Legal
Privacy Policy
This policy was last reviewed on the date this installation was deployed.
Read this first. This document is a starting template written to describe how the software behaves. It is not legal advice. Before you publish this installation, replace the operator details below with your own and have the text checked against the law that applies to you, including the GDPR if you have visitors in the EU. Pinterest also requires a working privacy policy link when you apply for API access.
1. Who operates this service
This installation of Kabobs PinFlow is operated by the individual or business that deployed it. Questions about this policy, or requests concerning your data, can be sent to support@kabobsrecipes.com or through the contact page.
2. What is collected
Account information
When you create an account we store your username, email address, optional full name and a hashed version of your password. Passwords are hashed with PHP's password_hash function and are never stored or transmitted in a readable form.
Pinterest authorisation
When you connect a Pinterest account we store the access token and refresh token that Pinterest returns, the token expiry time, the granted scopes, your Pinterest user ID and username, and a cached list of your board names and IDs. These tokens are encrypted before they are written to the database.
We never receive, request or store your Pinterest password. Authorisation happens entirely on pinterest.com.
Content you create
Pin titles, descriptions, alt text, destination links, board selections, scheduled times and the images you upload are stored so that they can be published on your instruction.
Technical and activity data
An activity log records events such as sign-ins, account connections, and publish successes or failures, with timestamps. The contact form stores the name, email, subject, message and IP address of the sender. Web server access logs are kept by the hosting provider under their own policy.
3. Why it is collected
| Purpose | Data used |
|---|---|
| Signing you in and keeping you signed in | Account details, session cookie |
| Publishing pins to Pinterest on your instruction | Pinterest tokens, pin content, images |
| Showing you what happened and diagnosing failures | Activity log, error messages |
| Generating text suggestions when you ask for them | The topic you type into the AI tools |
| Replying to enquiries | Contact form submissions |
4. Who it is shared with
Your data is not sold, rented, or shared for advertising. It leaves this server only in these cases:
- Pinterest, Inc. — pin content, images and your access token are sent to the Pinterest API when you publish or when the scheduler publishes on your behalf. Pinterest's own privacy policy governs what happens after that.
- OpenAI — only if you have supplied your own OpenAI API key and only the topic text you type into the AI tools. Leave the key blank and nothing is sent.
- Your hosting provider — as the party physically storing the database and files.
- Legal obligation — where disclosure is required by applicable law.
5. How long it is kept
- Account records and content are kept until you delete them or close your account.
- Deleting a pin removes its database row and its uploaded image file.
- Disconnecting a Pinterest account removes the stored tokens for it.
- Activity log entries and contact messages are retained by the operator of this installation; set your own retention period and state it here.
6. How it is protected
- Pinterest and OpenAI credentials are encrypted at rest using AES-256-GCM.
- Passwords are hashed, never encrypted or stored in plain text.
- All database access uses parameterised queries.
- Session cookies are HttpOnly, SameSite, and marked Secure when the site is served over HTTPS.
- Uploaded files are type-checked, renamed, and stored in a directory where script execution is blocked.
No system is perfectly secure. Serve this application over HTTPS, keep PHP updated, and use a strong database password.
7. Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a data protection authority. Because this is a self-hosted installation, these requests are handled directly by its operator. Contact them using the details in section 1.
You can also revoke this application's access to your Pinterest account at any time from your Pinterest account settings, independently of anything done here.
8. Children
This service is not directed at children and is not intended for anyone under the age at which Pinterest permits account holders in their country. Do not create an account if you are below that age.
9. Changes
If this policy changes, the revised version will be posted on this page. Continued use after a change means you accept the revised policy.