FerrowSign in

Privacy Policy

Last updated: 12 October 2026

Ferrow (“we”, “us”) is a tool for writing posts once and publishing them to X and LinkedIn, now or on a schedule, from the web app or from Claude. It is operated by Papan Sarkar, an individual based in Kolkata, West Bengal, India. This policy explains what we collect, why, who processes it on our behalf, and the choices you have.

The short version: we only collect what is needed to publish your posts, plus anonymous page-view counts. We do not sell your data, show ads, or use tracking cookies.

1. What we collect

Your Ferrow account

  • Name, email address and timezone.
  • Your password, stored only as a one-way scrypt hash. We cannot see it.

Connected X and LinkedIn accounts

When you connect a platform, we receive and store:

  • Your account ID on that platform and your public handle or name.
  • The access and refresh tokens the platform issues to us, encrypted at rest with AES-256-GCM, and the permissions you granted (for X: read and write posts and read your profile; for LinkedIn: sign-in with your basic profile and post on your behalf).

We use these only to publish posts you create or approve. We do not read your feed, messages, followers, connections or contacts.

Your posts

  • Post text, the platforms you chose, schedule times, and publishing results (status, the platform’s post ID and link, and any error message).
  • Whether a post was created in the web app or through Claude.

Connected apps (Claude)

If you connect Ferrow to Claude, we store which app you approved, the permissions you granted, when it last used them, and its access tokens as one-way hashes. Revoking the app in Settings ends its access immediately.

Contact form

  • Your name, email address and message.
  • A one-way hash of your IP address, used only to limit spam. We do not store the IP address itself.

Technical data

Our hosting provider processes standard request logs (such as IP address, browser type and the page requested) to run and secure the service. We do not use these logs to build profiles.

Anonymous usage statistics

We use Vercel Web Analytics to count page views. It uses no cookies and stores no personal identifiers: visits are grouped by a short-lived hash that is discarded after 24 hours. For each page view it records the page path (we remove query strings before sending), the referring site, your approximate location (country/region/city), and your browser, operating system and device type.

2. Cookies and local storage

  • Sign-in cookies (authjs.session-token, authjs.csrf-token, authjs.callback-url): strictly necessary to keep you signed in and protect forms.
  • Preference cookie (ferrow_sidebar_collapsed): remembers whether the sidebar is collapsed.
  • Local storage: remembers your light/dark theme choice in your browser.

We do not use advertising or third-party tracking cookies. Our page-view statistics work without cookies.

3. How we use your data

  • To sign you in and keep your account secure.
  • To publish, schedule, retry and show the status of your posts.
  • To refresh platform access so scheduled posts keep working.
  • To reply to messages you send us.
  • To prevent abuse and keep the service running.
  • To understand, in aggregate, which pages are used, so we can improve them.

We process this data to provide the service you asked for and, for security and spam prevention, in our legitimate interest in keeping Ferrow safe. Where the law requires consent, connecting a platform or sending a message is how you give it, and you can withdraw it at any time.

4. Who processes your data

We use these providers to run Ferrow. Each only receives what it needs for its job:

  • Vercel – hosts the website and app, and provides anonymous page-view statistics.
  • Neon – our database, hosted on AWS in Singapore.
  • Inngest – runs scheduled publishing and retries.
  • Resend – delivers contact-form messages to our inbox.
  • X and LinkedIn – receive the posts you publish to them, under their own privacy policies.
  • Anthropic (Claude) – only if you connect Ferrow to Claude. Claude can then read and manage your posts and connected accounts as you instruct it, and Anthropic’s privacy policy applies to what Claude processes.

These providers may process data outside India, including in Singapore and the United States. We do not sell or rent personal data to anyone.

5. How long we keep it

  • Account data and posts: until you delete them or ask us to delete your account.
  • Platform tokens: deleted immediately when you disconnect that platform.
  • Connected-app access: ends when you revoke it, or after 30 days without use.
  • Contact messages: up to 12 months, then deleted automatically.
  • Hosting logs: kept by our hosting provider for a short period under its own retention policy.

6. Security

All traffic uses HTTPS. Passwords are hashed with scrypt, and platform tokens are encrypted before they are stored. No system is perfectly secure, but we limit what we collect and who can access it. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

7. Your rights and choices

Depending on where you live, including under India’s Digital Personal Data Protection Act, 2023 and, where it applies, the EU or UK GDPR, you can ask to:

  • access a summary of the personal data we hold about you;
  • correct or update it;
  • delete it, or delete your account;
  • withdraw consent or object to processing;
  • nominate someone to exercise these rights for you.

You can disconnect X or LinkedIn at any time from the Accounts page in Ferrow, or by revoking access in that platform’s settings. To make any other request, email dev.papan101@gmail.com. We aim to respond within 30 days.

8. Grievance contact

For questions or complaints about how we handle your data, contact Papan Sarkar at dev.papan101@gmail.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India or your local data protection authority.

9. Children

Ferrow is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We will update the date at the top when this policy changes, and tell signed-in users about significant changes before they take effect.

11. Contact

Papan Sarkar, Kolkata, West Bengal, India. Email dev.papan101@gmail.com or use the contact form.