Privacy Policy

Rysal is a social media scheduling and publishing service. This policy explains what personal data we collect when you visit rysal.app, use the Rysal app at dashboard.rysal.app, connect your social accounts or use Rysal from an AI tool, what we do with it, and the choices you have.

The short version:

• We collect what we need to run the service: your account, your organization, the social accounts you connect, the posts you write and the comments and results we fetch for them.
• We act on a social account only when you tell us to: to publish a post you scheduled, or to fetch comments and results for an account you connected.
• We do not sell your data, we do not show ads, and we do not use your content or your social account data to train AI models.
• Everything is stored on Cloudflare. You can disconnect an account or delete your data at any time, in the app or by email to hello@rysal.app, and we finish deleting within 30 days.

Rysal is operated by Hareword LLC, a Wyoming limited liability company doing business as Pragmatic Growth ("Pragmatic Growth", "we", "us"). We are responsible for the personal data described in this policy.

When an organization uses Rysal, the organization decides which social accounts to connect and what to post, and we process that content to provide the service to it. If you are a member of an organization and have questions about how it uses Rysal, you can ask its owner as well as us.

Contact: hello@rysal.app. Postal address: Hareword LLC dba Pragmatic Growth, 604 Carson Dr, NT-1, Bear, DE 19701, United States.

Account data. Your name, email address and a one-way hash of your password (we never see or store the password itself), whether your email is verified, your profile picture if you add one, and your preferences such as time zone, time format, start of the week and theme.

Sign-in and session data. When you sign in we create a session and record its time, IP address and browser (user agent), so you can stay signed in and we can detect suspicious sign-ins. Links we email you (to sign in, reset your password, confirm your email address or accept an invitation) are stored until they are used or expire.

Organization data. The organization's name, its members and their roles, the email addresses of people you invite, which channels each member may publish to or answer comments on, approval requests and notes left on posts.

Connected social accounts. When you connect a Facebook Page, Instagram account, Threads profile, X account, LinkedIn profile or page, YouTube channel or TikTok account, the platform asks for your consent and then gives us an access token and, where the platform uses one, a refresh token. We also store the account's ID, name, handle, profile picture, account type, the permissions you granted and when the token expires. Tokens are encrypted before they are stored and are never sent to your browser.

Posts, ideas and media. The text, images, videos and documents you add, link previews, schedules, tags, templates, ideas and drafts, and, once a post is published, its ID and address on the platform. If a post fails, we keep the reason the platform gave.

Comments. For accounts you connect, we fetch comments, replies and mentions on your posts so you can answer them in Rysal. These include the commenter's public name, handle, profile picture and the text and media of their comment, as the platform provides them. We store the replies you send from Rysal.

Results (metrics). For accounts you connect, we fetch counts such as followers, impressions, reach, views, likes, comments, shares, saves and clicks for the account and its posts.

Web push subscriptions. If you turn on browser notifications for reminders, your browser gives us a push address and encryption keys for that device. We store them with your account and the browser and device type.

AI assistant. When you use the writing assistant or ask for ideas or reply suggestions, we send the text you ask about (and, for replies, the comment) to the AI model and store the result only if you keep it in a post, idea or reply. These requests pass through Cloudflare AI Gateway, which records only metadata about each request (the model, token counts, status and cost), never the text you send or the text the model returns.

AI tools connected through MCP. If you connect an AI tool such as Claude, ChatGPT or Cursor to Rysal, we store the grant (which tool, which organization, the permissions, when it was created and last used). The tool's requests are logged like any other request.

Emails. The emails we send you (for example verification, sign-in links, invitations, publishing failures and reminders) and whether they were delivered.

Logs and security data. For every request: the time, the IP address, the browser, the page or API path, a request ID, the response status and any error. Bot checks on our sign-up and sign-in forms (Cloudflare Turnstile) read signals from your browser to tell people from automated scripts.

Support messages. Anything you send to hello@rysal.app.

On the marketing site (rysal.app) we collect only aggregate, cookieless visit statistics with Cloudflare Web Analytics: the page, the referring site, your country and your browser type. It does not create a profile of you or follow you across sites.

We do not collect payment details: Rysal is free and has no billing.

We use personal data only for these purposes:

• To provide Rysal: create your account and organization, connect your social accounts, publish and remind you about your posts, show comments and let you reply, show results, and send the emails the service needs. Legal basis: performing our contract with you (GDPR Article 6(1)(b)).
• To keep Rysal secure and working: prevent spam and abuse, rate-limit requests, investigate errors and protect accounts. Legal basis: our legitimate interest in a safe, reliable service (Article 6(1)(f)).
• To improve Rysal: understand, in aggregate, which features are used and where things fail. We do not use the content of your posts or your social account data for this. Legal basis: legitimate interest (Article 6(1)(f)).
• To meet legal obligations, for example answering a lawful request from an authority. Legal basis: legal obligation (Article 6(1)(c)).
• Where we ask for your consent (for example browser notifications), the legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time.

We do not sell personal data, share it for advertising, show ads in Rysal, let third parties serve content or ads in Rysal, or use it to make decisions about you that have legal or similarly significant effects.

Rysal uses each platform's official API with the permissions you approve on the platform's own consent screen. We use them only to do what you ask: publish or schedule the posts you create, fetch comments and let you reply, and fetch results. We do not read your private messages, we do not post anything you did not create or approve, and we do not follow, like or message anyone on your behalf.

• Facebook (Pages you manage): publish posts, photos, videos, Reels and Stories; read and reply to comments on your Page's posts; read Page and post insights.
• Instagram (professional accounts): publish photos, carousels, Reels and Stories; read and reply to comments on your posts; read account and post insights.
• Threads: publish posts and replies; read replies to your posts and answer them; read post insights.
• X: publish posts and threads; read replies and mentions of your account and answer them; read post metrics.
• LinkedIn (your profile and pages you administer): publish posts; read and reply to comments on your posts; read page and post statistics.
• YouTube (your channel): upload Shorts with their title and description; read and reply to comments on your videos; read channel and video statistics.
• TikTok: publish videos and photo posts to your account (or send them to your TikTok inbox to finish there); read basic account and video statistics and comments where TikTok's API allows.

Some posts cannot be published through a platform's API (for example posts to Facebook Groups or with music added in the app). For those, Rysal sends you a reminder instead and you finish the post yourself; Rysal does not log in to the platform as you.

Media you attach is uploaded to our media storage and, for platforms that fetch media by address (such as Instagram and Threads), given to the platform as a link on media.rysal.app. These links contain long random names that cannot be guessed, but anyone who has the exact link can open the file.

Each platform's own terms and privacy policy apply to what you publish there: Meta Privacy Policy (Facebook, Instagram and Threads), X Privacy Policy, LinkedIn Privacy Policy, Google Privacy Policy (YouTube) and TikTok Privacy Policy.

Rysal uses YouTube API Services to connect your YouTube channel, upload Shorts you schedule, show and answer comments, and show your channel and video statistics.

By connecting a YouTube channel to Rysal you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

From YouTube we access and store: your channel's ID, title, handle and picture; the access and refresh tokens Google issues (encrypted); the IDs, titles and addresses of videos published through Rysal; comments and replies on your videos, with the commenters' public names and pictures; and statistics such as views, likes, comments and subscribers. We use them only to provide the features above and share them only with the members of your Rysal organization who have access to that channel and with our hosting provider, Cloudflare.

We refresh or delete stored YouTube data at least every 30 days, and we check at least every 30 days that our access has not been revoked.

You can remove Rysal's access in two ways. In Rysal, disconnect the channel: we revoke the token with Google at once and delete the YouTube data we stored within 7 days. Or, at any time, use Google's security settings page at https://security.google.com/settings/security/permissions: our access stops at once, and we delete the data we stored within 30 days of the revocation. Questions or complaints about how we handle YouTube data go to hello@rysal.app.

Rysal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above that you can see in Rysal.
• We transfer it to others only as needed to provide those features (to the members of your organization and to Cloudflare, which hosts Rysal), to comply with the law, or as part of a merger or acquisition with your notice.
• We do not use or transfer it to serve ads, including retargeting, personalized or interest-based advertising, and we do not sell it.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine learning models.
• No person at Pragmatic Growth reads it unless you give us permission for a specific request (for example a support question), it is needed for security (such as investigating abuse), it is required by law, or it is aggregated and anonymized for internal operations.

We handle data from Meta, X, LinkedIn and TikTok under the same rules and under each platform's developer terms.

Rysal runs entirely on Cloudflare (Cloudflare, Inc., United States). Your data is stored in:

• Cloudflare D1, our database: accounts, organizations, channels, encrypted tokens, posts, comments, results and settings. Its primary copy is in Western Europe.
• Cloudflare R2: the media files you upload and the thumbnails we make from them, served from media.rysal.app.
• Cloudflare Workers KV: sessions, short-lived sign-in and connection codes, and cached link previews.
• Cloudflare Workers, Queues, Workflows and Durable Objects: the code that runs Rysal and publishes your posts, which processes your data while it works.

Cloudflare runs a global network, so requests may be processed in the data center closest to you. When data leaves the European Economic Area, the United Kingdom or Switzerland, it is protected by the European Commission's Standard Contractual Clauses and, where Cloudflare is certified, the EU-U.S. Data Privacy Framework.

We share personal data only with:

• Members of your organization, according to the roles and channel access the organization's owner and admins set.
• Cloudflare, which hosts and runs Rysal: database, storage, email delivery (Cloudflare Email Service), the AI assistant (Workers AI through AI Gateway), bot checks (Turnstile) and the marketing site's visit statistics (Web Analytics). Cloudflare processes data on our instructions and does not use AI requests to train its models.
• The social platforms you connect (Meta for Facebook, Instagram and Threads; X; LinkedIn; Google for YouTube; TikTok), to publish, reply and fetch comments and results as you ask.
• Browser push services (such as Google, Mozilla, Apple and Microsoft) if you turn on browser notifications. They receive an encrypted notification for your device and cannot read it.
• AI tools you connect through MCP, which receive the data their requests ask for, with your permissions. What they keep is governed by your agreement with their provider (for example Anthropic, OpenAI or Cursor), not by this policy.
• Error reporting (Sentry, Functional Software, Inc., United States), which receives technical details of errors after tokens and personal data are removed.
• Authorities, courts or advisers when the law requires it or to protect our rights, our users or the public.
• A buyer or successor if Pragmatic Growth is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

We keep data only as long as we need it:

• Account data: while your account exists. When you delete your account, it is removed within 30 days.
• Organization data, posts, ideas, notes and media: while the organization exists or until you delete them. When an organization is deleted, all of its data, including media files, is removed within 30 days.
• Social account tokens: until you disconnect the account, delete the organization or the platform revokes them. Tokens are deleted at once when you disconnect, and we also revoke them with the platform where its API allows.
• Comments and results fetched from a platform: while the account stays connected. After you disconnect it, they are deleted within 30 days (within 7 days for YouTube).
• Sessions: until you sign out or the session expires.
• Email links: until used or until they expire (15 minutes for sign-in links, 1 hour for password resets, 24 hours for email confirmation, 48 hours for invitations).
• Web push subscriptions: until you turn notifications off, sign out on that device, or the push service tells us the subscription has expired.
• Request logs: up to 30 days.
• AI Gateway request metadata (model, token counts, status and cost; never the prompt or response text): kept for troubleshooting and abuse prevention. Its volume is capped, so the oldest records are removed as new ones arrive, rather than after a set number of days.
• Backups: our database keeps restore points for up to 30 days, so deleted data disappears from backups within 30 days of deletion.
• Support emails: up to two years after the conversation ends, unless you ask us to delete them sooner.

We keep data longer only when the law requires it, or to establish or defend a legal claim, and then only the data that is needed.

You can delete data yourself in the Rysal app:

• Disconnect a social account in Settings > Channels. Its tokens are deleted at once and its comments and results within 30 days.
• Delete posts, ideas and media from the screens where they appear.
• As the owner, delete the whole organization in Settings > Organization.
• Delete your account in Settings > Profile.

You can also email hello@rysal.app from the address you use for Rysal and ask us to delete your data. We confirm within 3 business days and finish within 30 days. The Data Deletion page has step-by-step instructions, including how to remove Rysal from Facebook, Instagram, Threads, X, LinkedIn, YouTube and TikTok.

Posts you published to a platform stay on that platform until you delete them there; deleting them in Rysal does not remove them from the platform.

Wherever you live, you can ask us to:

• Access: tell you what personal data we hold about you and give you a copy.
• Correct: fix data that is wrong. You can change most of it yourself in Settings.
• Delete: erase your data (see Deleting Your Data).
• Port: give you your data in a common, machine-readable format so you can move it elsewhere.
• Restrict or object: stop or limit processing that is based on our legitimate interests.
• Withdraw consent: for anything based on consent, such as browser notifications, at any time.

To use any of these rights, email hello@rysal.app. We may ask you to confirm your identity, usually by replying from the email address on your account. We answer within 30 days. If you are in the EEA, the United Kingdom or Switzerland, you can also complain to your local data protection authority. If you live in California or another US state with a privacy law, you have the same rights, we will not treat you differently for using them, and we do not sell or share personal data for cross-context behavioural advertising.

If you commented on a post of an account managed with Rysal and want us to delete our copy of your comment, email us with a link to the comment.

The marketing site, rysal.app, sets no cookies. Its visit statistics come from Cloudflare Web Analytics, which does not use cookies or local storage.

The Rysal app, dashboard.rysal.app, uses only what it needs to work:

• A session cookie that keeps you signed in. It is first-party, secure and not readable by scripts, and it ends when you sign out or the session expires.
• Local storage in your browser for preferences such as the theme and the state of the sidebar.
• Cloudflare Turnstile on the sign-up and sign-in forms, which reads browser signals to check that you are a person. Cloudflare may also set strictly necessary security cookies.
• A service worker, which lets your browser receive reminder notifications if you turn them on.

We use no advertising or tracking cookies and no third-party analytics in the app, so there is nothing to opt in to.

All connections to Rysal use HTTPS. Social account tokens are encrypted with AES-GCM before they are stored and never leave our servers. Passwords are stored only as salted hashes. Every request is checked against your organization and your role, so one organization can never see another's data. Access to production systems is limited to the people who run Rysal.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities without undue delay, as the law requires.

Rysal is a tool for businesses and creators and is not meant for children. You must be at least 16 years old to use it. We do not knowingly collect data from anyone under 16; if we learn that we have, we delete it. If you believe a child has given us data, email hello@rysal.app.

We will update this policy when Rysal or the law changes. The date at the top shows the latest version. If a change is significant, or if we start using data from a connected account in a new way, we will tell you by email or in the app before it takes effect and, where required, ask you to agree again.

Questions, requests or complaints about privacy: hello@rysal.app.

Postal address: Hareword LLC dba Pragmatic Growth, 604 Carson Dr, NT-1, Bear, DE 19701, United States.

See also our Terms of Service and Data Deletion page.