Tokens are never logged
Access tokens, refresh tokens, authorization headers, and session secrets are excluded from logging by policy and in code.
Your accounts, your media, your call.
Connecting a social account to a third-party tool is a real decision. This page says plainly what Selfpost holds, what it never records, and how to take it all back.
Launch updates only. No spam. Privacy policy
Every connection, and its actual state
Connected accounts show which platform they belong to, what they are permitted to do, and whether the connection is still healthy.
Nordlicht StudioDU
WorkspaceReadiness check
1 needs attentionInstagram Reels — account connected, caption and cover setReady
TikTok — privacy chosen, commercial disclosure answeredReady
YouTube Shorts — uploads stay private until Google approves Selfpost's API auditAction needed
Every destination is checked before you schedule, so a platform rule stops the post here rather than at the publish time you were counting on.
/w/[workspaceId]/composerBoring practices, stated out loud
Nothing here is exotic. It is worth writing down because the alternative is asking you to assume it.
Least access requested
Each permission is requested for a stated publishing or analytics purpose, and the reason is shown at the point of connection.
Workspace ownership checked
Every media, post, account, and analytics operation verifies workspace membership server-side. A client-supplied identifier is never trusted.
Disconnect and delete
You can disconnect an account or request deletion of associated data at any time, through a documented route.
Media stored on your behalf is served through signed, time-limited URLs rather than left publicly addressable.