Privacy Policy

Status and controller

Effective date: 16 August 2026. Last updated: 16 August 2026. This notice explains how ChannelCockpit handles personal data on the public website and in the protected private-beta service.

Controller

Amed Bozo is the controller for ChannelCockpit's own processing purposes and is a German sole proprietor (Einzelunternehmer), trading as ChannelCockpit. The business started on 1 August 2026.

The monitored email address above is the contact for privacy-rights and account-deletion requests. No data protection officer has been designated. Privacy questions can be sent directly to the controller.

The controller is established in Hesse. The competent supervisory authority is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit. You may also complain to another supervisory authority competent for your habitual residence, place of work or the place of an alleged infringement.

Scope

This notice covers:

• the static public website at channelcockpit.app;
• the authenticated ChannelCockpit private-beta application and its backend;
• account, security, platform-connection, analytics, publishing-planning, media, export, disconnect and deletion operations described below.

ChannelCockpit is a free, invite-only and closed private beta for individuals, creators and businesses. Account holders must be at least 18 years old. There is no public sign-up, payment or billing, team role or shared login.

The English-first service is offered worldwide. Account holders may connect channels or accounts they own, directly control, manage for their own organization or are expressly authorized by a customer to manage. Ownership or authority is a product condition for connecting a channel. It does not determine whether ChannelCockpit is a controller or processor under data-protection law.

YouTube, TikTok, Instagram and Facebook operate their own services under their own terms and privacy notices. This notice covers ChannelCockpit's side of an authorized connection; it does not replace a connected platform's notice or govern data that remains in that platform.

In plain language

• The public pages remain static and have no marketing tracker. The Contact page provides a same-origin form that forwards accepted messages to the monitored support mailbox.
• The private-beta app first passes through an outer Cloudflare Access gate and then uses a separate Firebase app account.
• Connecting a platform is optional. ChannelCockpit then handles only the authorized account and source data needed for the selected features.
• Drafts, captions or media can identify other people. The limits and rights route for that content are explained below.

Key terms used here

• Public site means the static marketing and Legal pages at channelcockpit.app.
• Protected app means the private-beta application behind Cloudflare Access; app account means the separate Firebase Authentication identity used inside it.
• Connected platform means an optional user-authorized YouTube, TikTok, Instagram or Facebook connection.
• Publishing content means drafts, captions, settings, schedules and uploaded media supplied for review-first planning inside ChannelCockpit.

Controller role and DPA-gated processor use

For its own purposes, including public-site delivery, account administration, service security, legal compliance and other processing for which it determines the purposes and means, ChannelCockpit acts as controller. This includes its direct account-holder relationship and the security, abuse-prevention and compliance processing described in this notice.

GDPR roles depend on the processing facts and applicable law. Whenever ChannelCockpit processes personal data on behalf of a controller, ChannelCockpit acts as processor and the Article 28 GDPR boundary applies, including for a channel managed for the account holder's own organization if the role facts establish a controller-processor relationship.

Before any processor-scope personal data is processed, a fact-specific role assessment, electronically evidenced acceptance of the applicable Data Processing Addendum, documented instructions and a rights-assistance path must be in force. An expressly authorized customer channel remains product-eligible to connect, but that authorization does not activate processor use or remove these conditions. Until all of those conditions are met, ChannelCockpit must not be used for any processor-scope personal data.

This notice does not categorically classify private or household use; roles in any such context depend on the processing facts and applicable law.

Data and sources

Data you provide

• email address and password handled by Firebase Authentication, optional display name and account-preference choices;
• timezone, language, date and time formats, onboarding and interface settings;
• publishing drafts, internal titles, captions, platform-specific overrides, schedules, review choices, uploaded media and its user-supplied file name, which is sanitized before storage;
• commands to connect or disconnect a platform, export data or permanently delete the account;
• privacy, support or deletion messages sent to the monitored email contact, plus the information needed to understand the request and verify the requester's authority;
• for the Contact form, only a reply email, selected topic and plain-text message; the hidden website field is an abuse trap and must remain empty.

The current service does not collect payment, billing, subscription, team-role or shared-login data because those capabilities are not available.

Data from your device and use of the service

• network and request data such as IP address, request time, requested resource, user-agent and response or error status;
• app platform, environment and release information, integrity attestations and tokens, rate-limit state and bounded diagnostic metadata;
• account identifier, authentication and verification state, creation and last-sign-in time, operation revisions, timestamps and lifecycle state.

Data from connected platforms

• granted scopes, token validity and expiry, provider account, channel, profile or Page identifiers, names and avatars;
• authorized profile, channel, Page, post and video metadata, source-specific insights, statistics and freshness or coverage information;
• connection status and provider responses needed to display the authorized current account and source data.

Data created by ChannelCockpit

• source and account bindings, connection state, dashboard layout, scheduled-post, review, preflight, queue, operation and provenance records;
• private media object paths and persisted media metadata, including the sanitized user-supplied file name, content type, size, hash, technical validation and malware-scan results;
• redacted operational logs, pseudonymized rate-limit subjects, export lifecycle records and hashed deletion receipts.

People represented in user-provided content

Drafts, captions or uploaded media can contain personal data about people other than the account user, including anyone named, depicted, heard, tagged or otherwise identifiable. Categories can include names or usernames, image or voice, statements and context, and platform references. The source is the account user and is not necessarily the affected person.

Processing of that content is limited to the user-requested publishing journey: private storage, technical validation and malware scanning, review, scheduling and, after explicit user review and confirmation, conditional transmission to the chosen connected platform. The applicable service providers, recipients, retention windows and rights routes are described below.

Account holders must provide only content connected with a channel they are product-authorized to connect, must have lawful authority for the content and must minimize personal data about other people. Channel ownership or authority does not decide the GDPR role. If ChannelCockpit processes that content on behalf of a controller, the role-assessment, DPA, instructions and rights-assistance conditions above apply regardless of whether the channel belongs to a customer or is managed for the account holder's own organization. Account holders must not upload or otherwise provide special-category personal data in the current private beta, including health, biometric, political, religious, trade-union or sexual-life information. Anyone represented in content can contact support@channelcockpit.app without having an account.

Purposes and legal bases

References to the GDPR mean Regulation (EU) 2016/679. The legal basis depends on why the particular data is used, as set out below.

Public-site delivery and security — Article 6(1)(f) GDPR

Firebase Hosting receives ordinary IP and HTTP request data to return the static page or asset requested by the visitor. Firebase may also process this data for service operation, security and usage analysis as described in its privacy information. ChannelCockpit's legitimate interests are availability, integrity and abuse prevention. ChannelCockpit does not use Hosting request data for marketing, audience measurement or visitor profiles. Firebase's stated retention is described below.

Providing the requested service — Article 6(1)(b) GDPR

Account authentication, settings, platform connections, source-aware analytics, publishing preparation and review, calendar and queue state, media handling, export, disconnect and account deletion are processed to provide functions requested by the user or take requested pre-contractual steps.

If a person uses an authorized business account but is not the contracting party, ChannelCockpit relies on Article 6(1)(f) GDPR for the limited account and contact data needed for ChannelCockpit's own account administration and security. The legitimate interests are serving the authorized business account and protecting it from misuse. That basis does not determine the role for personal data handled through a connected channel. Where ChannelCockpit acts as processor, the relevant controller determines the legal basis and ChannelCockpit processes only under the activated DPA and documented instructions described above.

Security and reliability — Article 6(1)(f) GDPR

Cloudflare Access, App Check, abuse prevention, rate limits, redacted logs, error reporting, integrity checks and incident diagnosis protect accounts, platform credentials and service availability. ChannelCockpit's legitimate interests are preventing unauthorized use, maintaining a secure private beta and diagnosing faults while limiting diagnostic data to what is necessary.

Content about other people

An account holder's contract, channel ownership or authority does not by itself make personal data about another person lawful or establish the GDPR roles. The person responsible as controller must have a legal basis and keep third-party personal data to what is necessary. ChannelCockpit relies on Article 6(1)(f) GDPR for the limited security, validation and abuse-prevention steps for which it determines the purposes and means. Whenever ChannelCockpit otherwise processes the content on behalf of a controller, the processor activation conditions above apply. Until those conditions are in force, processor-scope personal data is prohibited. Special-category personal data is prohibited throughout the current beta, and the non-account-holder rights route remains available.

Legal compliance and claims — Article 6(1)(c) and 6(1)(f) GDPR

Data is processed where necessary to comply with an applicable legal obligation, including data-protection rights, or to establish, exercise or defend legal claims. Claim-related processing is limited to the data and period reasonably needed for that purpose.

Support and rights requests — Article 6(1)(b), 6(1)(c) or 6(1)(f) GDPR

Messages are processed to answer a service request under the account relationship, comply with data-protection duties, verify authority and protect personal data from disclosure to the wrong person. The applicable basis depends on the request: contract for account support, legal obligation for statutory rights, and legitimate interests for proportionate verification, security and claims documentation.

The Contact implementation accepts only same-origin, size-limited plain-text form data. It derives opaque abuse and idempotency keys without placing the reply address or message in those keys. A request is reported as accepted only after the delivery provider accepts it for forwarding to the monitored support mailbox; provider acceptance does not mean that the message has already been read or answered.

Consent

The public site has no advertising, marketing analytics or optional consent-based processing. Authorizing OAuth scopes lets a connected platform issue credentials; that provider authorization is not automatically consent under Article 6(1)(a) GDPR. ChannelCockpit relies on consent only when it asks for a specific, optional consent. Any such consent can be withdrawn for the future without affecting processing that was lawful before withdrawal.

Whether data is required

An email address and password are required for an authorized private-beta account. Authentication, security and basic request data are required to operate the protected service. Connecting a platform and supplying publishing content or media are optional, but the selected feature cannot work without the corresponding scopes and data. Public registration is closed.

No automated decisions or advertising profile

The current service performs no solely automated decision with legal or similarly significant effects, no advertising profiling and no active generative-AI processing. ChannelCockpit does not sell personal data and has no advertising network, social inbox, comments, direct messages or sentiment-analysis feature.

ChannelCockpit does not sell personal data, use it for personalized advertising or train general-purpose AI models with user content.

Site and device storage

Public website

The public site contains no tracker, advertising network, Firebase client or account runtime and does not intentionally use consent-requiring marketing or analytics technology. Assets and the progressive Contact script are served locally. The Contact form posts only to the same-origin /api/contact route. Its Function validates the request in memory and stores only HMAC-derived rate-limit and idempotency state in Cloud Firestore; it does not place the message body, reply address or client IP in that state. Firebase Hosting receives IP addresses and ordinary HTTP request data for page delivery and may use it for service operation, security and usage analysis. Contact request logs containing the remote IP are excluded from ChannelCockpit's default application log bucket. ChannelCockpit does not use Hosting request data for marketing, audience measurement or visitor profiles. The legal basis for ChannelCockpit's processing is Article 6(1)(f) GDPR as described above; Firebase states that Hosting IP data is retained for a few months.

If a visitor changes the site's display settings, the browser stores one local record named channelcockpit.display-preferences. It can contain only the selected theme, text size, contrast and motion preference. The site removes the record when all choices return to their defaults, does not place an account or advertising identifier in it and does not transmit that record. ChannelCockpit treats this first-party record as necessary solely to remember the display setting expressly requested by the visitor under section 25(2) TDDDG.

Protected application

The app runtime persists appearance or theme state, the Firebase app-account session and short-lived OAuth callback mechanics in the browser or app. Before that runtime loads, Cloudflare Access evaluates required authorization and session state at the outer gateway. The current web App Check flow also uses reCAPTCHA Enterprise; Google's reCAPTCHA documentation states that execution sets a necessary risk-analysis cookie. These security states are separate from the static public site and are not used by ChannelCockpit for advertising or marketing analytics. Timezone, language, date, time and onboarding preferences are account data in Cloud Firestore, not advertising cookies.

Access authorization, Firebase session, OAuth callback and reCAPTCHA/App Check state supports the current sign-in, connection and security functions. Cloudflare explains its Access authorization state in its authorization-cookie documentation, and Google explains reCAPTCHA's risk-analysis cookie in its reCAPTCHA FAQ. ChannelCockpit uses these functions for the requested authentication, connection and security purposes. Provider-controlled storage remains subject to the provider's purpose and configuration.

Authentication and security

Outer Cloudflare Access gate

The private-beta app and staging environment sit behind a separate outer Cloudflare Access gateway before the application runtime and Firebase app-account authentication. An unauthenticated protected-route request redirects to a *.cloudflareaccess.com endpoint or fails closed with an authorization response. At that boundary Cloudflare handles ordinary network and HTTP request data and evaluates authorization and session state before the request can reach the app. Cloudflare Access is a perimeter gateway and is distinct from Cloudflare R2 media storage.

Cloudflare Access processes authorization and session information needed to enforce the gateway policy, plus ordinary request and security data. The data is used to control access, investigate abuse, secure the service, meet applicable legal duties and handle claims. Session and gateway-log periods follow the configured Access settings and applicable provider terms; no shorter exact period is promised here. Cloudflare's session-management documentation explains the configurable session boundary.

Email and password authentication

After the outer Access gate, Firebase Authentication is the sole current application-account identity provider and the source of the ChannelCockpit account identifier and authentication state. It processes the email address and password, account identifier, verification and account state, user-agent, IP address and sign-in metadata. ChannelCockpit does not receive connected-platform login passwords. Firebase's privacy information says logged authentication IP addresses are retained for a few weeks; after the customer initiates user deletion, other authentication information is removed from live and backup systems within 180 days. Firebase Authentication runs only in United States data centers.

Firebase App Check

Protected requests carry Firebase App Check integrity evidence. The current web private beta uses reCAPTCHA Enterprise. Attestation material from the current web flow is sent to Google. Firebase states that App Check does not retain that material and that ordinary tokens without replay protection are not retained by Firebase services. ChannelCockpit configures a one-hour App Check token lifetime. Provider-controlled reCAPTCHA browser state follows Google's applicable configuration and terms.

Technical safeguards

Current safeguards include authenticated owner scope, App Check, least-privilege server access, encryption in transit, encrypted server-only OAuth credentials, private media storage, type and codec validation, malware scanning, bounded inputs and redaction of credentials, content and direct identifiers from operational logs. For client-error reporting, the application-level user field is converted to a derived pseudonymous hash of the Firebase UID rather than logging the raw Firebase UID. Reports can also contain a report UUID, error type and source, operation and fatal flag, redacted stack, platform, environment, release and fingerprint. Google and Firebase Functions infrastructure can independently process request IP addresses, service or resource identifiers and technical service data as described elsewhere in this notice and the provider terms. No internet service can guarantee absolute security.

Connected platforms

A connection starts only after the user chooses a platform and authorizes specific OAuth scopes. The backend exchanges the callback securely and stores encrypted access and refresh credentials, scopes, expiry and token-free connection metadata. Credentials are never included in the account export. Granted access can be withdrawn in ChannelCockpit or through the provider's own controls.

Current beta authorizations may include write-oriented permissions because they support the user-initiated publishing journey. Each permission has a specific purpose after explicit user review and confirmation:

• YouTube youtube.upload permits a selected YouTube video, title, description and settings to be transmitted to the chosen YouTube channel.
• TikTok video.publish permits selected TikTok media, caption and privacy settings to be transmitted to the chosen TikTok account.
• Instagram instagram_business_content_publish permits selected Instagram media, caption and settings to be transmitted to the chosen Instagram account.
• Facebook pages_manage_posts permits selected Facebook Page post content, media and settings to be transmitted to the chosen Page.

After explicit user review and confirmation, selected content, media and settings may be transmitted to the chosen connected platform. A granted scope, saved draft, review, preflight, schedule, calendar entry or queue entry shows authorization or planning state only. Queue or planning state alone is not proof that a provider accepted or delivered the content, and this notice does not assert that any particular provider transaction occurred.

YouTube and Google

ChannelCockpit uses YouTube API Services. On an authorized account it can receive channel identity and metadata, uploaded-video metadata and authorized YouTube Analytics or other source statistics for the connected user's own channel. Live YouTube analytics responses are not additionally persisted; ChannelCockpit stores the encrypted authorization credentials and the limited connection metadata needed to maintain and display the connection.

Google's handling is described in the Google Privacy Policy. Users can also revoke ChannelCockpit's Google access in Google security settings. ChannelCockpit's in-app disconnect attempts immediate provider revocation and local credential removal. The YouTube Developer Policies require stored authorization to be rechecked at least every 30 days; non-statistical Authorized Data must be deleted or refreshed within 30 days. A request, in-app revocation or ChannelCockpit account deletion requires relevant stored YouTube data to be deleted as soon as possible and within seven days, while revocation through Google's security page has a 30-day provider-policy ceiling. Deleting ChannelCockpit data does not delete data held by YouTube.

ChannelCockpit uses Google user data only for the disclosed connection, own-channel identity, source-aware analytics and user-confirmed YouTube publishing features. Selected publishing data is transmitted to YouTube only for the confirmed user-facing action. It is not used for advertising, sale, unrelated profiling or active AI processing. It is shared only with the service providers needed to operate and secure those features, with YouTube for the confirmed publishing action, or when disclosure is legally required. Human access is limited to what is necessary to provide user-requested support, investigate security or abuse, or comply with law. This use is intended to follow the Google API Services User Data Policy, including its Limited Use requirements.

TikTok

TikTok's Display API can provide the connected user's open_id, display name, avatar and profile details, plus metadata and metrics for that user's videos under granted scopes. ChannelCockpit stores account-scoped daily profile and video snapshots and deltas for source-aware analytics. TikTok lets users grant, deny or revoke individual scopes in its app. TikTok describes its own handling in the TikTok Privacy Policy.

Instagram and Facebook

An authorized Meta connection can provide profile or Page identifiers, names and avatars, Page-owned content metadata and source insights. Where multiple Facebook Pages are available, the user selects the target account. After the user's explicit review and confirmation, the selected Instagram or Facebook publishing payload may be transmitted to that target. ChannelCockpit does not retrieve comments, messages, direct messages, visitor posts or an inbox. Instagram and Facebook are Meta services and process data under the Meta Privacy Policy and their platform terms.

Connected-platform operators are data sources and recipients that determine their own platform processing under their own terms and privacy notices. They are not used as ChannelCockpit processors for their platform operations.

Analytics and publishing

Source-aware analytics

Analytics keeps platform, account, source, coverage, freshness and data-through boundaries attached to provider data. YouTube and Meta insight responses are read live and are not additionally persisted. TikTok daily account and video snapshots and deltas are stored under an opaque account scope for up to 90 days. Dashboard layout stores only widget identifiers, order, visibility, size, revision and update time, not provider metrics. ChannelCockpit does not create a cross-platform total.

Publishing preparation and media

The service stores drafts, targets and account bindings, captions, platform overrides, schedule and timezone, review and preflight results, calendar and queue state, operation and provenance records. After explicit user review and confirmation, the selected publishing payload may be transmitted to the chosen connected platform. A queue or planning record documents ChannelCockpit state; it is not evidence that the provider accepted, published or otherwise delivered the content.

When permitted publishing content identifies another person, the same bounded workflow applies: user-requested private storage, technical validation, review, scheduling and conditional transfer after explicit confirmation. It is not used for advertising or an unrelated profile. The chosen connected platform can receive the confirmed payload, and the relevant service providers, retention and rights route apply to that content.

Uploaded publishing media is held in private Cloudflare R2 buckets configured for the European Union jurisdiction and Eastern Europe location hint. A private Google Cloud Run validator receives the file to inspect size, type, codec, dimensions and duration and to perform a ClamAV malware scan. Firestore holds the opaque object path, sanitized user-supplied file name, content type, size and lifecycle or validation metadata required to control that private object. The bucket is not public.

Recipients and service providers

• Google and Firebase: Firebase Hosting, Authentication, Cloud Firestore, Cloud Functions, App Check and Cloud Storage, plus Google Cloud Run, Logging, Monitoring and Error Reporting provide hosting, identity, database, backend, integrity, temporary export, validation and operations services. Google publishes a Google Cloud Data Processing Addendum; the exact entity and terms applying to the current accounts are not asserted here.
• Cloudflare R2: private object storage holds publishing media. Cloudflare publishes a Customer Data Processing Addendum; this link is not a claim that a particular addendum has been verified for the current R2 account.
• Cloudflare Access: the separate outer gateway for the private-beta app and staging handles ordinary network and HTTP request data and evaluates authorization and session state before the origin.
• Current web attestation: Google reCAPTCHA Enterprise receives web integrity and risk-analysis data for Firebase App Check.
• Connected platforms: Google/YouTube, TikTok and Meta/Instagram/Facebook receive OAuth authorization and current read requests and provide authorized account or source data. After explicit user review and confirmation, the chosen platform may also receive the selected publishing content, media and settings under the disclosed write-oriented permission.
• Support mailbox: email sent to support@channelcockpit.app is forwarded through Cloudflare Email Routing to the operator's monitored Gmail mailbox for support, privacy and account correspondence.
• Contact form: the same-origin Firebase Function uses Resend to forward the validated reply email, topic and message to the monitored support mailbox. Resend is configured to send from mail.channelcockpit.app. Cloud Firestore receives only opaque rate-limit and idempotency state, not the plaintext message or reply address.
• Authorities or professional advisers: data is disclosed only where an applicable legal duty requires it or where necessary to establish, exercise or defend legal claims.

The current service has no advertising network, data broker, marketing-email processor, external analytics tracker or active AI provider.

International transfers

Firebase Authentication processes data exclusively in the United States. Other Firebase and Google Cloud services can use global infrastructure or selected regions; a regional backend configuration does not mean that every Authentication, Hosting or App Check operation stays in Germany or the European Union. Google's published Data Processing Addendum describes transfer mechanisms, including Standard Contractual Clauses where applicable.

Publishing-media objects are assigned to Cloudflare R2's European Union jurisdiction; the Eastern Europe setting is a location hint rather than a complete processing-location guarantee. Cloudflare support, security and subprocessor operations can still involve transfers. Cloudflare's published DPA describes transfer mechanisms, including Standard Contractual Clauses where applicable.

The English-first service can be used worldwide, but user location does not change these provider and transfer facts. Connected-platform operators are global and may process authorized account and source data outside the EEA under their own privacy notices and transfer mechanisms. The Contact sending domain uses Resend's Ireland region. Resend states that email sending for that region occurs in Ireland while account metadata and sending logs are stored in the United States.

Google, Cloudflare and Resend publish data-processing and transfer information. The R2 object-location setting applies only to R2 objects and does not establish the processing location of Cloudflare Access. You can request available information about the service providers and safeguards through the contact above.

Retention

ChannelCockpit keeps personal data only for the periods below or until it is no longer needed for the stated purpose. Scheduled cleanup can retry after transient failures, so a period describes when a record becomes eligible for cleanup rather than guaranteeing physical erasure at an exact second. A shorter deletion command applies where described, subject to provider backups, soft deletion and a legal obligation or claims-related hold.

• Public site: Firebase states that Hosting IP data is kept for a few months.
• Public display preference: the local display-settings record remains on the device until the visitor resets all choices, clears browser storage or the browser removes it.
• Authentication: Firebase keeps logged authentication IP addresses for a few weeks. After customer-initiated account deletion, other authentication information is removed from Firebase live and backup systems within 180 days.
• Account and service records: account profile, preferences, drafts and active connection metadata remain while the account is active and needed for the requested service, then enter the deletion lifecycle. A record is retained longer only while required by law or reasonably needed for an unresolved dispute or legal claim.
• Support and privacy requests: ChannelCockpit keeps email messages and proportionate verification records until the request is completed and for as long as needed to demonstrate compliance, protect the requester or handle a related dispute. Provider-side mailbox and delivery records follow the applicable provider settings and terms.
• Contact form: the plaintext submission is forwarded to the support mailbox and is not stored in the rate-limit or idempotency collections. Opaque HMAC-derived counters and accepted-delivery state expire after 24 hours. Resend and the support mailbox can retain delivery and correspondence records under their applicable service settings and terms.
• Content about other people: permitted incidental personal data in a user-provided draft, caption or media file follows the applicable account, draft, media and publishing-control periods below; ChannelCockpit does not create a separate person profile from it. Special-category personal data is prohibited in the current beta. Processor-scope personal data follows these periods only after the role assessment and while the DPA, documented instructions and rights-assistance path are in force; otherwise that use is prohibited.
• OAuth credentials: encrypted tokens remain until expiry, revocation, disconnect or account deletion, subject to provider-specific refresh and deletion rules. YouTube-specific 30-day refresh or deletion and seven-day request or in-app revocation ceilings are described above.
• TikTok analytics: account and video history, deltas and video registry have a 90-day expiry; scheduler cursor state expires after 24 hours. Disconnect removes active credentials but account-scoped TikTok history can remain until that 90-day expiry. Full account deletion purges it earlier.
• Publishing media: incomplete upload bindings expire after 24 hours. A draft save, update or review transition binds media through seven days after that lifecycle action; a terminal transition binds it through seven days after that transition; and scheduled media is bound through the scheduled instant plus seven days. Later lifecycle actions may extend but do not shorten the existing binding. After the current binding expires, cleanup becomes eligible and is scheduled or retried; this is not a promise of physical deletion at an exact instant.
• Publishing control records: preflight records expire after 24 hours, operations and terminal queue records after 30 days, and provenance records after 90 days.
• Account exports: the JSON object is available for 10 minutes, its signed download URL for two minutes, and cleanup runs every five minutes; verified download requests earlier cleanup. The Firebase/Google Cloud Storage bucket has seven-day soft deletion, so a deleted object may remain recoverable to the provider or operator during that window.
• Applicable Google/Firebase backend deletion: the Google Cloud DPA says customer data deleted through an applicable service and no longer recoverable by the customer is deleted from Google's systems as soon as reasonably practicable and within a maximum of 180 days, unless applicable law requires storage. This provider backend maximum is not an export-only period.
• Rate limits and deletion receipts: distributed rate-limit state is removed after 24 hours without an update. A Meta deletion callback retains only platform, completion time and status plus a hash of the opaque confirmation code for 90 days.
• Perimeter and web-integrity state: ChannelCockpit's App Check token lifetime is one hour, and Firebase says ordinary App Check tokens without replay protection are not retained by Firebase services. Access session and reCAPTCHA state follow their provider configuration and applicable terms.
• Provider and operational records: Where no shorter period is stated, ChannelCockpit and its providers keep affected access, integrity, mailbox and operational records only while needed to maintain authorized access, analyze risk, answer correspondence, resolve incidents, demonstrate security, comply with applicable law or handle related claims.

Controls and deletion

Account export

An authenticated user can request an owner-scoped JSON export. It includes account and provider-connection metadata, user-owned Firestore records and export-safe publishing-media metadata, including the sanitized user-supplied file name, media type, content type, size, status and lifecycle timestamps. Credentials and fields containing tokens, secrets, passwords, cookies or session URLs are redacted or excluded; publishing media binaries and operational logs are not embedded. The short-lived object and link follow the retention described above. This product export is not necessarily a complete response to an Article 15 GDPR access request.

Platform disconnect

Disconnect removes the local credential and active access, attempts provider revocation on a best-effort basis, and removes provider-linked publishing identifiers and checkpoints. User-authored scheduled-post content can remain, and TikTok account-scoped history can remain until its 90-day expiry. Disconnect does not delete content or account data held by the connected platform; use that provider's controls for provider-held data.

Permanent account deletion

After recent authentication and explicit confirmation, deletion disables the identity, revokes Firebase refresh tokens, blocks new owner writes, attempts provider revocation, purges owner-scoped Firestore data, publishing artifacts and private media, exports and rate-limit state, and then deletes the Firebase Authentication identity. An hourly reconciliation handles interrupted work and late writes during the 24-hour deletion barrier. Provider backup and residual periods described above still apply.

The monitored contact for privacy-rights and account-deletion requests is support@channelcockpit.app. A person who cannot use the authenticated controls can use that address. An email request is not automatically fulfilled: ChannelCockpit may need enough information to identify the relevant account or content and verify authority without collecting more data than necessary.

ChannelCockpit records the request, verifies identity or authority only to the extent proportionate to the data at risk, and responds within the period required by applicable data-protection law. If a request cannot be fulfilled in full, the response explains the reason and available complaint route. The account and provider lifecycle described here continues to apply to deletion requests.

Your rights

Subject to the GDPR's conditions and exceptions, a person may request access, rectification, erasure or restriction, receive portable data, and object to processing based on legitimate interests. Where processing relies on consent, consent may be withdrawn for the future. A person may also complain to a competent supervisory authority.

Identity may need to be verified before acting on a request so that account and platform data are not disclosed to someone else. The in-app account editor, export, disconnect and deletion controls support specific product actions, but they do not replace a complete rights-request process. Rights affecting data held by YouTube, TikTok, Instagram or Facebook may also need to be exercised with that platform.

A person identifiable in a user-provided draft, caption or media file can have rights even without a ChannelCockpit account and can contact support@channelcockpit.app. ChannelCockpit handles requests concerning data under its control and may ask for enough context to locate the content and verify identity while respecting other people's rights. Where ChannelCockpit acts as processor, it routes and assists with the request through the activated rights-assistance path; the relevant controller remains responsible for the decisions it makes as controller.

Requests can be sent to support@channelcockpit.app or by post to the controller address above. A person may complain to Der Hessische Beauftragte für Datenschutz und Informationsfreiheit or another competent supervisory authority. The right to complain is not limited by contacting ChannelCockpit first.

Children, changes and contact

Children

Account holders must be at least 18 years old. ChannelCockpit is not directed at children and does not offer a parental-consent account path. User-provided drafts or media can nevertheless depict or identify a minor; the third-party-content duties, role questions and rights route described above then still apply.

Changes

The effective date and last-updated date are 16 August 2026. Before ChannelCockpit starts a materially different processing activity, this notice will be updated and users will be informed as required.

Contact

Privacy, rights and deletion questions can be sent to support@channelcockpit.app or to Amed Bozo, Moritzstraße 43, 65185 Wiesbaden, Germany.