This policy explains what personal data Forecast collects, why, who else processes it, how long it's kept and the rights you have. Forecast is operated by Chell Technologies Limited, Lagos, Nigeria ("we", "us"), a company in Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (NDPA) and, for people in the UK and European Economic Area, the GDPR.
Questions or requests: privacy@postforecast.xyz.
The short version
- Forecast only reads your Buffer account. It can't post, edit or delete anything there, or on any platform you connect.
- We use your posts and their results to forecast your posts, and to train and test Forecast's forecasting models.
- Connecting Instagram or YouTube, and sharing results in anonymised benchmarks, are optional and off until you turn them on.
- We don't sell personal data, show ads, or use advertising or analytics trackers.
- You can disconnect anything, and delete your account in Settings, at any time.
What we collect
From Buffer, when you sign in
- Your Buffer account: name, email address and Buffer account ID.
- Your Buffer organisations and connected channels: channel names, handles, profile pictures, platforms and time zones.
- Your posts: text, media (links and thumbnails), status, scheduled and sent times, and the channel each is for.
- Your posts' results as Buffer reports them (for example impressions, reach and engagement): day by day for the first 7 days after sending, and the latest totals of posts sent in the last 6 months.
- Access tokens that let Forecast read your Buffer account. They are encrypted when stored.
- If you add one, your Buffer personal API key, used only to read your posts' results. It is encrypted when stored, and you can remove it at any time in Settings.
From you, in Forecast
- Your settings: target countries, pre-publish check settings, notification settings (alert emails and quiet hours), which onboarding tours you've seen, and whether you share results in benchmarks.
- What you ask Forecast to do, such as a forecast for a different timeline, caption ideas, a country analysis or a comparison.
- Alerts you set on scheduled posts: the keywords you choose, their order, how often to check, and what to do when they fire. Forecast records each check's score, which trends and headlines it matched, and the notifications it sent you.
From Instagram or YouTube, only if you connect them
- The connected account's ID and name.
- Audience figures the platform reports to you as the account owner: the share of your followers (Instagram) or views and viewers (YouTube) by country, age band and gender. These are totals for your whole audience. We don't receive anything about individual followers or viewers.
- Access tokens for reading those figures, encrypted when stored.
Collected automatically
- A sign-in cookie that keeps you signed in, and a short-lived cookie that protects connecting Instagram or YouTube.
- Your colour theme, stored in your browser.
- Server logs: the time, the address requested and the response, kept to run and secure the service. We strip query strings, which can carry sign-in codes.
- If something breaks, an error report with technical details. Reports exclude cookies, headers, request bodies and post text.
This website (postforecast.xyz) sets no cookies and uses no analytics.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Signing you in, reading your posts, and showing forecasts, country analyses, caption ideas, comparisons, pre-publish checks and exports | Performing our contract with you (these terms) |
| Running the alerts you set, and emailing you when one fires (you can turn alert emails off in Settings) | Performing our contract with you (these terms) |
| Training and testing Forecast's forecasting models on posts and their results, so forecasts get more accurate | Our legitimate interest in improving the service. You can object (see "Your rights"). |
| Showing your own Instagram or YouTube audience | Your consent, given when you connect. Withdraw it by disconnecting. |
| Including your results in anonymised benchmarks | Your consent, given by switching it on. Withdraw it by switching it off. |
| Keeping the service secure, preventing abuse and fixing errors | Our legitimate interest in running a secure service |
| Meeting legal obligations, such as answering lawful requests | Legal obligation |
Forecasts are estimates to help you plan. Forecast doesn't make decisions about you that have legal or similarly significant effects.
Anonymised benchmarks
If you switch on "Include my results in anonymised benchmarks", the results of your sent posts from the last six months (at most 50 per platform) are pooled with other people's. We publish only typical ranges for groups of similar posts (platform, type of post and time of day), and only for groups with at least 20 accounts. Nobody sees your posts, captions, account or individual results. Instagram and YouTube audience figures are never used in benchmarks. Switch it off and your results leave the benchmarks at the next nightly update.
Who else processes your data
We use these service providers. Each processes data only to provide its service to us, under its data processing terms:
| Provider | What for | Data |
|---|---|---|
| Railway | Hosting our servers and database (EU, Netherlands) | Everything Forecast stores |
| Cloudflare | Delivering the app and this website | Requests passing through, including your sign-in cookie |
| Anthropic (Claude) | Writing forecast explanations, caption ideas and country notes | Post text and the figures needed for the request, including your audience shares if connected |
| OpenRouter | Checking posts for sensitive moments and trend relevance | Post text and current trend terms |
| Resend | Sending alert emails, if you have alerts with email on | Your email address and the alert message (the keyword, score and your post's due time) |
| DataForSEO | Search interest for trends and alert keywords | Search terms, such as your alert keywords, without anything that identifies you |
| Sentry | Error reports, if enabled | Technical error details, without cookies, request bodies or post text |
We also read public data that contains nothing about you: Google Trends, X trends, Google search interest through DataForSEO (we send search terms and a country, not who asked), news from GDELT and Google News (and, where we enable them, The Guardian, The New York Times, NewsData.io, GNews and Event Registry), Wikipedia's most-read articles, trending hashtags on Mastodon, trending YouTube videos, public holidays from Nager.Date, country statistics from the World Bank and language data from Unicode CLDR. We send these sources a country and search words, never anything about you.
Buffer, Meta (Instagram) and Google (YouTube) are where we read your data from, each under the access you grant. Their own privacy policies apply to what they hold.
We don't sell or rent personal data, share it for advertising, or let providers use it to train their own models for other customers. We may disclose data if the law requires it, or to a buyer if the business is sold, under this policy.
Google and YouTube data
Forecast's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's processing is covered by the Google Privacy Policy. You can disconnect in Forecast's settings or remove Forecast's access at myaccount.google.com/permissions; we then delete the YouTube data we hold.
International transfers
Your data is stored in the European Union (Netherlands). Some providers above process it in other countries, including the United States. Where data leaves Nigeria, the UK or the EEA, we rely on the safeguards the law allows, such as the provider's data processing agreement and standard contractual clauses.
How long we keep it
- Your account, posts, results and forecasts: while your account is open. When you delete your account in Settings, they're deleted straight away; if you ask us by email, within 30 days. Forecasting models already trained keep only what they learned in aggregate, not your posts.
- Buffer, Instagram and YouTube access tokens, and your Buffer API key: until you remove or disconnect them, revoke access on the platform, or delete your account.
- Instagram and YouTube audience figures: the latest figures only, replaced each day, and deleted when you disconnect.
- Database backups: one a day, each kept for 7 days, so deleted data leaves our backups within 7 days.
- Server logs: up to 30 days. Error reports: up to 90 days.
- Benchmarks: contain only group totals, rebuilt every night.
- Alerts: while active, and for 7 days after they end (when the post goes out, is deleted, or you delete the alert). Each alert's check scores are kept for 90 days. Notifications stay in your account until you delete it.
Your rights
Under the NDPA (and the GDPR, if it applies to you), you have the right to:
- be told how your data is used (this policy);
- get a copy of your personal data, and have it in a portable format;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of it, including for training forecasting models;
- withdraw consent at any time, without affecting what was done before;
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or your local data protection authority.
Email privacy@postforecast.xyz from the address on your Buffer account. We reply within 30 days. You can also do some of this yourself in Forecast's settings: delete your account, disconnect Instagram or YouTube, and switch off benchmarks. You can revoke Forecast's access to Buffer from Buffer's settings.
Deleting your data from Instagram's side
If you remove Forecast from your Meta business settings or ask Meta to delete your data, Meta tells us and we delete your Instagram connection and audience figures straight away. A data deletion request gives you a confirmation code and a page showing it was done.
Security
Connections are encrypted in transit (HTTPS). Access tokens are encrypted when stored, and access to our systems is limited to the people who run Forecast. No system is perfectly secure; if a breach affects you, we'll tell you and the regulator as the law requires.
Children
Forecast is for businesses and creators aged 18 or over. We don't knowingly collect data from children.
Changes
We'll post changes here with a new effective date, and tell you in the app or by email before significant changes take effect.
Contact
Chell Technologies Limited, Lagos, Nigeria
privacy@postforecast.xyz