Superfly: grow on social with a strategy

1. What we collect

Your account. Your name, email address and password. Passwords are stored only as a salted, one-way hash (scrypt); we never see or keep the password itself.

What you create. Your profiles, strategy (niche, audience, voice, pillars), drafts, scheduled posts, series and articles, plus images and PDFs you upload and article text you paste or bring in with the bookmarklet.

Connected platforms. When you connect X, Bluesky, Threads or LinkedIn, we store what's needed to act for you: access tokens or session credentials (encrypted, see Security below), and your public profile (handle, name, picture, bio, follower counts). We then read, on a schedule and when you ask:

your own posts and their metrics (likes, reposts, replies, views), for analytics and your Feed;
replies to and mentions of your posts, for your Engage inbox;
posts from your platform feed (X "For You", Bluesky's Discover feed), to find trends for you;
public posts matching your search keywords, for reply opportunities;
public posts by accounts you choose as role models.

News. If you turn on news discovery, we fetch headlines and short snippets from Google News RSS feeds for searches based on your strategy. We don't download the articles.

Connected apps. If you connect an AI assistant through Superfly's MCP server, we store the app's name, the permissions you granted, and hashed access tokens.

Technical data. Server logs (such as IP address, browser and errors) for security and debugging, and records of sign-in attempts (with your email hashed) to stop password guessing.

2. How we use it

To run Superfly: build your strategy, write drafts, schedule and publish posts, sync and analyze your posts, and show your inbox and feed.
To publish only what you ask: we post to your accounts only when you post, schedule or approve something (or, if you turn it on, a follow-up under a post that's doing well).
To keep the service secure and working, and to prevent abuse.
To contact you about your account or important changes.

3. Who we share it with

We share data only with the services that make Superfly work, and only what each needs:

AI providers. To write and analyze, we send the relevant text (your strategy, drafts, the post, document or article you're working from, and sample posts) to OpenRouter, which routes it to the AI model provider we use. They process it to return a response.
The platforms you connect, to publish and to read your data: X (through GetXAPI, a third-party X API service that uses your session tokens), Bluesky (your Bluesky server, via the AT Protocol), Threads (Meta's Threads API) and LinkedIn (through Zernio, which holds the LinkedIn connection).
Hosting. Our cloud hosting and database providers store and run Superfly.
When required. If the law requires it, or to protect the rights, safety or property of our users, us or others.

Each of these services has its own privacy policy. What you publish to a platform is governed by that platform's terms and is public there.

4. Platform data

We use data from connected platforms only to provide Superfly's features to you, following each platform's developer terms. You can disconnect a platform at any time in your profile's Settings; for Bluesky this revokes our access, and for LinkedIn it removes the connection from Zernio. For Threads, you can also remove Superfly in Threads (Settings → Account → Website permissions); when you do, or when you ask Meta to delete your data, we disconnect or delete your Threads data automatically.

5. Cookies and your browser

We use one essential cookie, which keeps you signed in for up to 30 days. We don't use analytics, advertising or tracking cookies. Your browser may also store small preferences (such as whether the sidebar is collapsed).

The "Post about this" bookmarklet runs only when you click it, and only on the page you're viewing: it sends that page to Superfly so you can write about it. It doesn't run in the background or on other pages.

6. How long we keep it

Your account data, for as long as you have an account.
Uploads that never get attached to a post, about a day.
Inbox replies and mentions, about two weeks.
Expired sign-in, OAuth and rate-limit records are removed daily.
When you delete a profile or your account, its data is deleted from Superfly right away (copies in backups expire on their normal schedule).

7. Your choices and rights

Delete your account in Account settings: this deletes everything in it and releases connected platforms. Nothing is deleted from the platforms themselves.
Remove a profile or a platform in the profile's Settings.
Revoke connected AI apps in Account settings → MCP connections.
Turn off news discovery in the profile's Settings.

Depending on where you live (for example under the GDPR or California law), you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to complain to a data protection authority. To make a request, write to [contact email]. We'll respond within the time the law requires.

8. Security

Platform credentials and tokens are encrypted at rest (AES-256-GCM); passwords and access tokens for connected apps are stored only as hashes; and traffic to Superfly is encrypted in transit (HTTPS). No system is perfectly secure, but we work to protect your data and will tell you if a breach affects it.

9. International transfers

Superfly and the services above may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards for these transfers.

10. Children

Superfly isn't meant for anyone under 18, and we don't knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.

11. Changes

If we change this policy, we'll update the date above, and for significant changes we'll let you know in the app or by email before they take effect.

12. Contact

[Operator name] · [contact email]

Privacy Policy