remove OnceToAll in X under Settings and privacy → Security and account access → Apps and sessions → Connected apps, which ends our access at once; the tokens are then deleted when you disconnect X or delete your OnceToAll account. The temporary data of an unfinished sign-in is stored encrypted and deleted within an hour.
2e. Data we receive from YouTube (YouTube API Services)
OnceToAll uses YouTube API Services to publish to YouTube. When you connect YouTube directly, you sign in with your Google account on Google's own screen and choose the channel; you never give us your Google password. You approve one permission: "See, edit, and permanently delete your YouTube videos, ratings, comments and captions". We then receive and store:
- your YouTube channel ID, name, handle and profile picture, and whether the channel may upload videos longer than 15 minutes;
- an access token and a refresh token for that channel;
- for videos you published through OnceToAll only: the video ID, its upload and processing status, and its view, like and comment counts. We read the counts about every 6 hours for the first two days, then daily up to 30 days after publishing, and after that once a month to check that the video still exists and that you still allow access.
We use this data only to show which channel a video will go to, to upload the videos you create in OnceToAll with the title, description and settings you choose (visibility, made for kids, altered or synthetic content, paid promotion, notifying subscribers, custom thumbnail), to post the first comment you write, to show you whether each video went live and its statistics, to delete a video from YouTube when you ask us to, and to renew access before it expires. We do not read your other videos, comments, subscribers or watch history, we do not use YouTube data for advertising or profiling or to train AI models, we never add YouTube numbers to totals from other networks, and we do not sell or share YouTube data with anyone except the processors in §4 that run our service. OnceToAll's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
By using the YouTube features of OnceToAll you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
To publish, our servers send your video straight from our storage to YouTube; no temporary public copy is created.
You can stop this at any time:
- disconnect YouTube in OnceToAll (Profile → Connected accounts): we revoke our access in your Google account and delete the tokens and the YouTube statistics we stored, immediately;
- or remove OnceToAll at security.google.com/settings/security/permissions: our access ends at once, and we delete the YouTube data we stored within 30 days (in practice at our next daily check);
- if you ask to delete your OnceToAll account, we revoke YouTube access and delete your YouTube data within one day, without waiting for the 7-day undo window.
Deleting data in OnceToAll does not delete videos on YouTube. To remove a video from YouTube, use "Delete from YouTube" in OnceToAll or YouTube itself. Questions about YouTube data: privacy@oncetoall.com.
We do not sell personal data, do not use your content to train AI models, and do not show third-party advertising. We do not track you across other apps or websites.
2f. Data we receive from LinkedIn
When you connect LinkedIn directly, you sign in on LinkedIn's own screen (OAuth 2.0); you never give us your LinkedIn password. You approve only these permissions: using your name and photo, and creating, changing and deleting posts on your behalf. We then receive:
- your LinkedIn member identifier, name and profile picture;
- an access token for your account, valid for about 60 days (LinkedIn does not give us a way to renew it, so you are asked to reconnect before it ends).
We use this data only to show which LinkedIn account a post will go to, to publish the posts you create in OnceToAll to your personal LinkedIn profile with the settings you choose (who can see the post, video title, cover image), to show you whether each post went live, to delete a post from LinkedIn when you ask us to, and to remind you before access ends. For link posts, our servers read the title, description and image of the page you link to, because LinkedIn builds the preview card from what we send. We cannot read your feed, connections, messages, your other posts or their statistics, we do not use LinkedIn data for advertising or profiling or to train AI models, and we do not sell or share it with anyone except the processors in §4 that run our service. Our use of this data follows the LinkedIn API Terms of Use.
To publish, our servers send your photos and videos directly to LinkedIn; no temporary public copy is created.
You can stop this at any time: disconnect LinkedIn in OnceToAll (Profile → Connected accounts), which deletes the token immediately, or remove OnceToAll in LinkedIn under Settings → Data privacy → Permitted services, which ends our access at once; the token is then deleted when you disconnect LinkedIn or delete your OnceToAll account.
2g. Using OnceToAll in a web browser
The web app at oncetoall.com uses the same account, data and rules as the mobile apps. In addition:
- What the browser stores. Your browser's local storage keeps your sign-in session (so you stay signed in), the post you are writing until you publish or save it, and a few display preferences. Signing out clears them; the next person who signs in on the same browser does not see them. Usage analytics, if you leave them on, keep their random identifier there too. We do not use advertising or tracking cookies, and we do not set cookies for analytics.
- Crash reports and usage analytics work as described in §2: the same providers (Sentry and PostHog, both in the EU), the same "Share usage analytics" setting, no session recordings and nothing you write in your posts.
- Media you upload goes straight from your browser to our storage (Cloudflare R2, EU jurisdiction); photos are resized in your browser before upload.
- Connecting a social account opens the network's own sign-in page in a separate window; your password for that network never passes through OnceToAll.
- Website statistics. On oncetoall.com we count visits with Cloudflare Web Analytics, which does not use cookies or fingerprinting and does not identify you.
3. Where the data lives
- Application database and authentication: Supabase, hosted in the EU (Ireland, eu-west-1).
- Media files (images, videos): Cloudflare R2, stored under EU jurisdiction.
- Instagram, Facebook and Threads connections and tokens: our own database (Supabase, EU); posts go from our servers directly to Meta's APIs.
- Directly connected TikTok accounts and their tokens: our own database (Supabase, EU); posts go from our servers directly to TikTok's APIs, and TikTok fetches the media from a temporary copy in Cloudflare R2 (EU jurisdiction), deleted within two days.
- Directly connected Bluesky accounts and their tokens: our own database (Supabase, EU); posts and media go from our servers directly to your Bluesky hosting provider and Bluesky's video service.
- Directly connected X accounts and their tokens: our own database (Supabase, EU); posts and media go from our servers directly to X's APIs.
- Directly connected YouTube channels, their tokens and statistics: our own database (Supabase, EU); videos go from our servers directly to YouTube's API.
- Directly connected LinkedIn accounts and their tokens: our own database (Supabase, EU); posts and media go from our servers directly to LinkedIn's API.
- Other social account connections and publishing: bundle.social (Bundle sp. z o.o., Warsaw, Poland), production infrastructure in Frankfurt, Germany; media may be routed through Cloudflare's global network for delivery.
- Error monitoring (mobile and web apps): Sentry, EU region (Germany).
- Product analytics (mobile and web apps): PostHog, EU cloud (Frankfurt).
- Website hosting and visitor statistics: Cloudflare (global network; no cookies, no personal identifiers).
- Transactional e-mail: Resend (United States).
- Subscription management: Apple / Google; RevenueCat (United States) once paid plans launch.
4. Who we share data with (processors)
We use the following service providers, each bound by a data processing agreement and acting only on our instructions:
| Provider | Role | Location |
|---|---|---|
| Bundle sp. z o.o. (bundle.social) | Publishing API and social account connections for networks other than those connected directly through Meta, TikTok, Bluesky, X, YouTube or LinkedIn; holds those OAuth tokens | Poland / EEA (Frankfurt) |
| Supabase Inc. | Database (including encrypted Instagram, Facebook, Threads, TikTok, Bluesky, X, YouTube and LinkedIn tokens), authentication, server functions | EU (Ireland) |
| Cloudflare Inc. | Media storage (R2), website and web app hosting, website visitor statistics (no cookies), DNS, e-mail routing | EU jurisdiction storage; global network |
| Functional Software Inc. (Sentry) | Crash and error monitoring | EU (Germany) |
| PostHog Inc. | Product analytics | EU (Frankfurt) |
| Apple Inc. / Google LLC | App distribution, payments, sign-in | Global |
| RevenueCat Inc. | Subscription status, once paid plans launch | US |
| Expo (650 Industries, Inc.) | Push notification delivery | US |
| Resend Inc. | Transactional e-mail | US |
The social networks you connect (Instagram, Facebook, Threads, LinkedIn, Bluesky, TikTok, YouTube, X) receive the content you ask us to publish and act as independent controllers under their own privacy policies. Meta Platforms (Instagram, Facebook, Threads), TikTok, Bluesky, X, Google (YouTube) and LinkedIn also receive the API requests we make on your behalf. OnceToAll is not affiliated with or endorsed by any of them.
5. International transfers
Your data is processed mainly in the European Economic Area. Because the controller is in Türkiye, transfers to processors abroad rely on each processor's data processing agreement and, where required, on standard contractual clauses (the EU Standard Contractual Clauses or the Standard Contract published by the Turkish Personal Data Protection Authority) or an adequacy decision.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and connected accounts | Until you delete your account (+ 7-day undo window; YouTube data is removed within one day of the request, see §2e); after that, removed from live systems right away and from backups within 30 days |
| Instagram, Facebook and Threads tokens | Until you disconnect the account, remove OnceToAll on Meta's side, or delete your OnceToAll account — deleted immediately in each case |
| TikTok tokens | Until you disconnect TikTok or delete your OnceToAll account — deleted immediately in each case |
| Bluesky tokens | Until you disconnect Bluesky or delete your OnceToAll account — deleted immediately in each case |
| Unfinished Bluesky sign-in data | Deleted after sign-in, at the latest within one hour |
| X tokens | Until you disconnect X or delete your OnceToAll account — deleted immediately in each case |
| Unfinished X sign-in data | Deleted after sign-in, at the latest within one hour |
| Statistics of a post deleted on X | Deleted when we see the post is gone |
| YouTube tokens | Until you disconnect YouTube, remove OnceToAll in your Google account, or delete your OnceToAll account (see §2e) |
| YouTube video statistics | Refreshed or re-checked at least every 30 days; deleted when you disconnect YouTube (immediately), revoke access in your Google account (within 30 days), ask to delete your account (within one day), or when the video is deleted on YouTube |
| LinkedIn tokens | Until you disconnect LinkedIn or delete your OnceToAll account — deleted immediately in each case; they expire on LinkedIn's side after about 60 days |
| Temporary media copy for TikTok | Deleted automatically, at the latest within two days |
| Posts and delivery records | Until you delete them or your account |
| Media files | Until you delete the post or your account; media of cancelled or deleted posts is purged within 30 days |
| Crash and diagnostic data | 90 days |
| Usage analytics | 12 months |
| Support e-mails | 24 months |
| Invoicing records | As required by Turkish tax law (10 years) |
7. Your rights
Under GDPR and KVKK Article 11 you can ask us to: tell you whether we process your data and give you a copy; correct it; delete it; restrict or object to processing; receive it in a portable format; and withdraw consent where processing is based on consent. Write to privacy@oncetoall.com; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or to your EU supervisory authority.
You can delete your account inside the mobile app (Profile → Settings → Delete account), in the web app (Settings → Delete account) or from oncetoall.com/delete-account.
8. Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the controller. Social network tokens are never stored on your device. Instagram, Facebook, Threads and directly connected TikTok, Bluesky, X, YouTube and LinkedIn tokens are stored encrypted on our servers and decrypted only at the moment of a request to Meta, TikTok, Bluesky, X, YouTube or LinkedIn; other networks' tokens stay with bundle.social. We will notify you without undue delay of a personal data breach that is likely to affect you.
9. Children
The App is not intended for anyone under 13, and the social networks you connect require you to meet their own age rules. We do not knowingly collect data from children.
10. Changes
We will announce material changes in the App (mobile or web) and update the date at the top. Continued use after the effective date means you accept the new policy.