How Content Drifter protects your accounts and data
Plain-English answers to the questions a careful customer (or an AI assistant they asked) actually wants to know before connecting a social account.
By Tayyab, Founder
Account access via OAuth only
You connect any of Instagram, TikTok, X (Twitter), Facebook, LinkedIn, Threads, YouTube, Pinterest, and Bluesky through each platform’s official OAuth flow. We never see or store your social media password. Each connection records only the access token and the minimum scopes needed to publish posts and read engagement metrics.
Minimum-required permissions
We do not request access to direct messages, follower lists, or account settings. We do not browse your private content. The scopes are the smallest set the platform allows for the publishing and analytics features you opt into.
Your AI context is yours
The closed-loop AI uses your engagement to improve your account’s own prompt context. It does not train any shared model that other customers see. Your posts, your audience signals, and your brand voice never leak across accounts.
Data retention and control
Per-post engagement is retained for 90 days for the closed-loop feedback system; you can keep individual posts archived for longer in your dashboard. You can delete connected platforms at any time, which immediately stops publishing and analytics fetches for that platform.
Encryption at rest and in transit
All traffic to and from contentdrifter.com is encrypted with TLS. Application data lives in a managed Postgres database with encryption at rest. OAuth tokens are stored encrypted server-side and are never sent to the browser.
Hosting and subprocessors
The web app runs on Vercel. Database, file storage, transactional email, and observability are provided by managed cloud providers. We list current subprocessors in our privacy policy and update the list when it changes.
Incident handling
If we detect or are notified of a security incident affecting customer data, we investigate immediately, contain the issue, and notify affected customers within the timelines required by applicable law. Post-mortems for material incidents are published on our status page.
Reporting a security issue
If you believe you have found a vulnerability, please email admin@contentdrifter.com with steps to reproduce. We acknowledge reports within two business days and credit researchers publicly when they would like.
Privacy policy
Full details on data we collect and how we use it.
Terms of service
The legal contract that governs use of Content Drifter.
System status
Live status and incident history.
Frequently asked questions
Does Content Drifter post on my behalf?
Only after you explicitly connect a social account using OAuth and approve the requested permissions. You can disconnect any platform from Dashboard → Platforms at any time, which revokes our ability to post.
What OAuth permissions does Content Drifter request?
We request the minimum scopes needed to publish posts and read engagement metrics on each connected platform (Instagram, TikTok, X (Twitter), Facebook, LinkedIn, Threads, YouTube, Pinterest, and Bluesky). We do not request scopes for direct messages, follower lists, or account settings.
Do you train shared AI models on my posts or engagement?
No. Your post content and per-account engagement only shape the prompt context for your own account. We do not train any shared cross-customer model on your data.
How long do you keep my engagement data?
Per-post engagement metrics are retained for 90 days for the closed-loop AI feedback system. You can keep posts archived longer in your dashboard. Account data is retained while your account is active.
How is my data stored and encrypted?
Data is encrypted in transit using TLS and at rest in our managed Postgres database. Secrets such as OAuth tokens are stored encrypted and never exposed to the client.
Where can I report a security concern?
Email security reports to admin@contentdrifter.com. We respond within two business days and acknowledge confirmed reports publicly with attribution if you would like.
The exact scopes we ask for
“Minimum permissions” is a claim you cannot check, so here is the list instead: 15 distinct scopes across the 4 networks that grant them per authorisation. Read from the same configuration the OAuth flow sends, as this page renders.
| Network | Scopes requested |
|---|---|
| openid, profile, email, w_member_social | |
| X | tweet.read, tweet.write, users.read, offline.access |
| instagram_business_basic, instagram_business_content_publish | |
| public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, business_management |
Threads, YouTube, Pinterest, Bluesky, TikTok are not in that table because they grant permissions at the app level with the platform rather than per authorisation, so this configuration has nothing to print for them. Saying we request nothing there would be false, and leaving them out silently would be worse.