Privacy Policy
Last updated: 2026-08-22
LEGAL_ENTITY_NAME, LEGAL_CONTACT_EMAIL, LEGAL_JURISDICTION are unset on the web service. Set them before anyone is asked to agree to this.This explains what Mark collects, why, and who else sees it. The controller of your data is [provider not configured]. For anything in this policy, including a request about your own data, contact [contact email not configured].
What we collect
| Your Telegram identity | Your numeric Telegram user ID and your @username. That’s the whole of it — we don’t store your name, phone number, or profile photo. The username is kept so we can still recognise you if the ID we were given at sign-in doesn’t match the one the bot sees. |
| Your email address | Only if you subscribe — it comes from Stripe’s checkout page. Used for receipts and for anything important about your account. We don’t market to you. |
| What you tell Mark | Your messages, including any photos and voice notes you send; your brand profile (what your business does, tone, topics, goals, things never to say, sample copy); and the drafts, images, and posts produced from them. |
| Connected accounts | A reference to the social accounts you connect, and — for a WordPress site — the site address and application password. Credentials are encrypted at rest and are never shown back to you or to anyone else. |
| Billing records | Your Stripe customer and subscription identifiers, your plan, and your usage history (how many posts, when). We never see or store your card details — those go straight to Stripe. |
| Technical logs | Server logs of requests and jobs, for debugging, security, and abuse prevention. |
Cookies
Two, both strictly necessary, both set by us: a sign-in cookie that keeps you logged in for 30 days, and a short-lived sign-in-in-progress cookie that lasts ten minutes and protects the Telegram login round trip. Both are HTTP-only.
There is no analytics, advertising, or third-party tracking on this site, and no cookie banner, because there is nothing to consent to beyond the two above.
Why we’re allowed to process it
- To perform our contract with you — running the Service: drafting, generating, scheduling, publishing, and billing.
- Our legitimate interests — keeping the Service secure, preventing abuse, and debugging failures.
- Legal obligation — keeping records of payments for as long as accounting and tax rules require.
Who else processes it
Mark is built on other people’s services, and running it means sending them the parts they need. Several are outside the EEA; transfers rely on the safeguards in those providers’ terms (typically Standard Contractual Clauses).
| Telegram | Delivers the chat, and provides sign-in. Sees your messages to the bot. |
| Anthropic | Writes the copy. Receives your messages and brand profile as prompts. |
| Google, Ideogram | Generate images. Receive image prompts. |
| OpenAI | Transcribes voice notes and produces spoken replies. Receives the audio. |
| Zernio | Connects your social accounts and posts to them. Receives the content being published. |
| Stripe | Takes payment. Holds your card details and billing email; we don’t. |
| Cloudflare (R2) | Stores images and voice notes. |
| Railway | Hosts the application and its database. |
Publishing to your own website or social accounts sends content to those platforms, under their privacy policies rather than ours.
What we don’t do
- We don’t sell your data, or share it for advertising.
- We don’t use your content to train our own models.
- Our AI providers state that they don’t train on data submitted through their APIs. That’s their commitment rather than ours, and their terms can change — check them if it matters to you.
How long we keep it
- Your account, brand profile, drafts and media: while your account exists.
- Active conversation context: a short rolling window, held in memory and refreshed as you talk.
- Billing and usage records: kept as long as accounting and tax rules require, even after you close the account.
- Logs: a short retention window, then discarded.
Ask us to close your account and we’ll delete your content and disconnect your accounts, keeping only what we’re legally required to keep.
Your rights
If you’re in the EEA or UK, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email [contact email not configured] and we’ll respond within one month. You can also complain to the data protection authority in [jurisdiction not configured] or where you live.
Automated content
Mark writes drafts automatically, but it doesn’t make decisions about you, and nothing it produces is published without your approval.
Children
The Service isn’t for anyone under 18, and we don’t knowingly collect their data.
Changes
If this policy changes in a way that matters, we’ll tell you before it takes effect. The date at the top always reflects the current version.