Last updated 11 September 2026
Privacy policy
ManyHandles publishes to social accounts you own and shows you what came back. This page says exactly what we store to do that, for how long, and who else sees it. No tracking, no ads, no selling data.
Who we are
ManyHandles is operated by Demant, a general partnership (VOF) registered in the Netherlands, trading as ManyHandles, Chamber of Commerce (KvK) no. 93149662, De Nieuwe Erven 3, Unit 14061, 5431 NV Cuijk, the Netherlands. We are the controller of the data described here. Questions and requests: privacy@manyhandles.com.
What we store and why
Everything below lives in our own database on servers run by Hetzner Online GmbH, on servers in Helsinki, Finland (EU).
| What | Why | How long |
|---|---|---|
| Your account: name, email, password (hashed) or your Google account id and email if you sign in with Google, profile picture link | So you can sign in | Until you delete your account |
| Sign-in sessions: session token, expiry, IP address, browser identifier | To keep you signed in and to spot abuse | Until you sign out or the session expires |
| Your workspace: name, members, roles, invitation emails, and the account groups you name | So a team can share one set of accounts | Until the workspace is deleted |
| Connected social accounts: platform, account id, handle, display name, avatar link, the access level you chose, your daily cap | To publish and read results for that account | Tokens are deleted the moment you disconnect. The account name stays with its history until you delete the workspace |
| Platform access tokens and the permissions you granted | To act on your behalf at the platform | Encrypted at rest (AES-256-GCM). Deleted on disconnect |
| Media you upload, captions, hashtags, saved drafts (including account choices, platform settings and time windows), and the posts you schedule | To prepare, resume and publish your content | Until you delete the piece, post or workspace |
| Post numbers: views, likes, comments, shares, saves, reach | To show what earns | Refreshed for 30 days after publishing, then kept as history |
| Comments other people leave on your posts: their platform id, username, the text and time | To show them in your inbox so you can reply | Refreshed for 30 days after publishing, kept with the post until you delete it. YouTube comments are deleted 30 days after we read them |
| Trackable links you create and when they were clicked | To show which post sent the click | Click records hold only a timestamp. No IP address, browser or referrer is stored |
Media you upload is stored on our server and fetched by the platforms from a long, unguessable link. That link is not listed anywhere, but anyone who has it can open the file. Do not upload anything that must stay private.
We do not run analytics or tracking scripts, we do not use advertising networks, we do not process your content with AI, and we do not sell or share your data with anyone beyond the parties named below.
Legal basis
- Performing our contract with you (GDPR art. 6(1)(b)): your account, workspace, connected accounts, media, posts, numbers and comments.
- Our legitimate interest in keeping the service secure (art. 6(1)(f)): session IP address and browser identifier.
- Your consent (art. 6(1)(a)): every platform connection is a permission screen you approve at the platform and can withdraw at any time.
Who else sees your data
- The platforms you connect: TikTok, Instagram, Facebook and Threads (Meta), YouTube (Google) and Bluesky. We send them your media, captions and posting options, and read back post ids, numbers and comments. Their own privacy policies apply to what they do with it.
- Google, if you choose "Continue with Google": we receive only your name, email address and profile picture.
- Hetzner Online GmbH: hosting, servers in Helsinki, Finland (EU).
- Resend: delivers the few emails we send you (password reset, account deletion confirmation). They see your email address and the message.
- Cloudflare: domain name service for manyhandles.com only. Traffic to the app does not pass through Cloudflare.
Your data stays inside the EU except for what you send to the platforms themselves.
YouTube
ManyHandles uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to what Google does with your data.
Through the YouTube API we upload the videos you schedule, read your channel name and id, read each uploaded video's processing status and its view, like and comment counts, and, at the Post + Inbox level, read the comments on your own videos and post the replies you write. We store: your channel id and name, the id of each video we uploaded, its latest counts, and the comments we read (author name and id, text, time). We never download videos from YouTube and we never read data about other channels.
Stored YouTube comments are deleted 30 days after we read them. Your channel name and picture are re-read from YouTube every few hours so what we show matches YouTube. Video counts are kept as your history for as long as your account exists. You can revoke our access at any time on your Google security settings page, in addition to disconnecting inside ManyHandles. When a grant is revoked, we stop using it and delete the comments and counts we held for that channel within 7 days.
Instagram, Facebook and Threads
Through Meta's APIs we publish to the Instagram accounts, Facebook Pages and Threads profiles you connect, read the numbers those posts earn, read comments on them and send the replies you write. You can remove ManyHandles at any time under "Apps and websites" in your Meta account settings. To have every piece of data we hold about your Meta accounts deleted, follow the data deletion instructions.
TikTok
Through TikTok's API we publish the videos and photos you schedule to your own TikTok account and read the numbers they earn. You can remove ManyHandles at any time under "Manage app permissions" in your TikTok settings.
Bluesky
Bluesky has no login screen for apps: you connect with an app password you create in Bluesky under Settings → Privacy and security → App Passwords. We send it to Bluesky once to sign in and never store it; what we keep is the session it returns (encrypted, like every other platform token), which we renew ourselves. Through the AT Protocol we publish your posts, read the replies and counts they earn and send the replies you write. Delete the app password in Bluesky at any time to cut off our access, in addition to disconnecting inside ManyHandles.
Cookies
- Sign-in session (better-auth.session_token): keeps you signed in. Strictly necessary.
- Theme (mh-theme): remembers light or dark mode for one year.
- Connection check(mh_<platform>_state): a one-time code while you connect an account, deleted when you return.
We remember your last account selection separately for each workspace in your browser’s local storage, until you clear that storage. Captions and platform tokens are not stored there. Saved draft content and settings live in our database as described above.
No third-party cookies, no cross-site tracking.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to privacy@manyhandles.com from the email address on your account and we answer within 30 days. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Disconnecting an account inside ManyHandles deletes our copy of its access token at once and, where the platform offers it (Google, TikTok), tells the platform to forget the grant too. Deleting your whole account and everything in it, and downloading a copy of your data, are both in Settings inside the app. Details on the data deletion page.
Security
All traffic is encrypted in transit. Platform tokens are encrypted at rest with a key that is never stored next to the data. Passwords are hashed. Access to the servers is by key only. If we ever discover a breach that affects you, we tell you without undue delay.
Changes
When we change what we store or who sees it, we update this page and the date at the top, and we email every account holder about material changes before they take effect.