Rama Social

Privacy Policy

Last updated: 13 September 2026

Rama Social is a private, self-hosted social media scheduling tool operated by Rama Skills at social.ramaskills.in. This policy explains what data the service holds, why, and how to remove it.

This is a private instance. It is not open to public sign-up. Accounts are created only by the operator, and the service is used to publish to social media accounts that Rama Skills owns or is authorised to manage. Your data is stored on a server we control and is not sold, rented, or shared with advertisers.

1. Who we are

Rama Skills ("we", "us") operates this instance. For any privacy question, data request, or complaint, contact me@ramaskills.in.

2. What we collect

Data	Why we hold it
Email address	Account identity and sign-in.
Password	Sign-in. Stored only as a one-way hash — never in readable form.
Name, profile picture, bio	Shown in the interface. Optional.
IP address, last-seen time, timezone	Security, abuse prevention, and scheduling posts in your local time.
Social account access tokens	Required to publish on your behalf. See section 3.
Post content, drafts, schedules, tags, comments	The core function — the posts you write and when they go out.
Uploaded media (images, video)	Attached to your posts. Stored on our server disk.
Analytics returned by each platform	Displaying post performance inside the app.

We do not use advertising trackers, third-party analytics scripts, or cookies beyond the session cookie needed to keep you signed in.

3. Connected social accounts

When you connect a channel (Instagram, Facebook, X, LinkedIn, YouTube, and similar), that platform's own OAuth screen asks for your consent and then returns an access token to this server. We store that token, its refresh token, and its expiry so that scheduled posts can be published at the right time without you signing in again.

What we do with platform data

Publish the posts and media you schedule.
Read your account/page name and profile picture, to show you which channel you are posting to.
Read post metrics and comments, to display them in the app.

What we never do

Post anything you have not created or scheduled.
Read or store your social media password — OAuth means we never see it.
Sell, rent, or transfer platform data to any third party.
Use platform data for advertising, profiling, or training machine-learning models.

You can disconnect any channel at any time from Settings → Channels. Disconnecting deletes the stored tokens for that channel. You can also revoke our access from the platform's own security settings (for Instagram and Facebook: Meta Accounts Centre → Apps and websites).

4. Where your data lives

Everything is stored on a single private virtual server rented from Hostinger, located in India. Data is held in a PostgreSQL database and on the server's own disk. Traffic to and from the site is encrypted with TLS (HTTPS). The database is not reachable from the public internet.

5. Third parties

We do not share your data with third parties, with these unavoidable exceptions:

The social platforms you connect — receive the posts and media you choose to publish.
Hostinger — our hosting provider, which physically operates the server.
Optional AI features — if an AI provider key is configured, text you explicitly submit to an AI feature is sent to that provider to generate a response. This is off unless enabled.
Legal obligation — if required by valid legal process.

6. How long we keep it

Account data — until the account is deleted.
Posts and media — until you delete them, or the account is deleted.
Access tokens — until you disconnect the channel or revoke access at the platform.
Server logs — rotated and discarded automatically within 14 days.

Deleting your account removes your posts, media, and tokens from the live database. Encrypted backups may retain a copy for up to 30 days before being overwritten.

7. Your rights

You can ask us to show you the data we hold about you, correct it, export it, or delete it entirely. Email me@ramaskills.in and we will respond within 30 days. See Data Deletion for the self-service route.

8. Security

Passwords are hashed. The site is served only over HTTPS. The application and its database run in isolated containers bound to the server's loopback interface, so they cannot be reached directly from the internet. Access tokens are stored in a database that is not publicly exposed. No system is perfectly secure; if we become aware of a breach affecting your data, we will tell you.

9. Children

This service is not intended for anyone under 18 and we do not knowingly collect their data.

10. Changes

If this policy changes materially, we will update the date at the top of this page and notify account holders by email.

11. Contact

Rama Skills — me@ramaskills.in
Service: social.ramaskills.in