Help & Support
Security & Privacy
Social Neuron is built with security and privacy as core design principles.
Authentication
- OAuth 2.0 for all social platform connections -- we never store your social media passwords
- API keys prefixed with
snk_for programmatic access, stored in your OS keychain - Row Level Security (RLS) on all database tables -- users can only access their own data
Data Protection
Encryption
- All data in transit encrypted via TLS 1.3
- OAuth tokens encrypted at rest with AES-256
- API keys hashed with SHA-256 before storage
Data Residency
- Application hosted on Vercel (edge network)
- Database on Supabase (AWS, configurable region)
- Media storage on Cloudflare R2 (global)
Privacy Compliance
GDPR
Social Neuron complies with the EU General Data Protection Regulation:
| Right | How to exercise |
|---|---|
| Right to access | Settings > Account > Export Data |
| Right to erasure | Settings > Account > Delete Account |
| Right to portability | Settings > Account > Export Data (structured JSON) |
| Right to rectification | Edit your data directly in the dashboard |
Data Processing
- We process your data to provide the service (GDPR Art. 6(1)(b))
- Analytics use hashed user IDs -- we never send raw identifiers to third parties
- We respect the Global Privacy Control (GPC) browser signal
Cookie Policy
- Essential cookies only for unauthenticated visitors
- Analytics tracking requires explicit consent
- No third-party advertising cookies
Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database, auth | Account data, content |
| Cloudflare R2 | Media storage | Uploaded files |
| Stripe | Payments | Email, subscription tier |
| PostHog | Product analytics | Hashed user ID, events |
| Sentry | Error tracking | Anonymized error data |
| AI providers | Content generation | Prompts (no PII sent) |
All third-party services are bound by data processing agreements.
Reporting Security Issues
If you discover a security vulnerability, please email socialneuronteam@gmail.com with:
- Description of the vulnerability
- Steps to reproduce
- Impact assessment
We aim to acknowledge reports within 24 hours and resolve critical issues within 72 hours.