Last updated: October 22, 2026

Privacy policy

Timalio publishes to your social accounts what you schedule there. To do that, we handle access tokens to your accounts and the content you entrust to us. This page says exactly what, why, with whom, and for how long.

Who is responsible

Timalio is published by LE MEON, a French SAS, 22 rue Alexander Fleming, 31240 Saint-Jean, France (SIREN 952 263 093), which is the data controller. For any question about your data: contact@timalio.com.

What we collect

• Your account: your email address, your name, and, if you set a password, its hash computed with scrypt. The password itself is never stored. We also keep the date on which you created your account, thereby agreeing to the terms and to this policy, and the version of both texts on that day (the date shown at the top of each page), so that we can establish what you agreed to.
• Your organization: its name, its members, each member's role, and the invitations sent (invited address, intended role). The invitation link is only kept as a hash.
• The content you schedule: the text of the posts, the accounts they target, the publishing dates and times, and the approval log (who wrote, submitted, approved or requested changes, when, and with what comments). The images you attach to a post, with their alt text: the files are stored on the server, inside the European Union, and not in the database.
• The API keys you create: their name, their visible prefix, their hash and the date they were last used. The full key is shown once and is not stored.
• The data coming from the connected networks, detailed below network by network.
• If you join the waitlist on timalio.com: your email address, which form you used, the date, and your IP address.

Data coming from LinkedIn

When an admin connects a LinkedIn profile, Timalio asks LinkedIn for the openid, profile and w_member_social permissions, and keeps only the following:

• The member ID and the member's name, as LinkedIn returns them, so we know on whose behalf to publish and can show the account in the app.
• The access token, and the refresh token when LinkedIn issues one, encrypted with AES-256-GCM before being written to the database: no token is stored there in the clear.
• The ID of each published post, so we can show the link to the publication.

This data serves one purpose only: publishing to that profile the posts your organization scheduled for it, on the chosen date.

Timalio reads nothing else on LinkedIn: not your feed, not your messages, not your connections, and not other members' posts, comments or reactions. The only calls we make to LinkedIn are reading your identity when you connect, and sending the scheduled posts.

When an account is disconnected, the access token and the refresh token are deleted from the database (not merely disabled), and the posts that were waiting on that account do not go out. The member ID, the name and the history of what has been published on that account are kept, so that your organization keeps a record of its publications. You can ask us to delete them (see “Your rights”). You can also revoke Timalio's access from your LinkedIn account settings.

Data coming from Bluesky

When an admin connects a Bluesky account, Timalio goes through the AT Protocol OAuth authorization, with the atproto scope, post creation (repo:app.bsky.feed.post) and image upload (blob:image/*). We keep only this:

• The account identifier (its DID) and its handle, so we know on whose behalf to publish and can show the account in the application.
• The access session, encrypted with AES-256-GCM before being written to the database, as for LinkedIn.
• The identifier of each publication, to show the link to it.

Timalio reads nothing else on Bluesky: not your feed, not your follows, not other accounts' posts. The scope we ask for only allows creating posts and uploading the images that go with them.

Bluesky is an open network: your account is hosted by a server, Bluesky's or another AT Protocol server. That server is the one that issues the authorization and receives your posts.

When an account is disconnected, the session is deleted from the database, as for LinkedIn, and the posts that were waiting on that account do not go out.

Data coming from Facebook and Instagram

Both networks go through a single application at Meta Platforms Ireland Limited and through a single authorization. Timalio asks for five permissions and not one more: pages_show_list to show you the list of your Pages, pages_read_engagement to read a Page's name, pages_manage_posts to post on it, instagram_basic to read the professional Instagram account linked to a Page, and instagram_content_publish to post on it. Timalio only keeps the following:

• The id and the name of the Page or Instagram account you choose to connect, to know where to publish and to show the account in the app. The other Pages the authorization showed us are not stored.
• The Page token, encrypted with AES-256-GCM before it is written to the database.
• Your id at this application (app-scoped user ID), which only Meta can tie back to you. It is the only handle we have to honour the two callbacks Meta requires of us: the one announcing that someone has revoked their authorization, and the one asking for their data to be deleted.
• The id of every published post, to show the link to the publication.

Timalio reads nothing else: not your messages, not your comments, not your insights, not content published by anyone else. The only calls made to Meta are reading your identity and your Pages when you connect, and sending the scheduled posts.

When an account is disconnected, the token is deleted from the database, as for LinkedIn, and the posts that were waiting on that account do not go out. You can also revoke Timalio's access from your Facebook account settings, which the two callbacks above report to us.

These two networks are not open yet: they are awaiting Meta’s approval. The Timalio app is not published at Meta, so Meta only accepts the authorization of people who hold a role on it. Until that changes, the Timalio app shows them as “Awaiting Meta’s approval” and refuses the connection: only our own accounts are linked, and no customer data goes to Meta. On the day Meta approves the app, this page will state the exact permissions requested then.

Signing in with Google

If you choose “Continue with Google”, Timalio asks for the openid, email and profile permissions. We keep your email address and your name, and nothing else. An address Google reports as unverified is refused. For sign-in, no Google token is kept: Google is only used to identify you, never to act on your behalf (the YouTube channel, described below, is a separate case).

Data coming from YouTube (Google API Services)

Timalio uses the YouTube API Services. By connecting a YouTube channel, you also agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to the data Google processes on that occasion.

When an admin connects a channel, Timalio asks Google for two permissions, and only two: https://www.googleapis.com/auth/youtube.upload (publish a video to the channel you choose) and https://www.googleapis.com/auth/youtube.readonly (read the channel and its statistics). We keep:

• The channel ID and the channel name you choose, so we know where to publish and can show it in the app.
• The access token and the refresh token, encrypted with AES-256-GCM before being written to the database: no token is stored there in the clear.
• The ID of each published video, so we can show the link to the publication.
• Four counters read through youtube.readonly: the channel's subscriber count, and the views, likes and comments counts of the videos published through Timalio. These are numbers, kept to show their evolution in the app's analytics screen, and nothing else.

youtube.upload is used solely to publish to your channel the video you composed in Timalio and asked to schedule or publish: no video is uploaded without an explicit action by your organization. Timalio reads, modifies and deletes nothing else on your channel. It does not read the text of your comments, your subscribers, your playlists or your other videos.

Limited Use. Timalio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice, this data is used only to provide the user-facing feature in the app (publishing to your channel and showing its statistics). It is not sold, not transferred to third parties beyond what this page describes, not used for advertising, not read by humans except with your consent, for security purposes or to comply with the law, and not used to train an artificial intelligence model.

Revoking access. You can remove Timalio's access to your Google account at any time at security.google.com/settings/security/permissions, without going through Timalio. Disconnecting the channel from the app deletes the token from the database at once, and the videos waiting on that channel do not go out.

This network stays closed to customers until Google has finished verifying the application: only our own accounts are connected to it.

The emails we send

Timalio sends three emails, and not one more: resetting a password, inviting someone into an organization, and telling approvers that a post is waiting for review. Each one answers an action somebody took. There is no newsletter, and you will get no marketing email from us.

Sending is handled by Resend, which receives on that occasion the recipient's address and the content of the message: its subject, the name of the organization or person concerned, and the link to open. The text of your posts is never copied into an email: the approval notice says there is something to review, not what it contains.

Payment

Payment is handled by Stripe. Your card is entered in a window served by Stripe: no card data passes through Timalio or is stored by it. We keep only the Stripe identifiers of your customer record and of your subscription, its status, the number of accounts it covers and its renewal date. To create your customer record, we send Stripe the email address of the admin who subscribes and the name of the organization.

What we do not do

• We do not sell or rent your data to anyone.
• We publish nothing your organization has not scheduled. A tool connected through the API or the MCP server is no exception: it follows the same rules as the interface, approval workflow included when it is switched on.
• We train no artificial intelligence model on your content, and we send it to no artificial intelligence service.

Why we process this data

• To perform our contract with you: creating your account, publishing what you schedule, billing the subscription.
• Our legitimate interest in protecting the service: limiting repeated sign-in attempts, keeping technical logs, making backups.
• Our legal obligations, in particular keeping invoices.
• Your own request, for the waitlist: you gave us your address so we would let you know.

Providers and third-party services

Your data is shared only with the following services, each for the purpose stated:

• Hostinger International Ltd (Cyprus): hosting of the server that runs the website, the application and the database, inside the European Union.
• Cloudflare, Inc. (United States): domain name registration and DNS resolution. Cloudflare neither receives nor keeps the content of your posts.
• Stripe: payment and billing of the subscription.
• Google: signing in with a Google account, if you choose it, and publishing to your YouTube channel through the YouTube API Services, if you connect one. Separately, the website and the application load their fonts from Google's servers (Google Fonts), which receive your browser's IP address in the process.
• Resend, Inc. (United States): sending the three emails described above. Resend receives the recipient's address and the content of the message.
• LinkedIn Ireland Unlimited Company (Ireland): recipient of the posts you schedule on a connected LinkedIn profile, and issuer of the access tokens.
• Bluesky Social PBC (United States): recipient of the posts and images you schedule on a connected Bluesky account. The authorization and the tokens are issued by that account’s hosting server, which may be Bluesky’s or another AT Protocol server you have chosen.
• The Mastodon instance you name (depends on its operator): recipient of the posts and images scheduled on that account. Mastodon is a network of independent instances: the operator and the country are those of the instance you choose.
• Meta Platforms Ireland Limited (Ireland): recipient of the posts and images scheduled on a Facebook Page. Awaiting Meta’s approval: not connectable by a customer yet, see above.
• Meta Platforms Ireland Limited (Ireland): recipient of the posts and images scheduled on a professional Instagram account. Awaiting Meta’s approval: not connectable by a customer yet, see above.

The data Timalio records stays on the server hosted inside the European Union. Stripe, Google, Resend, Cloudflare and Bluesky belong to groups established in the United States and may process the data they receive outside the European Union, under their own policies and safeguards.

The networks that are not open yet

The website shows other networks marked “Coming soon”: Discord, Telegram, LinkedIn Pages, Threads, and TikTok. They cannot be connected today, and no data is sent to them. They are listed here so that you know, before connecting one, where your data would go.

• Discord (United States): recipient of the posts and images sent to the channel whose address you paste.
• Telegram (United Arab Emirates): recipient of the posts and images sent to the channel you connect.
• LinkedIn Ireland Unlimited Company (Ireland): recipient of the posts scheduled on a company page.
• Meta Platforms Ireland Limited (Ireland): recipient of the posts scheduled on a Threads account.
• TikTok Technology Limited (Ireland): recipient of the videos and photos scheduled on a TikTok account, once this network opens.

Threads goes through the same Meta Platforms Ireland Limited application as the two Meta networks described above. On the day it opens, connecting an account will require your explicit consent at Meta, and this page will be updated with the exact permissions requested.

TikTok goes through an application at TikTok Technology Limited (Ireland, the entity that processes European users' data for TikTok). On the day this network opens, connecting an account will require your explicit consent at TikTok for the user.info.basic, video.publish and video.upload permissions (reading your identity, posting your videos and photos), and this page will be updated with the exact permissions requested. You will be able to revoke Timalio's access at any time from your TikTok account settings, which ends the processing. Any integration between Timalio and the TikTok API follows the TikTok Developer Terms of Service and the Content Sharing Guidelines published by TikTok.

How long we keep it

• Access tokens: until the social account is disconnected or replaced.
• Your account, your organization, the published posts and their approval log: for as long as your organization uses Timalio, then until you ask us to delete them. An unpublished post can be deleted at any time from the app.
• If an admin removes you from an organization: your access and your API keys are revoked immediately, but your name stays attached to the approval-log steps you carried out.
• Invoices: ten years, the period required by the French commercial code. They are held by Stripe, together with your customer record (the name of the organization and the email address of the admin who subscribed): that record and those invoices therefore remain at Stripe after your organization is deleted. This is an accounting obligation.
• If you never paid anything (no invoice, no subscription, no payment): there is nothing to keep, and your customer record at Stripe is deleted together with your organization. If Stripe cannot be reached at that moment, your organization is deleted all the same, and the deletion of the record is retried automatically within the following hours.
• Waitlist addresses: until you ask to be taken off.
• Web server logs, which contain IP addresses: about ten days. Sign-in attempts are counted per IP address in memory for fifteen minutes, and are never written to the database.
• Single-use links and codes: the password reset link (valid for thirty minutes), the link that confirms your address and the code used to connect a Telegram channel are only kept as a hash. The row that holds them is deleted automatically, at most thirty days after they expire.
• Technical payment records: when an admin opens the payment window, we record the date, the number of accounts and who opened it, so that a double click cannot create two subscriptions. That row is deleted thirty days after the window closes, whether the payment went through or not. The identifier of each notification Stripe sends us is deleted forty-five days after we receive it.
• Database backups: fourteen days. Deleted data may therefore survive there for up to fourteen days.
• The record of an export or a deletion: with no time limit. When an organization is exported or erased, we keep the date, the type of request, the organization name and the number of items involved, so we can prove the request was actually honored. That record contains no email address and no content: keeping someone's address to prove we erased it would contradict itself on the same line.

Your rights

Three of these rights are exercised directly in the application, without writing to us and without delay, under “Settings” then “Your data”. The application lives at app.timalio.com; if your session has expired, log in first. The three rights:

• Take your data with you (access and portability): an admin downloads in one click everything the organization has entrusted to us: posts, approval log, connected accounts, team, time slots, settings, and the billing history in amounts and dates. In JSON, plus a CSV of the posts for a spreadsheet. The access tokens to your networks, the API key hashes and the card data are not in there: an export that contained them would be a copy of your keys.
• Delete your organization (erasure): an admin erases it directly, along with everything that belongs to it. The deletion is immediate and permanent, and requires retyping the organization's name to confirm. It is refused while a subscription is running: you have to cancel it first, under “Card and invoices”.
• Delete your account: you leave your organizations and your account is erased. If you are the only admin of an organization, we ask you to appoint another one or to delete the organization first, so it is not left with nobody able to administer it.

For rectification, restriction of processing, objection, or any request that cannot be settled from the app (removing an address from the waitlist, for instance), write to contact@timalio.com. We answer within one month.

An admin can disconnect a network at any time from the app: the corresponding token is deleted immediately.

Asking for deletion from the network itself

Some networks let you remove an application's access from their own settings, and ask us at the same time to erase what we hold. We act on those requests, and you can follow their status on a public page, with no account and without writing to us:

app.timalio.com/suppression

The request gives you a confirmation code; it is the only pass to that page, which shows nothing but that code, the status of the request and two dates. Neither your name, nor an organization's, nor the number of accounts involved appears there: the code travels around, and everything it opens must be readable without learning anything about a Timalio customer.

What such a request erases, and what it does not. It erases the access tokens, the identifier the network had given us for you, and the posts still waiting on the accounts you had connected. It does not erase the posts already published, nor the organization itself: those belong to the customer company, not to the person who had connected the account. To erase an entire organization, use “Delete your organization” above, or write to us.

If our answer does not satisfy you, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

Security

Traffic goes over HTTPS. Access tokens are encrypted with AES-256-GCM, passwords hashed with scrypt, API keys and invitation links kept as SHA-256 hashes. Each organization sees only its own data.

Cookies

The timalio.com website sets no cookie. The application sets a session cookie, strictly necessary to keep you signed in (thirty days at most), and a ten-minute temporary cookie during a sign-in with Google or LinkedIn, to check that the answer comes back to your browser. No advertising cookie.

The site measures its audience with Plausible Analytics, a tool that sets no cookie and records no personal data: visits are counted in aggregate, with no individual profile and no identifier that follows you from one site to another. The instance is self-hosted by LE MEON, on this same domain, and shares nothing with a third party. This measurement therefore requires no banner to click.

The payment window is served by Stripe, which may use its own cookies there, necessary for payment security and fraud prevention.

If this page changes

The date at the top of this page is updated with every change.