Privacy

Last updated 14 May 2026

The short version. Hoist holds the access tokens and post content you give it so it can publish on your behalf. We don't sell data. We don't show ads. We don't train AI models on your posts. You can delete everything at any time.

Who runs Hoist

Hoist is operated by X3 E-Commerce LLC, a Wyoming company. If you need to reach a human about your data, email privacy@hoistsocial.com.

What we collect

Account info. Your email address (for sign-in) and the name you give your brand workspaces.
Platform connections. When you connect TikTok, Instagram, X, YouTube or any other platform to Hoist, we store the OAuth access token that platform issues to us. We do not see or store your password for those platforms.
Post content. The videos, images, captions and schedules you give Hoist to publish on your behalf.
Audit logs. When a post is published or fails, we keep a record of the time, target platform and result so you can debug it.

What we do with it

We use this data for one purpose: to publish your posts to the platforms you told Hoist to publish to, at the times you told Hoist to publish them. That's it.

We do not:

Sell, rent or share your data with third-party advertisers.
Train AI models on your content.
Read your private DMs or messages from connected platforms.
Post anything you did not explicitly schedule.

Who we share it with

To do its job, Hoist sends data to:

Cloudflare — our infrastructure provider (hosting, database, storage, queues).
The platforms you connect — TikTok, Instagram, X, YouTube, etc. We post your content to them as you direct.
Resend — for sending you sign-in links and notification emails.
Anthropic — if you ask Hoist to generate or refine a caption, that prompt is sent to Anthropic's API.

None of these providers may use your data for their own purposes under our agreements with them.

Where it lives

Your data is stored in Cloudflare data centres in the United States. Cloudflare provides encryption at rest and in transit. Access tokens are stored in encrypted KV storage and are only decrypted in-memory inside the publishing worker when we need to make an API call on your behalf.

How long we keep it

Account email: until you delete the account.
Access tokens: until you disconnect the platform or the token expires.
Post content: until you delete the post or the brand workspace.
Audit logs: 90 days.

Your rights

You can, at any time:

Disconnect any connected platform from inside Hoist (revokes the token immediately).
Delete a brand workspace (removes all posts, tokens and audit logs for that brand).
Delete your entire account (wipes everything we hold about you).
Email privacy@hoistsocial.com and ask for a copy of everything we hold on you, or ask us to delete it.

If you are in the EU, UK, California or any other jurisdiction with data-protection rights, you have whatever rights that law gives you and we will honour them.

Cookies and tracking

Hoist uses one cookie: a session cookie that keeps you logged in. We do not run analytics, advertising trackers, or fingerprinting on hoistsocial.com.

Children

Hoist is not for anyone under 18. We do not knowingly hold data on minors.

Changes to this policy

If we change anything material we will email every account holder before the change takes effect. The latest version always lives at hoistsocial.com/privacy.

Contact

Privacy questions: privacy@hoistsocial.com
Everything else: hello@hoistsocial.com