Privacy policy
Effective October 3, 2026
This BrightBean Studio service is operated by Anji Chunyun Furniture Co., Ltd. (安吉春韵家具有限公司). Contact mandy@pandasofa.com about privacy, access or deletion. This policy applies to this independently operated installation, not to the upstream software project's services.
Information we process
- Account information you provide, such as your email address, profile details and password hash; organization and workspace memberships; and login sessions.
- Connected social-account identifiers, display names, avatars, OAuth access and refresh tokens, granted permissions and token expiry dates.
- Content you upload or create: media files, captions, drafts, schedules, comments, approvals and platform-specific posting settings.
- Publishing responses, post identifiers, status and errors; available post or account performance information. Supported inbox features process messages or comments only for connected accounts and granted permissions.
- Technical information needed to operate the service, such as request logs, IP addresses used for abuse prevention, timestamps and browser session information.
Why we use it
We use this information to authenticate users, separate workspaces, connect authorized accounts, store and preview content, carry out requested publishing and scheduling, display results, provide support and protect the service from abuse. We do not sell your personal information or use connected-platform data for advertising targeting.
When information is shared
When you authorize a connection or submit a post, relevant account and content data is exchanged with the selected social platform. Members and authorized clients of your workspace may see information according to their access roles. Infrastructure providers process data to host the service and deliver traffic; this installation currently uses a Cloudflare HTTPS tunnel. We may disclose information where legally required.
Media intended for publishing is served through publicly reachable file URLs so that social platforms can fetch it. Anyone who obtains such a URL may access the file. Do not upload confidential material to the publishing media library. Files may already have been fetched by a platform before you remove them here.
Cookies and security
The service uses session and CSRF cookies and may store interface preferences such as timezone. Passwords are stored as hashes and connected-account credentials are encrypted at rest by the application. HTTPS protects traffic to the public endpoint. No service can promise absolute security.
Retention and deletion
Account data and content are retained while needed to provide your workspace and requested functions. You can remove content or disconnect social accounts in the application. Logs and retained backup copies may persist after an item is removed; contact us for information or an erasure request. We will assess requests, including any retention required by law or an unresolved security incident.
Disconnecting an account stops its use in this workspace and attempts to revoke its authorization. You can also revoke access in the social platform's own settings. Deleting data here does not automatically remove posts already published on social platforms. See our deletion instructions.
Your choices
Contact us to request access, correction, a copy or deletion of your data, or to raise an objection or privacy concern. Include your account email and the relevant workspace; do not send passwords or access tokens. We may need to verify that you are authorized to make the request.
Other platforms and changes
Social platforms process data under their own policies, including TikTok's Privacy Policy and Google's Privacy Policy. The service is intended for adults managing their own or authorized business accounts. We may update this policy as the service changes and will revise the effective date.