Privacy policy

What we collect

• Your account. You sign in with a MaxPoints account through MaxAuth, the sign-in shared by MaxPoints products. MaxReach receives your account’s email address.
• Connected social accounts. For each account you connect: its profile name, handle, profile picture and follower count, and the access tokens (and refresh tokens) the network grants MaxReach. Bluesky connects with an app password you create for MaxReach, which we keep in place of a refresh token. Tokens and app passwords are stored encrypted.
• What you create. Your posts, captions, per-network settings, schedules and posting times, alt text, the photos and videos you upload, and any details about your brand that you give the AI Assistant.
• Live streams. The server addresses and stream keys you save for going live (stream keys are stored encrypted), and the camera, screen and overlay video you stream, which passes through MaxReach to your destinations as it happens and isn’t recorded.
• What we read from the networks. Metrics for the posts you publish through MaxReach (such as views, likes, comments and shares), your accounts’ follower counts, and the comments on your posts, including each commenter’s public name and handle, so you can read and answer them in MaxReach.
• Basic usage data. Technical details such as IP address, browser type and request logs, used to run and protect MaxReach, and a cookie that keeps you signed in.
• Error reports. When something breaks, an error message and technical details about where it happened, with common credentials and personal details removed first.
• Product usage. Which MaxReach pages you open and which features you use (for example, that a post was scheduled or a live stream started, never its content), measured by MaxReach itself with no third-party trackers or advertising pixels.

How we use it

We use your information only to provide MaxReach to you:

• to publish and schedule the posts you ask for, on the accounts you choose;
• to show your posts’ analytics and your comments, and to reply to or hide comments when you ask;
• to keep your connections working, by renewing tokens before they expire and emailing you when an account needs to be connected again;
• to write captions and transcripts when you use the AI Assistant;
• to answer your support requests, keep MaxReach secure and fix problems.

We don’t use your content or your accounts’ data for advertising.

Who we share it with

• The social networks you choose. When you publish, your content goes to the networks and accounts you picked, and their own terms and privacy policies apply to it there.
• AI providers, only when you use the AI Assistant. Anthropic receives your brief, the post’s photos or frames of its video, the video’s transcript and your brand details, to write captions. OpenAI receives the video’s audio, to transcribe it.
• Service providers. The companies that host MaxReach’s servers and database and send its emails, only as far as they need to run MaxReach.
• When the law requires it. If we must answer a valid legal request, or to protect someone’s safety, investigate fraud or abuse, or enforce our terms.
• In a business transfer. If MaxPoints is involved in a merger, acquisition or sale of all or part of its business, with appropriate safeguards.

We never sell your information, and we don’t share it for targeted or cross-site advertising.

How long we keep it

• Photos and videos are kept until the posts that use them are published, then cleared 30 days after the last of those posts is published; each post keeps a small thumbnail. Uploads that no post uses are deleted after 90 days, and unfinished uploads after a day.
• Connected accounts: disconnecting an account deletes its stored tokens, and for Bluesky its app password, straight away.
• Posts, captions, analytics and comments stay in your workspace so you can see your history, until you delete them.
• Everything else: email support@maxpoints.com from your account’s email address and we’ll delete all of your MaxReach data (see Data deletion).

Cookies and browser storage

MaxReach uses a secure, HTTP-only cookie to keep you signed in, and short-lived cookies while you sign in. Your browser’s local storage holds a random visitor ID, a session ID that expires after 30 minutes of inactivity, and how you arrived at MaxReach (such as a campaign link), for MaxReach’s own usage measurement. MaxReach doesn’t use Google Analytics, advertising pixels or cross-site tracking. Signing out clears the sign-in cookie, and you can clear local storage in your browser.

Security

Access tokens, app passwords and stream keys are encrypted before they are stored, and every connection to MaxReach uses HTTPS. No system is perfectly secure, so we keep only what MaxReach needs to work.

Your choices and rights

• Disconnect any account on MaxReach’s Accounts page, and remove MaxReach’s access in that network’s own settings.
• Edit or delete your posts and media in MaxReach at any time.
• Ask for a copy of your information, or ask us to correct or delete it, by emailing support@maxpoints.com from your account’s email address.
• Only use the AI Assistant when you want to: nothing is sent to Anthropic or OpenAI unless you do.

Depending on where you live, you may also have the right to a portable copy of your information, to withdraw consent, or to appeal a decision about your request. We may need to confirm your identity first, and we won’t treat you differently for using any of these rights.

Google API Services

MaxReach’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a YouTube channel, MaxReach uses YouTube API Services. We use YouTube data only to upload and manage the videos you publish through MaxReach, read their statistics, and read and reply to their comments. We don’t use it for advertising, and we don’t sell it or share it except as this policy describes.

By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can remove MaxReach’s access at any time on your Google Account’s third-party access page; disconnecting the channel in MaxReach also deletes its tokens.

TikTok, Meta, X, LinkedIn, Pinterest and Bluesky

Data MaxReach receives from TikTok, Meta (Facebook, Instagram and Threads), X, LinkedIn, Pinterest and Bluesky is used only to provide the features you use: publishing and scheduling your posts, showing their analytics, and reading and answering their comments. It isn’t used for anything else, and it is deleted as described above. Each network controls its own privacy practices, and disconnecting an account in MaxReach doesn’t delete what that network already holds.

Children

MaxReach is for adults and isn’t directed to children under 13. We don’t knowingly collect information from children; if you think a child has given us information, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top of this page, and if the change is significant we’ll also let you know by email or in MaxReach.

Contact

MaxReach is operated by MaxPoints LLC. For any question or request about your privacy or this policy, email support@maxpoints.com, or write to MaxPoints LLC, 18121 E Hampden Ave Unit C #1244, Aurora, CO 80013, USA.