In short: HEIDI Connect stores only what is needed for you to sign in and for publishing and reading statistics for the accounts you connected yourself. Access tokens are stored encrypted, uploaded media is deleted automatically after 48 hours, and disconnecting an account deletes its token immediately. Nothing is sold, shared with third parties, used for advertising or used to train AI models. Full policy below.
Last updated: 2 September 2026.
HEIDI Connect ("the Service", "we", "us") is operated by Linus Svenning, a sole proprietorship (enskild firma) registered in Sweden. We are the data controller for the personal data described in this policy.
Contact: [email protected]
Website: https://heidiconnect.app
This policy explains what personal data we process when you use HEIDI Connect at heidiconnect.app or through our API, why we process it, what we do and do not do with it, how long we keep it, and what rights you have.
HEIDI Connect is a business-to-business tool. Our clients are creators, artists, labels and agencies who connect social media accounts they own or are authorised to manage so that their own software can publish content and read statistics for those accounts.
Data: your email address, and — if you sign in with Google — your name, profile picture URL and Google account identifier. We also store the time you created the account and the time you last signed in.
Purpose: to create your account, sign you in, and separate your data from other clients' data.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Data: when you request a one-time sign-in link we store a hashed version of that token together with the email address it was issued for. The token is valid for 20 minutes and can be used once.
Purpose: to let you sign in without a password.
Legal basis: performance of a contract.
We use two cookies, both strictly necessary for the Service to work. We use no analytics, advertising, tracking or third-party cookies.
hc_session — keeps you signed in. Signed, HttpOnly, SameSite=Lax, Secure over HTTPS, valid 30 days.
hc_pending — holds your sign-in details for up to 30 minutes while you enter an invitation code during first-time registration.
Legal basis: strictly necessary for a service you have requested; no consent banner is required for cookies of this kind under Swedish and EU rules.
Data: for each account you connect we store the account identifier issued by the platform, the username, display name, profile picture URL, the permissions you granted, the token expiry, and the access token and refresh token issued by the platform. Access tokens and refresh tokens are encrypted at rest and are never displayed to you or to anyone else in readable form.
Purpose: to act on that account on your instruction — publishing, reading statistics, reading and replying to comments and messages.
Legal basis: performance of a contract. You choose which accounts to connect and can disconnect any of them at any time.
We never receive your password for any platform. All sign-in happens on the platform's own website through its official OAuth flow.
Data: profile information, your published posts, statistics for your account and your posts, and — where you have granted those permissions — comments and direct messages on your own content.
Purpose: to display this back to you, and only to you, in our interface or through your own software via our API. Most of this data is fetched live from the platform when you look at it and is not copied into our database.
Legal basis: performance of a contract.
Data: for each publishing job: which account it was for, the type of post, the caption you wrote, the status, the time, and the resulting post identifier and link — or the error message if it failed.
Purpose: to show you what has been published, to let you troubleshoot failures, and to protect both you and us in a dispute about what was posted and when.
Legal basis: performance of a contract, and our legitimate interest in being able to document the operation of the Service (GDPR Art. 6(1)(f)).
Data: the image or video files you choose to publish.
Purpose: the platforms fetch media from a URL, so a file must be reachable for a short time while the post is being created.
Retention: files are stored under randomly generated, unguessable names and are deleted automatically after 48 hours.
Legal basis: performance of a contract.
Data: a label you choose, a hashed and encrypted copy of the key, and the time it was created and last used.
Purpose: so your own software can reach your own accounts through our API.
Legal basis: performance of a contract.
Data: ordinary server logs about requests and errors, used to operate and troubleshoot the Service. Access tokens, refresh tokens, API keys and client secrets are deliberately excluded from our logs.
Purpose: operating, securing and debugging the Service.
Legal basis: legitimate interest in running a secure and functioning service.
Data: if you buy a standalone seat, we store the email address you used at checkout, the identifier of the Stripe Checkout session and the time the session was used. Your subscription status is read from Stripe when you sign in and every six hours. We never receive or store your card details. The payment itself takes place on Stripe's own pages.
Purpose: to open the seat you paid for, to reopen it when you return, and to close it if the subscription ends.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)), and a legal obligation for accounting records (Art. 6(1)(c)).
We do not sell personal data or Platform Data. We do not share it with any third party other than the sub-processors listed in section 5 and the platform the data belongs to. We do not use it for advertising, ad targeting or profiling. We do not use it to train artificial intelligence or machine learning models. We do not aggregate data across clients. We carry out no automated decision-making or profiling that produces legal effects for you.
Data obtained from Meta, TikTok and YouTube is used solely to provide the functions described in section 3 back to the client whose account the data belongs to, in accordance with the Meta Platform Terms, the TikTok Developer Terms of Service and the YouTube API Services Terms of Service.
HEIDI Connect uses YouTube API Services to upload videos to, and read statistics for, the YouTube channel you connected yourself. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
We request exactly two permissions: youtube.upload, used only to publish a video you selected yourself, and youtube.readonly, used only to show you your own channel and video statistics. We do not read, modify or delete anything else on your channel, we store no YouTube data beyond what section 3 describes, and we never use it for advertising, profiling or training AI models.
You can revoke our access to your YouTube channel at any time through the Google security settings page, or by pressing Disconnect next to the channel in the Service, which deletes the stored tokens immediately.
Cloudflare, Inc. (United States) — provides the encrypted network tunnel and DNS through which heidiconnect.app is reachable. Traffic passes through Cloudflare's network; no data is stored there by us.
Resend (Plus Five Five, Inc.) — delivers the one-time sign-in emails. Sending is configured to Resend's EU region (Ireland). Resend receives your email address and the content of that email.
Google LLC — if you choose to sign in with Google, Google provides us with your email address, name and profile picture. If you connect a YouTube channel, Google and YouTube receive and return the data needed to upload your video and to report its statistics.
Stripe, Inc. and Stripe Payments Europe, Ltd. (Ireland) process the payment if you buy a seat. Stripe receives your email address, your payment details and the amount, and acts as an independent controller for the payment itself. We receive only your email address and the status of the subscription. Stripe's handling is described in the Stripe Privacy Policy.
The social media platforms (Meta Platforms Ireland/Inc. for Instagram and Facebook, TikTok, YouTube/Google, Bluesky) — data flows to and from the platform whose account you connected, on your instruction.
We do not use any other analytics, advertising, tracking or data enrichment providers.
The database and media files are stored on hardware controlled by the operator in Sweden (EU/EEA). Backups, where taken, remain under the operator's control.
Transfers outside the EU/EEA occur only through the sub-processors above: network transit via Cloudflare (United States) and, if you sign in with Google, authentication via Google (United States). These providers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Sending of sign-in emails is configured to remain within the EU.
Your account with us — until you ask us to delete it.
Access and refresh tokens — until you disconnect the account, which deletes them immediately, or until you delete your account.
Connected account details (username, display name, picture URL) — deleted together with the token when you disconnect.
Sign-in tokens — 20 minutes, or until used.
Purchase records (the Stripe session identifier and the email address it was paid with): kept while the subscription is active and then for as long as Swedish accounting law requires.
Uploaded media — deleted automatically after 48 hours.
Publishing log — kept while your account exists so you can see your own history; deleted with your account.
API keys — until you delete the key or your account.
Technical logs — kept only as long as needed to operate and troubleshoot the Service, normally no more than 12 months.
Under the GDPR you have the right to: obtain access to the personal data we hold about you; have inaccurate data rectified; have your data erased; restrict or object to our processing; receive your data in a portable format (data portability); and withdraw consent where processing is based on consent.
To exercise any of these rights, email [email protected]. We will respond within 30 days. We may need to confirm your identity before acting on a request.
You can also act directly in the Service at any time: press Disconnect next to an account on /connect to delete its tokens immediately, and see data deletion instructions for deleting everything.
You may additionally revoke our access from the platform itself — Instagram and Facebook: Settings → Apps and websites; TikTok: Settings → Security → Manage app permissions; YouTube: Google security settings; Bluesky: delete the app password.
If you believe we process your data unlawfully you have the right to lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), www.imy.se, or with the supervisory authority in your country of residence.
All traffic to and from heidiconnect.app is encrypted with HTTPS. Access tokens and refresh tokens are encrypted at rest with symmetric authenticated encryption and are never rendered in readable form. API keys are stored hashed. Session cookies are signed and HttpOnly. Secrets are deliberately kept out of application logs. Access to the underlying system is limited to the operator. No system is perfectly secure; if a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform you where required.
The Service is a professional tool and is not directed at children. You must be at least 18 years old, or the age of majority in your country, to use it. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
If we change how we handle personal data we will update this page and change the date at the top. Material changes will additionally be communicated to the email address on your account before they take effect. The version published here is always the one in force.
Questions, requests or complaints about privacy:
Linus Svenning (enskild firma), Sweden
[email protected]