Eternal Morphs PublisherPrivacy Policy
Last updated: 25 September 2026
Eternal Morphs Publisher (the service) publishes posts to social media accounts on behalf of its users. It is provided by Eternal Morphs, a business run by Matt Miller (I, me). This policy explains what the service stores about you, why, where, and how to have it removed.
What is collected
| Data | Why | Kept for |
|---|---|---|
| Your access request: name, email, what you told me you post | To set up your account and email you the sign-in details. | Until your account is created or the request is declined, then 90 days |
| Your account: username, sign-in secrets stored hashed or encrypted, sign-in times | So you, and only you, can sign in. | Until your account is closed |
| Access tokens and app passwords for connected social accounts | These are the only way to publish on your behalf. Without them the service cannot work. | Until you disconnect the account or ask for deletion |
| Your account handle and platform user ID | To show which account a post will go to, and to address the right account when publishing. | Until you disconnect the account |
| Post content you create: text, images, video, scheduling times | To publish it, and to show you what is queued. | Until published, then removed from the queue |
| Publishing results: success or failure, error messages, the platform's post ID | So you can see whether a post actually went out, and diagnose it if it did not. | Until deleted on request |
What is not collected
- No analytics about other people, and no data about anyone who did not request an account.
- No reading of your feed, followers, direct messages, or private content beyond what publishing requires.
- No advertising or tracking of any kind. The service has no advertising relationship with anyone.
- No sale, rental, or sharing of data with third parties, ever.
Where it is stored
On servers I operate, hosted in Germany. Access tokens and account secrets are stored encrypted, in files readable only by the account that runs the service. Nothing is stored on a third-party analytics or marketing service.
Who it is shared with
Only the social platform you asked to publish to. When you publish to Instagram, the post goes to Instagram; that is the whole of the sharing. No data is passed to any other company.
YouTube API Services
Eternal Morphs Publisher uses YouTube API Services to upload videos to YouTube channels you have authorised.
- By using this feature you are also agreeing to the YouTube Terms of Service.
- Google's own handling of your data is described in the Google Privacy Policy.
- You can revoke this application's access to your Google account at any time through the Google security settings page. Revoking access stops all future uploads immediately.
- The only YouTube data stored is the OAuth token needed to upload, the channel ID it belongs to, and the IDs of videos uploaded through the service. No viewing history, subscriber data, or analytics is collected.
Meta platforms (Facebook, Instagram, Threads)
Publishing to Facebook Pages and Instagram uses Meta's Graph API. You can review and remove this application's access at any time in your Facebook Business Integrations settings. Removing it stops all future publishing immediately.
TikTok
Publishing to TikTok uses TikTok's Login Kit and Content Posting API. The service stores the access token TikTok issues, your TikTok open ID, and your display name and avatar so the composer can show which account a post will go to. You can disconnect the application from your TikTok account in TikTok's app under Settings → Security & permissions → Manage app permissions, or remove the account inside the composer.
How to delete your data
Two ways, both of which work:
- Disconnect the account. Removing a connected account from the service deletes its stored tokens and handle immediately.
- Ask. Email [email protected] and ask for your data, or your whole account, to be deleted. Everything associated with you is removed within 30 days, and you get confirmation when it is done.
Revoking access at the platform (using the links above) stops the service from publishing straight away, but you should still ask for deletion if you want the stored records removed as well.
Your rights
You can ask what data is held about you, ask for a copy of it, ask for it to be corrected, or ask for it to be deleted. Email the address above. There is no form to fill in; just ask.
Security
Sign-in needs two things from you together, and tokens and secrets are encrypted at rest and restricted to the account running the service, on servers with automatic security updates and a firewall limiting access to the ports publishing needs. No system is perfectly secure, and this policy does not claim otherwise; if a breach ever affects your data, you will be told directly.
Children
The service is not directed at children and is not intended for use by anyone under 18.
Changes to this policy
If this policy changes, the date at the top of the page changes with it. If a change materially affects data already stored, anyone with an account is told directly before it takes effect.
Contact
Matt Miller, Eternal Morphs. [email protected]