Privacy Policy

Effective date: October 27, 2026

This Privacy Policy explains how Decoded Dad ("Decoded Dad," "we," "us," or "our") collects, uses, stores, shares, and deletes information in connection with (1) the website at decodeddad.com and its newsletters (the "Site"), and (2) the "Decoded Dad" applications registered with third-party social media platforms, which are used to publish and manage content on social media accounts (the "Social Applications"). Together, these are the "Services."

Decoded Dad is operated by Jeff Weber in the United States. Questions about this policy can be sent to [email protected].

1. Information we collect

1.1 Information collected through the Site

Membership and newsletter information. If you subscribe, we collect your email address and, optionally, your name, along with your subscription preferences and the page or source from which you signed up.
Email engagement. Our newsletters record whether an email was opened and which links were clicked, so we can understand what readers find useful.
Comments. If you comment on a post, we store your comment along with the member name associated with it.
Analytics. We use a self-hosted instance of Plausible Analytics, which measures page views, referring sites, approximate location derived from IP address, browser, operating system, and device type. Plausible does not use cookies and does not create persistent identifiers for individual visitors.
Technical information. Our servers log standard request information such as IP address, browser user agent, requested page, and time of request, for security and troubleshooting.

The Social Applications are used only by Decoded Dad and by individuals Decoded Dad has expressly authorized, to manage social media accounts that they own or administer. When an authorized user connects an account, and only with that user's permission granted through the platform's own authorization screen, we receive and store:

Authorization credentials: access and refresh tokens issued by the platform, which allow us to act on the connected account as the user authorized.
Account and profile information: account or channel identifiers, display name, username, and profile picture, and the list of Pages, organizations, channels, or servers the user manages and chooses to connect.
Content: posts, captions, images, videos, and scheduling details that the user creates or schedules through the Social Applications, and identifiers of the resulting published posts.
Engagement and insights: metrics the platform provides about the connected account and its posts (for example, impressions, reach, likes, comments, followers, and video views), and comments or replies on content published through the Social Applications.

We do not request or receive passwords for connected social media accounts, except where a platform's own design requires an application-specific password (such as a Bluesky app password), which the user creates and can revoke at any time.

2. How we use information

To operate the Site, deliver newsletters you have subscribed to, and display comments.
To publish, schedule, and manage content on connected social media accounts as directed by the authorized user.
To display engagement metrics and comments to the authorized user so they can understand and respond to their audience.
To maintain the security, integrity, and reliability of the Services, and to troubleshoot problems.
To comply with legal obligations and to enforce our Terms of Service.

We use information obtained from social media platforms only to provide the features described above to the user who authorized the connection. We do not use it to build advertising profiles.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

With the social media platforms themselves, when the authorized user directs us to publish, edit, or delete content, or to retrieve metrics.
With service providers that process data on our behalf: Mailgun, to deliver newsletter and account emails; and artificial intelligence model providers, accessed through our own gateway with zero-data-retention settings where offered, only for content an authorized user chooses to process with AI-assisted writing or image tools. Service providers may use information only to provide their services to us.
For legal reasons, when required by law, legal process, or a governmental request, or when necessary to protect the rights, property, or safety of Decoded Dad, our users, or others.
In a business transfer, such as a merger or sale of assets, subject to this Privacy Policy.

Information obtained through Google APIs is not transferred to advertising platforms or data brokers, is not used to serve or target advertising, and is not used to determine creditworthiness or for lending purposes. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Platform-specific disclosures

The Social Applications use the official APIs of the platforms listed below. Your use of each platform remains subject to that platform's own terms and privacy policy.

YouTube and Google. The Social Applications use YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy. You can revoke our access to your Google account at any time at https://security.google.com/settings/security/permissions.
Meta (Facebook, Instagram, and Threads). You can remove our access in Facebook Settings & Privacy → Settings → Apps and Websites, in Instagram Settings → Apps and websites, or in Threads Settings → Account → Website permissions. See the Meta Privacy Policy.
LinkedIn. You can remove our access in LinkedIn Settings → Data privacy → Permitted services. See the LinkedIn Privacy Policy.
TikTok. You can remove our access in TikTok Settings and privacy → Security → Apps and services permissions (labels vary by version). See the TikTok Privacy Policy.
Discord, Twitch, Kick, Mastodon, and Bluesky. You can remove our access in each service's connected-apps or authorized-applications settings, or, for Bluesky, by deleting the app password you created.

5. Cookies

The Site uses only cookies necessary for its operation, such as a session cookie that keeps subscribed members signed in. Our analytics do not use cookies. The Site loads fonts from Google Fonts, which means your browser requests font files from Google's servers and Google receives your IP address; see the Google Privacy Policy. We do not use advertising cookies.

6. Data storage and security

The Services are hosted on infrastructure operated by Decoded Dad in the United States. Information is transmitted over encrypted connections, access to systems and stored credentials is restricted to the operator, and authorization credentials for connected accounts are stored in access-controlled databases. No method of transmission or storage is completely secure, but we work to protect your information using measures appropriate to its sensitivity.

7. Data retention

Authorization credentials are kept while the account remains connected, and are deleted when the account is disconnected or access is revoked.
Content and engagement data from social media platforms are kept while the account remains connected, to provide scheduling history and metrics to the authorized user, and are deleted on request or after the account is disconnected. Data obtained from YouTube API Services, other than authorization credentials, is refreshed or deleted at least every 30 days.
Newsletter and member information is kept until you unsubscribe and ask us to delete it, or delete your account.
Server logs are kept for a limited period for security purposes and then deleted.

8. Your choices and rights

You can unsubscribe from newsletters at any time using the link in any email. You can disconnect a social media account at any time from within the Social Applications or from the platform's own settings, as described in Section 4.

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, to object to or restrict certain processing, and to receive a copy of your information. To make a request, email [email protected]. We will respond within the time required by applicable law, and we will complete deletion requests within seven (7) calendar days of verifying the request. We will not discriminate against you for exercising these rights.

9. Data deletion

You can request deletion of all information we hold about you, including any data obtained from Facebook, Instagram, Threads, YouTube, or any other platform. Step-by-step instructions are on our Data Deletion page. Deleting information we hold does not affect data stored by the social media platforms themselves, including content you published to them.

10. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date, and if we make material changes to how we use information obtained from connected accounts, we will notify affected users and, where required, ask for renewed consent.

12. Contact

Decoded Dad
Email: [email protected]