--- title: "Privacy Policy | Chockstone Labs" description: "Privacy Policy for the Chockstone Labs website and social media service." canonical: https://chockstonelabs.com/privacy/ last_updated: 2026-10-31 source: "The same content as https://chockstonelabs.com/privacy/" --- Source: the same content as https://chockstonelabs.com/privacy/ # Privacy Policy Effective November 10, 2026 **This policy applies only to chockstonelabs.com and the Chockstone Labs social media service.** Capnolog, SpotMeter, and PencilCAD are also made by Chockstone Labs LLC, but each is a separate app with its own privacy policy on its own website, and that policy, not this one, covers it. See [Our other apps](https://chockstonelabs.com/privacy/#other-apps). ## Who we are This policy covers the website at chockstonelabs.com and our social media service, both operated by Chockstone Labs LLC, an Ohio limited liability company, PMB 5052, 46 Shopping Plaza, Chagrin Falls, OH 44022. Our other apps, Capnolog, SpotMeter, and PencilCAD, have their own privacy policies (see [below](https://chockstonelabs.com/privacy/#other-apps)) and are not covered here. ## What we collect On the pages of this website, very little. They have no accounts, forms, or comments, and they set no cookies. We count page views, scrolling, and taps with cookieless analytics, described under [Analytics](https://chockstonelabs.com/privacy/#analytics). Everything the pages load, including the fonts and the analytics script, is served from our own site. Our social media service, and the link-in-bio pages it publishes, are covered [below](https://chockstonelabs.com/privacy/#social). ## Email If you email us, we receive your email address, whatever name you include, and what you write. We use it to respond to you and keep the correspondence for our records for as long as reasonably needed. We do not sell it or share it, except with the provider that hosts our email and where the law requires. You may ask us to delete your correspondence at any time by writing to the address below, and we will do so unless we need to keep it to comply with the law or resolve a dispute. ## Server logs Our hosting provider keeps standard server logs, such as IP address, browser type, and pages requested, for security and to operate the service, under its own retention practices. We do not use those logs to identify individual visitors. ## Analytics We use PostHog, Inc. for product analytics, sent through our own site rather than straight to PostHog. On the public pages of this website, it records the pages you view (the address without anything after a “?”), the page you came from (trimmed the same way), any campaign tags in the link you followed (such as utm_source), your browser, device type, and screen size, how far down each page you scroll and how long it stays open, how quickly it loads, which parts of it come into view and how long each stays on screen, and the links and buttons you tap, by where they sit and where they lead, never what you type. The random visitor ID lives only in the page’s memory, and a link to another page of this website hands it to that page, so one visit counts as one visitor. It sets no cookies, stores nothing on your device, and never passes the ID to another website. If you go on to start a space, that visit joins your account’s analytics record. Inside the social media service, once you sign in, it also records your account ID and your space’s ID (never your name or email), the screens you open, and steps such as starting a space, accepting an invitation, connecting an account, scheduling or publishing a post, and starting a plan. In the web app it keeps its ID in your browser’s local storage, so a signed-in session counts as one person. Our servers send the same steps with only event names, IDs, network and plan names, and counts: never a caption, comment, message, username, name, or email. Once a day they also send each connected account’s totals since it joined the service, as counts: followers then and now, views, minutes watched, and posts made through the service. No figures read from YouTube or Google Business Profile are sent. We do not pass your IP address on to PostHog, and its location lookup is turned off. The iPhone app sends the same kinds of events, plus crash and error reports, to PostHog with location lookup turned off; you can turn this off in the app’s Settings. We use analytics only to understand and improve our product, never for advertising, and we do not sell it. If your browser sends a Do Not Track or Global Privacy Control signal, the analytics script does not load on this website or in the web app, and nothing is sent. ## Children This site is not directed to children under 13, and our social media service is only for people 18 and older. We do not knowingly collect personal information from children under 13; if you believe a child has given us personal information, email [hello@chockstonelabs.com](mailto:hello@chockstonelabs.com) and we will delete it. ## Where data is handled We are located in the United States, and the site and the social media service are hosted there. If you visit from elsewhere, anything you send us or that the service handles will be processed in the United States. ## Do Not Track We do not track visitors across websites. If your browser sends a Do Not Track or Global Privacy Control signal, our analytics does not load on this website or in the web app; see [Analytics](https://chockstonelabs.com/privacy/#analytics). ## Social media service Our social media service, described at [chockstonelabs.com/social](https://chockstonelabs.com/social/), lets the creators and businesses we work with (our customers) manage their Instagram, TikTok, Threads, YouTube, Facebook, LinkedIn, Bluesky, Mastodon, and Pinterest accounts. ## Account data When a customer connects an Instagram or TikTok account, we receive the following through that platform’s official API, and only with the customer’s permission: the account’s username, ID, and profile details; its posts, captions, and media; performance figures such as views, reach, likes, comments, shares, and follower counts; comments on its posts; and its direct messages. We read direct messages from Instagram each time the customer opens them and do not store them; we keep only a reply drafted for the customer to send, with the recipient’s username and when they last wrote, for up to 7 days. We store the account’s access tokens encrypted so the service can act on the account. Customers sign in through Clerk, which gives us their name and email address. When a customer connects a Threads profile, we receive through the Threads API, and only with the customer’s permission: the profile’s username, ID, and name; its posts with their text, media, and links; figures for those posts such as views, likes, replies, reposts, quotes, and shares, and the profile’s follower count; and the replies people leave under the profile’s own posts. We use it only to publish the posts the customer approves, with the reply setting they choose, to show them how their posts perform, and to post the answers they write or approve under replies to their own posts, as Meta’s terms allow. We do not read mentions, reply under anyone else’s posts, or send messages on Threads. We store the profile’s access token encrypted. Removing Chockstone Labs from the apps in Threads disconnects the profile and deletes its access token at once; a deletion request made through Threads also deletes the profile’s name, the figures we imported, and the replies kept for answering. ## How we use it We use this data only to provide the service to that customer: to publish the posts they approve, show them how their posts perform, reply to comments, send the messages they configure or write, and keep their accounts connected. We also measure how accounts grow after they join. Each customer sees their own accounts’ growth; anything we say about it outside Chockstone Labs is a total across many accounts, never one account’s figures. We do not sell it, use it for advertising, share it with data brokers, or use it to train AI models. We use Instagram and TikTok data only as each platform’s terms allow. ## YouTube Customers can also connect a YouTube channel. For that, our service uses YouTube API Services, and a customer who connects a channel agrees to the [YouTube Terms of Service](https://www.youtube.com/t/terms). Google’s own handling of that data is covered by the [Google Privacy Policy](https://policies.google.com/privacy). With the customer’s permission, we receive from the YouTube Data API the channel’s name, handle, and ID; its subscriber count; its videos’ titles, descriptions, lengths, publish times, and view, like, and comment counts; and the comments on its own videos. From the YouTube Analytics API we also read how long viewers watch its videos, shown when the customer opens a video’s results and not stored, and once a week the share of its viewers by age range, gender, and country, kept only as that summary and replaced each week. We use it only to upload the videos the customer approves to their own channel, to show them how their videos perform, and to post a reply under a comment on their own video when a person on their team taps Send; replies on YouTube are never sent automatically. To measure how channels grow after they join, we read a channel’s views, minutes watched, and subscribers gained and lost since it joined from the YouTube Analytics API, do not store them, and look at them only added up with at least two other accounts. We share it only with the service providers listed below and with an AI assistant the customer connects, as described below, and we refresh it at least every 30 days while the channel stays connected. Chockstone Labs’ use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. A customer can revoke our access at any time from their Google Account at [security.google.com/settings/security/permissions](https://security.google.com/settings/security/permissions), or by disconnecting the channel in the service. When a channel is disconnected in the service, we revoke our access with Google at once and delete the channel’s data within 7 days. If access is revoked from the Google Account instead, the channel shows as signed out and its data is deleted within 30 days unless it is reconnected. ## Facebook Pages and public research When a customer connects a Facebook Page, we receive through Facebook Login, and only with the customer’s permission: the Page’s name, username, ID, and follower count; its posts with their text, media, and links; figures for those posts such as views, reach, reactions, comments, shares, and video watch time; the comments people leave under the Page’s own posts; and the username of the Instagram business account linked to the Page. We store the Page’s access token encrypted, and use this data only to publish the posts the customer approves, to show them how their Page performs, and to post the answers they write or approve under comments on the Page’s own posts, as Meta’s terms allow. When a customer connects a LinkedIn profile, we receive through LinkedIn’s sign-in, and only with the customer’s permission: the member’s ID, name, and profile photo. We use it only to publish the posts the customer approves to that profile. We do not read the profile’s posts, figures, connections, comments, or messages. We store the access token encrypted. LinkedIn ends this access after 60 days, and the customer reconnects to keep posting. When a customer connects a Bluesky account, we receive through Bluesky’s sign-in, and only with the customer’s permission: the account’s handle, its identifier (DID), display name, and profile picture. We use it only to publish the posts the customer approves to that account, and to read the account’s own recent posts and the replies people leave under them, so the customer can answer those replies from their inbox, by hand or with an automatic reply they set up. We do not read its follows, likes, or messages. We store the sign-in session encrypted. Posts on Bluesky are public. When a customer connects a Mastodon account, we register our app with the customer’s Mastodon server and receive through that server’s sign-in, and only with the customer’s permission: the account’s username, server, ID, display name, profile picture, and follower count, and its recent posts with their favorites, boosts, and replies counts. We use it only to publish the posts the customer approves to that account and to show them how those posts perform. We also read the replies people leave under its own posts, so the customer can answer them from their inbox; an answer to a reply goes out only when a person on their team taps Send. We do not read its follows, notifications, or direct messages. We store the access token, and the app credentials for that server, encrypted. A post reaches the audience the customer picks on Mastodon. A customer can also list public Mastodon accounts as competitors: we read their public follower counts and recent public posts from their server, and keep them until the customer removes that competitor. When a customer connects a Pinterest account, we receive through Pinterest’s sign-in, and only with the customer’s permission: the account’s username, ID, profile picture, and follower count; the names of its boards; and its Pins with figures such as impressions, saves, and outbound clicks. We use it only to publish the Pins the customer approves to the board they pick, to make a board named after the account when it has none, and to show them how their Pins perform. We store the access and refresh tokens encrypted. For Instagram accounts, Threads profiles, and Facebook Pages, we also read once a week the audience summary Meta gives: the share of followers by country and city, and for Instagram and Threads by age range and gender. These are totals for the audience as a whole, never about any one person. We show them only to the customer’s team, replace them each week, and delete them with the account’s other imported data. When a customer connects a Google Business Profile account, we receive through Google’s sign-in, and only with the customer’s permission: the names, IDs, and websites of the business locations that Google account manages; their posts; and each location’s daily views on Search and Maps, calls, website clicks, and direction requests. We use it only to publish the posts the customer approves to their own listings and to show them how their listings perform, and, added up with at least two other accounts, to measure how listings grow after they join. We do not read or answer reviews, or change a listing’s details. We store the access and refresh tokens encrypted. Chockstone Labs’ use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. When a customer connects Canva, we receive through Canva’s sign-in, and only with their permission, the list of their designs: titles, preview pictures, page counts, and when each was last edited. We export only a design they pick and copy that file into their media library. We never change or make designs. We store the access and refresh tokens encrypted, and delete them when the customer disconnects Canva. When a customer adds a blog or feed, we read its public feed about once an hour, and the public page of a new post for its preview picture. We keep the feed’s address and the posts we have already turned into drafts, until the customer removes the feed. Through that linked Instagram account, a customer can also look up a hashtag’s top and most recent public posts, and see public figures for the Instagram business and creator accounts they list as competitors: follower counts, and recent posts with their captions, likes, comments, and views. This is public information Instagram provides to businesses. We only read it: we never like, follow, comment on, or message these accounts. We keep hashtag results for 7 days and competitor figures until the customer removes that competitor. If you run one of these public accounts and want your figures removed from a customer’s space, write to us as described below. Removing Chockstone Labs from the business integrations in Facebook disconnects the customer’s Pages and deletes their access tokens at once; a deletion request made through Facebook also deletes the Pages’ names, the figures we imported, the comments kept for answering, and their hashtag searches. A customer can share a post for approval through a link that needs no sign-in. The link carries a label the customer types, such as a name or an email address. We store that label with the link, and it appears in the customer’s activity log and notifications when someone acts through the link. Removing the link ends its use, and the customer can ask us to delete the label. ## People who interact with our customers If you comment on or message an account that is managed with our service, we process your username, what you wrote, and when, on behalf of that account’s owner, so they can read and answer it. We keep a comment only when the owner answers it or it matches a reply they set up, together with that answer, for 60 days. If you comment a keyword the owner has set up, the service may send you one direct message with the link you asked for. If you message the account, its team may answer you through the service within the 24 hours Instagram allows; a reply their assistant drafted says it is automated. Reply STOP and it will not message you again; reply HUMAN and the account’s team is told to answer you in person. To have this data removed, ask the account’s owner or write to us. ## AI assistants Customers can connect an AI assistant, such as Claude, to the service. The assistant can read and act on a customer’s accounts only within the permissions that customer grants, and the assistant’s provider handles that data under its own privacy policy. We also use Anthropic’s Claude on our servers for a few features a customer uses inside the service: drafting and rewriting messages and captions, working out what an edit instruction means, and reading the words and still frames of a customer’s posts and videos to suggest formats and edits. For these we send Anthropic the text and still frames needed for that request, and what the customer typed to ask for it. Under Anthropic’s commercial terms it does not train its models on this data. We also send short pieces of text to TypeSafe for yes-or-no judgments about them, and, only when a video needs a closer look, a few still frames to Google’s Gemini API. These providers are listed on the [subprocessors page](https://chockstonelabs.com/legal/subprocessors/). We do not sell this data or use it to train models. ## Link-in-bio pages Customers can publish a link-in-bio page at chock.link followed by their username. When you visit one, or open a customer’s short link at chockstonelabs.com/go or chock.link/go, we count the page view and any link you tap, with the time and the app you opened it from, such as Instagram. These pages set no cookies, and we do not store your IP address with these counts; the server holds it in memory for up to ten minutes, never on disk, so that a reload counts once. ## Service providers A few providers help us run the service, each only for its listed purpose: Replit hosts the service, its database (including the anonymous link-in-bio counts described above), and its files; Clerk handles sign-in and sends invitation emails; Stripe takes payment for paid plans, selling them through its Link service, and receives the paying owner’s name, email, billing address and payment details (payment details go straight to Stripe and never reach us); PostHog receives the product analytics described under [Analytics](https://chockstonelabs.com/privacy/#analytics); Cloudflare runs our domain’s DNS and our outside uptime check; Resend receives and stores the brand email a customer forwards to its deals address, and carries the email we send; Google Workspace carries our own email, including what you send to our addresses; and the browser push services of Apple, Google, and Mozilla deliver the notifications a customer turns on. They process data on our behalf; as the seller of record for paid plans, Link also handles payment data under its own privacy policy. Our [subprocessors page](https://chockstonelabs.com/legal/subprocessors/) lists them with the data each handles. Otherwise we disclose data only when the law requires it. ## Disconnecting and deleting data A customer can disconnect an account in the service at any time, or remove Chockstone Labs from the connected apps in their Instagram or TikTok settings. When an account is disconnected, we delete its access tokens immediately and the rest of its data within 30 days, unless the customer asks us to keep it or the law requires us to. A customer’s owner can also download everything in their space, and delete the whole space, from the service’s Settings. Deleting stops all posting at once, disconnects the space’s accounts, and deletes the rest of its data 30 days later. To ask us to delete data about you, whether you are a customer or someone who interacted with a customer’s account, email [hello@chockstonelabs.com](mailto:hello@chockstonelabs.com?subject=Delete%20my%20data) with the subject “Delete my data” and the username involved. We will delete it and confirm within 30 days. Copies in backups are deleted as those backups expire. ## Our other apps Capnolog, SpotMeter, and PencilCAD are separate apps. Each has its own privacy policy, published on its own website, that covers the data that app handles, and this policy does not apply to them. Capnolog’s privacy policy is at [capnolog.com/privacy](https://capnolog.com/privacy), SpotMeter’s is at [spotmeter.app/privacy](https://spotmeter.app/privacy/), and PencilCAD’s is at [pencilcad.app/privacy](https://pencilcad.app/privacy/). If you are not sure which policy applies to you, write to us at the address below. ## Changes We may update this policy. Changes take effect when posted here with a new effective date. ## Contact Questions or requests about this policy may be sent to [hello@chockstonelabs.com](mailto:hello@chockstonelabs.com) or to the mailing address above.