Privacy policy

Last updated 4 November 2026

Spread lets you write a post once and publish it to your social media accounts. This policy explains what information Spread collects, why, who it’s shared with, and the choices you have. It applies to the Spread website, web app and mobile apps.

Spread is developed and run by 18 Yard Development Studio, a business name of Automate Smart Home Studio Pty Ltd (ABN 46 669 281 583), South Australia (“we”, “us”). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Questions go to domenic@18yard.dev.

What we collect

• Your account: your email address, your name if you add one, and your password, which our authentication provider stores in hashed form. We never see it in plain text.
• Accounts you connect: when you connect Facebook, Instagram, Threads, TikTok, X or YouTube, we receive that account’s ID, name, username and profile picture, plus the access tokens that let Spread post for you. Tokens are encrypted before they’re stored.
• What you post: your captions, photos and videos, the accounts and times you choose, each platform’s settings, and the result of each post, including links to it once it’s live.
• Notifications: if you turn them on, your device’s push token and your notification choices.
• Beta applications: what you tell us when you apply for early access to a platform.
• Subscriptions: your plan and whether it’s active. Payments are handled by the App Store, Google Play or our web checkout provider. We don’t see or store your card details.
• Technical information: request logs (including your IP address) and error reports, including the app version you’re using, to keep the service running and fix problems.

How we use it

• To publish your posts to the accounts you connect, at the times you choose, and show you how each one went.
• To send the notifications you asked for, such as when a post goes out or needs attention.
• To run your account, apply your plan’s limits and handle your subscription.
• To keep Spread secure, prevent misuse and answer your support requests.

We only use data from social platforms to post for you and show you the results. We don’t read your feed, messages or followers, we don’t sell your information, and we don’t use it for advertising.

Social platforms

When Spread posts for you, the platform receives the content you chose to post and handles it under its own terms and privacy policy. You can disconnect an account in Spread at any time, and you can also remove Spread’s access from the platform itself:

• Facebook and Instagram: Settings → Apps and websites (or Business integrations), then remove Spread.
• Threads: Settings → Account → Website permissions, then remove Spread.
• TikTok: Settings and privacy → Security and permissions → Apps and services permissions.
• X: Settings and privacy → Security and account access → Apps and sessions → Connected apps → Spread → Revoke app permissions.
• YouTube: Spread uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. You can remove Spread’s access at Google security settings.

When you remove Spread from Facebook, Instagram or Threads, the platform tells us and we delete that connection and its tokens.

Who we share it with

We use these service providers to run Spread. They process information for us and only as needed to provide their service:

• Supabase: accounts, database and file storage, hosted in Sydney, Australia.
• Vercel: hosting for the website, web app and API.
• RevenueCat: subscription management, with payments through Apple, Google or our web checkout provider.
• Expo, Apple and Google: delivering push notifications to your devices.

Some of these providers store or process information outside Australia, including in the United States. We may also disclose information if the law requires it, or to protect the rights and safety of our users or others.

Requests from public authorities

We only disclose personal information to police, courts or other public authorities when the law requires it. For every request we review whether it is lawful and valid, challenge requests we believe are unlawful or too broad, disclose only the minimum information needed, and keep a record of the request, our response and the reasons for it.

How long we keep it

• We keep your information while your account is open.
• Files you upload but never post are deleted within a day. Files for a post you cancel before anything goes out are deleted when you cancel it.
• Disconnecting an account deletes its tokens. Your past posts stay in your history.
• Deleting your account removes your profile, connected accounts, posts and files. Copies may remain in backups for a limited time before they’re overwritten. See how to delete your data.

Keeping it safe

Connection tokens are encrypted at rest, everything travels over HTTPS, and access is limited to Spread’s own servers and the providers listed above. Your files are private and shared with a platform only through short-lived links when posting. No system is perfectly secure, but we work to protect your information and will tell you if a breach is likely to cause you serious harm.

Your choices and rights

• You can see and change your account details in Spread at any time.
• You can ask us for a copy of your information, ask us to correct it, or ask us to delete it, by emailing domenic@18yard.dev.
• You can turn notifications off in Spread or in your device settings.
• If you have a privacy complaint, email us first and we’ll respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner.

Children

Spread isn’t meant for anyone under 16. If you believe a child has given us their information, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.