Mongoose Post

Privacy policy

Effective October 21, 2026. Mongoose Post is run by Mongoose Athanor LLC, 1001 S. Main St., STE 600, Kalispell, MT 59901, USA. Questions: privacy@mongooselabs.app.

What Mongoose Post does

It sends posts you write (or that a tool you connect, such as Mongoose Studio, writes for you) to social accounts you connect, on the schedule and within the limits you set. It only posts. It does not like, follow, repost or message anyone, and it does not read your feeds.

What we store, and why

• Your sign-in. You sign in with your Mongoose account. We keep the anonymous identifier Mongoose gives this app and your email address, and one essential sign-in cookie (secure, HTTP-only, first-party, valid for up to 60 days or until you sign out).
• Connected accounts. For each account you connect: the platform, the account's public handle and name, its id on the platform, and the credentials you give us to post for it (an app password, a channel's posting token, a webhook address, or a Zernio API key). Credentials are encrypted at rest (AES-GCM), decrypted only for the moment a post is sent, and never shown in a page, written to a log, or included in an export. Not even you can see them again after connecting.
• Your posts. The text, links, images and video you add, each account's version of the post, its schedule and status, and what the platform answered (the post's address, or the reason it refused).
• API keys you make: their names and a one-way hash of each key. We can't see a key after showing it to you once.
• An activity log of who connected, approved, paused or changed what in your workspace. It never contains credentials.

Who receives what

• The platforms you post to (Bluesky, Telegram, Discord, and through Zernio: TikTok, Instagram, YouTube, X, Threads, LinkedIn, Facebook, Pinterest) receive the post you scheduled for that account and the credentials needed to make it. What they do with it is set by their own policies.
• Zernio (zernio.com), for accounts you connect through it, receives the post and its media to publish them for you.
• Cloudflare hosts Mongoose Post and stores its data. It also counts page loads as aggregate, cookieless page-performance statistics.
• Images and video you add to a post have an unguessable public address, because some platforms fetch media by address. Anyone with that address can see the file.

We don't sell your data, use it for advertising, or train AI models on it.

How long we keep it

As long as your account exists. Removing a connected account deletes its credentials and its sends. Deleting a post removes it here (a post that has gone out stays as the record of what was published until you delete your account).

Deleting your data

In the app: Settings → Delete your account. That deletes your workspace, every connected account and its credentials, every post, file and API key, and your sign-in. It doesn't delete posts already published on a platform: delete those on the platform. You can also email privacy@mongooselabs.app from your account's address and we'll do it for you within 30 days.

To stop Mongoose Post using an account without deleting anything here, remove it under Accounts, or revoke its access on the platform (for Bluesky, delete the app password; for Discord, delete the webhook; for Telegram, remove the poster from the channel).

Children

Mongoose Post is not for anyone under 13, and in some places the age is higher.

Changes

If this policy changes in a way that matters, we'll say so in the app before the change takes effect.