Privacy Policy

Flobbie Social (“Flobbie”, “we”, “us”) is a social media scheduler based in the United States. We run the website at flobbie.com and the app at app.flobbie.com. For the personal information described here we are the controller (for the content of a workspace, see “Workspaces” below). You can reach us about privacy at privacy@flobbie.com.

Your account

Your name, email address and password (stored only as a one-way hash, never in a readable form), and, if you add them, a profile photo and your preferred language. If you log in with Google, GitHub or your company’s login, we receive your name and verified email address from that service.

What you put into Flobbie

The posts, drafts, comments, media files, tags, ideas, templates and signatures you create; the people you invite to a workspace (their email address and role); and the settings of your workspace.

Connected social accounts

When you connect a social account (for example on Facebook, Instagram, LinkedIn, X, YouTube, TikTok, Pinterest, Threads, Bluesky or Mastodon), we receive and store the access tokens the platform gives us (encrypted), the account’s name, username, picture and ID, and the statistics the platform provides for it and for your posts, such as followers, likes and views.

Integrations you set up

API tokens (stored as a hash), the AI agents you connect, webhooks, RSS feeds for auto-posting, and the keys of the link shortener you choose (encrypted).

Technical information

To keep you logged in we use a session cookie. To slow down password guessing, we keep your IP address together with the email address you tried for up to one minute after a failed login. Our web server’s access logs leave out IP addresses and request headers, and the app keeps no logs about you in its database. We don’t use analytics, advertising or tracking tools on the website or in the app.

• To provide Flobbie: store your work, publish posts to the accounts you choose at the time you choose, show statistics, and send the emails you need (confirming your email address, resetting your password, invitations) and the notifications you turn on.
• To keep Flobbie secure and working: prevent abuse, fix problems and protect your account.
• To answer you when you contact us.
• To meet legal obligations.

We don’t sell your personal information, we don’t share it for advertising, and we don’t use your content to train AI models.

When you use Flobbie’s AI features (the assistant, the post generator or the in-app agent), what you write and the content needed for the answer are sent to the AI model provider we use, which processes them to create the response.

When you connect your own AI agent (for example ChatGPT, Claude or Cursor) through our API or MCP server, that agent reads and changes your Flobbie data with the access you gave it. What the agent’s provider does with that data is governed by its own terms and privacy policy. You can disconnect an agent at any time in Settings, API & Agents.

We share personal information only as needed to run Flobbie:

• Hosting and storage: Hetzner Online (servers in the European Union, which also store uploaded media) and MongoDB, Inc. (MongoDB Atlas, our database).
• Website delivery and protection: Cloudflare, for flobbie.com.
• Email: the provider that delivers our emails.
• AI: the AI model provider behind our AI features, when you use them.
• Social platforms you connect: they receive the posts and media you publish to them, and their own privacy policies apply to what you publish there.
• Services you choose to use: your link shortener (Dub, Short.io or Kutt), Discord or Slack for webhooks, Unsplash and GIPHY when you search their images, and Google, GitHub or your company’s login if you log in with them.
• Legal reasons: when the law requires it, or to protect the rights and safety of our users, the public or Flobbie.
• A business transfer: if Flobbie is merged, sold or reorganized, your information may move with it under this policy.

Content in a workspace belongs to that workspace. Its members can see and work with it, and the workspace’s owner decides who is a member. If you join someone else’s workspace, the owner of that workspace decides what happens to its content.

Flobbie is based in the United States, and our servers and providers are in the European Union and the United States. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your information for as long as you have an account. When you delete your account (Settings, Profile), we delete your login, your profile and your profile photo. Content you created in a workspace stays with that workspace for its other members. To have a workspace and everything in it deleted, write to privacy@flobbie.com.

Disconnecting a social account deletes its tokens. Sessions end after 14 days without use. Backups may hold copies for a limited time until they are replaced. We keep information longer only when the law requires it.

You can see and change most of your information in the app, and delete your account at any time. You can also ask us to give you a copy of your information, correct it, delete it, or stop or limit using it, and you can object to how we use it. Write to privacy@flobbie.com; we’ll answer within 30 days and may need to confirm that the request comes from you.

If you are in the EEA, the UK or Switzerland

We use your information to provide the service you signed up for (performance of a contract), for our legitimate interests in keeping Flobbie secure and working, to meet legal obligations, and with your consent where we ask for it (you can withdraw it at any time). You can complain to the data protection authority where you live.

If you are in California or another US state with a privacy law

You have the right to know what personal information we collect and how we use it, and to access, correct and delete it. We don’t sell personal information or share it for cross-context behavioral advertising, and we won’t treat you differently for using your rights.

Connections to Flobbie are encrypted (HTTPS), access tokens and keys for other services are stored encrypted, passwords are stored as one-way hashes, and access to our systems is limited. No service is perfectly secure; if something happens that puts your information at risk, we’ll tell you as the law requires.

Flobbie is not meant for anyone under 16, and we don’t knowingly collect information from them. If you believe a child has given us personal information, write to privacy@flobbie.com and we’ll delete it.

We use only what Flobbie needs to work, and no advertising or tracking cookies:

• flobbie_session: keeps you logged in (until you log out, or 14 days without use).
• XSRF-TOKEN: protects your forms against cross-site request forgery.
• flobbie_remember: only if you tick “Remember me”, to keep you logged in on this device.
• Browser storage: your appearance and language, the calendar view you last used and whether you closed the getting-started card. It stays in your browser.

Cloudflare may set a cookie on flobbie.com to tell people from bots.

We’ll update this policy when Flobbie changes. When a change matters, we’ll tell you in the app or by email before it takes effect. The date at the top shows when it last changed.

Questions or requests about your privacy: privacy@flobbie.com.