Privacy policy
Effective 11 October 2026
The short version
This page says what RUNIT keeps about you, why, who else handles it, and how to get it deleted. RUNIT stores what it needs to write, schedule and publish your posts, read the comments and enquiries you point it at, and show your public page. It does not sell data, does not show adverts, and does not use your content to train anything. You can delete everything yourself from Settings.
Who is responsible for your data (the “data controller”): Iam The Protagonist Ltd, trading as RUNIT and The It Group, a private limited company registered in England and Wales, company number 16842280, registered office 60 Hay Lane, London, NW9 0NB, United Kingdom. Registered with the Information Commissioner's Office, registration number ZC272634. Email: theitgroupapps@gmail.com.
1. What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Account: email address, a hashed password or the identifier Google gives us when you sign in with it, and the settings you choose. | To create your account and sign you in. | Contract |
| Connected social accounts: the handle, its ID on the platform, its profile picture, and the access key the platform issues so RUNIT can post and read figures for you. Keys are encrypted before they are stored and deleted when you disconnect. | To publish and read on your behalf — that is what the app is for. | Contract |
| Things you add: drafts, captions, hashtags, schedules, photos and video, templates, briefs, the brand kit, your public page, watchlist handles, and the figures the platforms report for posts RUNIT published. | That is what the app is for. | Contract |
| Email in the Deal Inbox: the subject, sender and body of messages in a Gmail account you connect or forward to a private RUNIT address, plus the summaries and reply drafts made from them. | To sort your enquiries and draft replies you choose to send. | Contract |
| Comments on your posts, fetched from the platforms, and the category RUNIT files each under. | So replies can be drafted and abusive ones hidden. | Contract |
| An audit log: who approved, published, connected or invited what. | So a workspace with several people in it has a record. | Legitimate interests (running a shared workspace) |
| Push notification token — an anonymous device token if you turn notifications on in the phone app, deleted when you sign out. | To send you the notifications you have turned on. | Consent |
| Server logs: the address your device connects from and the pages it asks for, kept by our hosting for a few days. | To keep the service secure and fix faults. | Legitimate interests (running a working app) |
| Support emails you send us. | To answer them. | Legitimate interests |
RUNIT asks for no location, no contacts and no crash reports. We do not sell your data, and we don’t use it for advertising.
How platform data is used
Data obtained from Instagram, Facebook, Threads, TikTok, LinkedIn, YouTube, X and Bluesky is used only to publish the posts you approve, to show you how those posts performed, to draft replies to comments on them, and to show you public figures for accounts you add to a watchlist. It is not shared with anyone else, not used for advertising, and not used to build profiles of other people.
RUNIT’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to upload videos you approve with the captions you add, read their statistics and comments, and post the replies you approve; Gmail data is used only to read and summarise enquiries in the Deal Inbox and to send a reply you have written and confirmed.
2. Who else handles it
We use other companies to run the app. They only get what they need for their job, under a contract that stops them using it for anything else.
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts the database, sign-in and file storage. | London, UK |
| Vercel | Hosts the website and the API. | London, UK (a US company) |
| Anthropic | The AI model that writes drafts. It receives the text you ask it to work from and your brand kit; drafts are not used to train models. | US |
| Google (Gemini) | Restyles pictures when you ask it to. It receives that picture, up to three of your recent pictures as examples of your look, your brand colours and what you describe, on Google’s paid service, whose terms don’t let Google use them to improve its products. | US |
| Resend | Sends notification emails to you and receives mail forwarded to your private Deal Inbox address. | US |
| Stripe | Takes payment for website purchases. Card details go to Stripe directly and never touch RUNIT; Stripe is the controller for card data under its own policy. | US and EU |
| Apple / Google | Sign-in, push notifications, app distribution and billing in the phone app, seeing only the device token and the notification text. | US |
| The platforms | Instagram, Facebook and Threads (Meta), TikTok, X, LinkedIn, YouTube and Gmail (Google), and Bluesky receive the posts and replies you approve, under their own policies. | US |
Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or the UK’s adequacy regulations for that country.
People you invite into a workspace see the posts, media and figures in it according to their role. Anyone opening your public page sees what you chose to put on it. We’ll share data if the law requires it — a court order, a lawful request from the police or a regulator — and to protect someone’s safety.
How we protect your data
Sign-in keys from Google (YouTube and Gmail), Meta, TikTok and the other platforms, and any AI key you add, are the most sensitive things RUNIT holds. They are encrypted with AES-256-GCM before they are written to the database, using a key kept only in the server’s protected settings and never in the database itself, and are decrypted only in memory at the moment RUNIT posts or reads on your behalf. They are never sent to your browser or the phone app.
- In transit — every connection to RUNIT, and from RUNIT to the platforms and the services above, uses HTTPS (TLS).
- At rest — the database and file storage are encrypted at rest (AES-256) by Supabase, hosted in London.
- Access control — database row-level security means a signed-in person can only ever read the workspaces they belong to. Each member has a role (owner, publisher or editor) that limits what they can see and do, and actions are written to the audit log.
- Least access — RUNIT asks each platform only for the permissions the features above need, and the administrative keys that bypass those rules exist only on the server and are held by the company alone.
- Google user data — data from Google APIs is not read by people at RUNIT, except with your permission for support, where needed for security or to comply with the law. It is never sold, never used for advertising and never used to train AI models.
- If something goes wrong — no system is perfect; if a breach puts you at risk we will tell you and, where the law requires, the Information Commissioner’s Office within 72 hours.
3. How long we keep it
- Your account and what’s in it: while your account exists. Media files no longer attached to any post are removed automatically along the way. When you delete your account, everything is removed at once.
- Platform sign-in keys: deleted the moment you disconnect the account.
- Payment records for website purchases: 6 years after the transaction, because tax law requires it. They are kept separately from your profile and contain only what the record needs.
- Server logs: a few days.
- Backups: up to 30 days, after which deleted data is gone from them too.
4. Your rights
Under UK data-protection law you can ask us to:
- show you what we hold about you (a copy, usually within a month);
- correct it;
- delete it (which you can also do yourself in the app — see below);
- give you a copy in a form you can take elsewhere;
- stop using it for a particular purpose, or object to our legitimate-interests uses;
- withdraw consent for anything that was based on it, like notifications.
Email theitgroupapps@gmail.com and we’ll reply within one month. If you’re not happy with how we handle it you can complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.
Deleting your data
Open Settings in RUNIT, scroll to Delete account, type your email address to confirm, and everything — workspaces, posts, media, connected-account keys, inbox threads, notifications — is deleted straight away and disappears from backups within 30 days.
To remove a single platform instead, open Connections and disconnect it; its key is deleted immediately. If you removed RUNIT from a platform’s own settings first and want the data it already holds gone, email theitgroupapps@gmail.com from the address on your account and it will be deleted within 7 days.
5. Children
RUNIT is not for anyone under 13. We don’t knowingly collect data from them. If you think a child has given us data, email us and we’ll delete it.
6. Cookies and tracking
The phone app sets no cookies. The website uses only the cookies it needs to keep you signed in; there are no analytics or advertising cookies. We don’t use Apple’s App Tracking Transparency because we don’t track you across other companies’ apps.
7. Changes
If how we handle data changes, this page is updated first and the effective date above changes. For anything significant we’ll tell you in the app or by email.
8. Contact
Iam The Protagonist Ltd, trading as RUNIT and The It Group
Registered in England and Wales, company number 16842280
60 Hay Lane, London, NW9 0NB, United Kingdom
theitgroupapps@gmail.com