Privacy policy
Last updated: 19 October 2026
Vane (vaneapp.dev) schedules and publishes your posts to the social networks you connect. This page says what we keep, why, and how to have it removed. We wrote it to match what the service actually does.
TODO before submitting to LinkedIn / Meta: put the company’s legal name and a monitored contact address in the two places marked like this.
Who is responsible
[legal name of the company or person behind Vane] is the controller of the data described here. Contact: [contact email].
What we keep
- Your account: email address, an optional name, your time zone, and your password as a salted PBKDF2 hash (we never store the password itself).
- Your posts: the text and pictures or videos you write or upload, the time you chose, and whether each post was sent or failed, with the link to the published post.
- Your connected accounts: a sign-in token for each network, stored encrypted (AES-256-GCM). Besides the token we keep the public name, username or id of the account, so the dashboard can show which one it is.
- Operational records: a short log of what the service did for you (for example “post sent”), sign-in sessions (stored as a hash), and counters that limit abuse. A request’s IP address is used only to apply those limits.
What Vane does with LinkedIn, Threads and the other networks
Vane asks each network for the smallest permission that lets it publish for you.
- LinkedIn (openid, profile, w_member_social): to learn your name and member id and to create posts on your own profile when you schedule them.
- Threads (threads_basic, threads_content_publish): to learn your username and to publish the posts you schedule.
- Bluesky, Mastodon, Telegram: a Bluesky app password, a Mastodon sign-in on your server, or a Telegram bot token, used only to publish your posts.
Vane does not read your feed, messages, followers or connections, does not post anything you did not schedule, does not sell or share this data, does not use it for advertising, and does not use it to train AI models. Data received from a network is used only to provide the publishing features you asked for.
You can take the access back at any time: remove the channel in Vane, or remove Vane in LinkedIn’s or Threads’ own settings. Removing it there makes the connection stop working and Vane cancels the posts still waiting for it.
Where the data lives and who helps us run it
Vane runs on Cloudflare (hosting, database and file storage). Email codes for sign-in are sent through Resend. These providers process data for us under their own terms; nobody else gets your data, except the network you publish to, which receives the post you asked us to publish.
How long we keep it
Posts, channels and the account stay until you delete them. Removing a channel deletes its saved sign-in and its scheduled posts at once. Expired sign-in sessions and short-lived technical records are removed automatically.
Your choices and rights
You can see and remove your channels and posts in the dashboard. To delete your whole account, or to ask for a copy of your data or a correction, write to [contact email]; we answer within 30 days. Steps are on the data deletion page. If you are in the EU/UK you also have the rights of access, rectification, erasure, restriction and portability, and may complain to your data protection authority.
Cookies
Vane sets one cookie, to keep you signed in (HttpOnly, Secure). There are no advertising or tracking cookies.
Children
Vane is not meant for anyone under 16 and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will say so in the dashboard before it takes effect. The date at the top shows the current version.