Privacy policy

As of October 2026. Applies to the crosspost service at crosspost.tstieh.de. Translation for convenience — the German version is legally binding.

1. Controller

Tom Stieh, Webdesign & Betreuung (sole proprietorship). Postal address and further contact details are in the legal notice. Privacy requests: webdesign@tstieh.de. No data protection officer is appointed or required.

2. What crosspost does

crosspost is a tool for invited users: you upload a video, and crosspost publishes it on your behalf to YouTube, Instagram and/or TikTok. It only processes the data needed for that.

3. Sign-in and user account

Sign-in runs through Accounts @tstieh.de (portal.tstieh.de), a self-hosted identity service (Authentik) on the same servers. crosspost receives a unique identifier, your name, your email address and your group membership (to check the invitation) and stores identifier, name, email, creation date and last sign-in. Legal basis: Art. 6(1)(b) GDPR (providing the service). Stored until you delete your crosspost account.

4. Connected platform accounts

When you connect YouTube, Instagram or TikTok, you sign in directly with that platform; crosspost never sees your password. crosspost receives access tokens and stores them encrypted (AES-256-GCM), together with the account ID, account or channel name and the granted permissions. Tokens are used solely to publish the videos you request, check their processing status and keep the access valid. Legal basis: Art. 6(1)(b) GDPR. When you disconnect, the tokens are deleted and, where the platform supports it, revoked there.

Requested permissions:

  • YouTube (Google): upload videos (youtube.upload) and read the channel name (youtube.readonly).
  • Instagram (Meta): basic data of the business/creator account and content publishing (instagram_business_basic, instagram_business_content_publish).
  • TikTok: basic data (display name), upload and publish videos (user.info.basic, video.upload, video.publish).

crosspost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. crosspost uses YouTube API Services; the YouTube Terms of Service and the Google Privacy Policy apply. You can also revoke access at any time at myaccount.google.com/permissions. Data obtained from platform APIs is not sold, not used for advertising and not shared with third parties other than the platform you publish to.

5. Videos and texts

Uploaded videos, titles, descriptions, chosen settings and publishing status are stored to carry out publishing and show you its progress. The video file is transferred to the platforms you select. For Instagram, crosspost serves the video under a random, signed address that expires after a few hours, from which Instagram fetches it.

Video files are deleted automatically 7 days after all publishing is finished, or immediately on request (delete post). Texts and status remain until you delete the post or your account. Legal basis: Art. 6(1)(b) GDPR.

6. Recipients and third countries

When publishing, video, texts and settings are sent to the respective platform, whose privacy terms apply; the platforms also process data outside the EU:

  • Google Ireland Limited / Google LLC (USA, certified under the EU-US Data Privacy Framework) — privacy
  • Meta Platforms Ireland Limited / Meta Platforms, Inc. (USA, certified under the EU-US Data Privacy Framework) — privacy
  • TikTok Technology Limited (Ireland); transfers to third countries as described by TikTok, including on the basis of standard contractual clauses — privacy

These transfers only happen at your request and are necessary for the service (Art. 6(1)(b), Art. 49(1)(b) GDPR). crosspost does not share data beyond that.

7. Hosting and server logs

crosspost runs on own servers at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), located in Helsinki, Finland (EU), under a data processing agreement pursuant to Art. 28 GDPR. Requests technically involve IP address, time, requested address, status code and browser identifier; these are kept in logs for at most 14 days to secure operations (Art. 6(1)(f) GDPR).

8. Emails

crosspost emails you when publishing fails permanently, a TikTok draft is ready, or you request your data by email. Sent via an own mail server (mx.volantic.de, also Hetzner, EU). Legal basis: Art. 6(1)(b) GDPR.

9. Cookies

crosspost only sets technically necessary cookies: a session cookie for sign-in (up to 30 days) and a cookie for your language choice (one year). No tracking, no analytics, no advertising, no external fonts or scripts. Legal basis: Section 25(2)(2) TDDDG, Art. 6(1)(b) GDPR.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Under "My account" you can download all stored data yourself and delete your account including all data. You may also lodge a complaint with a supervisory authority, e.g. the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

No automated decision-making or profiling takes place.