Privacy Policy
This Privacy Policy governs the manner in which TOOPOST collects, uses, maintains and discloses information collected from users of the website.
In this Privacy Policy, "We", "Us", "Our" and other similar references mean TOOPOST and "You" and "Your" and other similar references mean a specific "User" of the service.
This privacy policy applies to the Site and all products and services offered by TOOPOST.
Personal Identification Information
We may collect personal identification information from Users in a variety of ways, including when Users visit our site, register on the site, fill out a form, and in connection with other activities, services, features or resources we make available on our Site.
Non-personal Identification Information
We may collect non-personal identification information about Users whenever they interact with our Site.
Web Browser Cookies
Our Site may use cookies to enhance User experience. Users web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them.
How We Use Collected Information
TOOPOST may collect and use Users personal information for the following purposes:
- To improve our Site. We may use feedback you provide to improve our products and services.
- To send periodic emails. We may use the email address to send User information and updates pertaining to their order.
How We Protect Your Information
We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information.
AI Clients and MCP Connections
When you connect Toopost to an AI client such as ChatGPT or Codex through MCP, the client receives the data returned by the tools it calls on your behalf. Depending on the permissions you authorize, this can include post titles, article content, source URLs, dates, authors, feed information, saved or liked posts, and reading interactions or aggregate account statistics.
The available read permissions are posts:read, feeds:read, and interactions:read. OAuth authorization connects the AI client to your Toopost account. The current Toopost plugin provides reading and analysis tools; it does not provide tools to edit, delete, or publish your posts.
The AI provider processes data it receives under its own privacy policy and your settings with that provider. For OpenAI clients, see OpenAI's privacy policy. Review your provider's settings before connecting an account containing private source material.
You can disconnect the integration in your AI client's connection settings to stop it from making further requests. Disconnecting does not remove information already received by that provider. Contact [email protected] for questions about your Toopost data or connected access.
Account and Source Data
Toopost processes account identifiers such as your username and email, your connected source settings, imported posts and article content, and your reading, saved, or liked interactions to provide your inbox, search, account access, and requested integrations. MCP requests use the query and tool parameters supplied by your AI client to retrieve relevant material from your connected account.
Product Analytics and SplitHub
We use SplitHub (splithub.io) on our website and in the Toopost web, iOS and Android apps to understand usage, measure registrations and subscription purchases, and evaluate product improvements and experiments. SplitHub receives page or screen visits, timestamps, engagement such as time spent and scroll depth, and events such as registration, adding a source, and purchasing a subscription. Purchase events include the plan and platform, not card numbers or payment credentials.
SplitHub uses a randomly generated visitor identifier and a session identifier. When you sign in to Toopost, we associate these visits with your account UUID. This is pseudonymous data linked to your account, not anonymous data. We do not send your name or email address as analytics profile fields. Requests also expose network and browser information needed to receive them, including IP address and user agent; analytics may include approximate location (country, region and city inferred from the network), browser, operating system and device type. We do not request GPS location for SplitHub analytics. Our website may also send referring pages, campaign parameters and experiment assignments.
Mobile app version 2.0.4 removes query parameters, private article or collection identifiers, page titles and referrers from SplitHub event payloads before transmission. We do not send article bodies, saved content, AI conversations, passwords or authentication tokens as product analytics events. SplitHub analytics is used to understand and improve Toopost, not to combine your activity with other companies' data for targeted advertising.
The SDK stores visitor and account identifiers in local storage, session identifiers in session storage, and may set a first-party visitor cookie with a one-year lifetime. Local storage remains until cleared. Signing out stops attaching your account UUID to subsequent events; it does not delete earlier analytics. Clearing website data or the app's local data removes locally stored identifiers and may also sign you out. To request access to or deletion of analytics linked to your account, contact [email protected]. We assess retained analytics separately from active account records and coordinate applicable deletion requests with our analytics provider.
Service Providers
Cloudflare provides hosting, database, and connection infrastructure for the Toopost service and MCP server. Vercel hosts our marketing website. SplitHub provides the analytics and experimentation described above. If you connect an AI client, its provider receives the tool results needed for your request. Our marketing website also uses Google advertising services and Meta's Facebook Pixel for advertising measurement; these services may receive browser, cookie, and page-visit information. Browser privacy settings and blocking third-party cookies can limit this collection.
Retention and Your Controls
Account and source data are kept to provide the service while your account remains active, unless you remove data or request deletion. Successful account deletion removes account records and associated personal data from the active database during the deletion process. Cloudflare D1 recovery history can retain earlier database versions for up to 30 days. Where Cloudflare Workers logs are enabled, their retention is up to seven days.
The MCP server's locally issued access-token records expire after one hour, refresh-token records after 30 days, and client-registration records after 30 days. Tokens issued by the main Toopost authorization service follow that service's expiry. Your AI provider has its own retention settings for information it has already received.
You can manage your sources in Toopost and disconnect AI integrations in the AI client's connection settings. For account deletion, access, correction, or questions about retained information, contact [email protected]. Disconnecting an AI client does not itself delete your Toopost account or copies already held by that provider.
Contact Information
If you have any questions about this Privacy Policy, please contact us at [email protected].
Last updated: October 21, 2026