Privacy Policy

StickyHive ("we," "our," or "us") is a comprehensive community management and social media marketing platform that includes a Chrome extension for community management on platforms like Skool, Circle, and Mighty Networks, server-side integrations with the official APIs of Circle and Mighty Networks, as well as a web-based Social Planner for scheduling and publishing content to social media platforms including Instagram, Threads, Facebook, LinkedIn, and TikTok. This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you use our platform, services, and Chrome extension.

By installing and using StickyHive, you agree to the collection and use of information in accordance with this policy.

Coaching plugin privacy notice — updated October 5, 2026. Skool Coach By StickyHive provides community coaching and course references in ChatGPT and compatible hosts. This section describes the coaching plugin specifically. The extension and Social Planner descriptions below, including their authentication, data collection, processor, and retention details, describe those separate services rather than the coaching plugin.

Reference requests: The plugin does not require a StickyHive account or access your Skool account. Its reference tool accepts a course section, topic, and content version and returns coaching material. It has no parameters for chat messages, member records, passwords, or community authentication tokens, and it cannot publish posts or send messages. Content you share in ChatGPT or another host is handled by that host under its own privacy policy.

Operational data: We use technical access and error logs to operate, protect, and troubleshoot the reference service. Logs are retained for 30 days. We do not capture request bodies in these logs. The application records response status, request duration, and generic error events. Its rate limiter uses a hashed network address with a 120-second cache expiry; this short expiry does not apply to the separate access and error logs.

Service providers: The coaching service uses DigitalOcean for hosting, Cloudflare for traffic delivery and protection, and Sentry for error monitoring. These providers process operational data as part of delivering those services. The statements below that Sentry is disabled or that data is shared only with our backend do not apply to this coaching service.

Support and privacy requests: Contact [email protected] or use our support page for questions or requests concerning your data. For chat history held by ChatGPT or another host, use that host's privacy controls.

What We Collect:

• Platform Authentication Tokens: We capture session cookies, CSRF tokens, and authentication tokens from the community platforms you visit (Skool, Mighty Networks) to enable backend API access on your behalf
• Circle: We do not use or store Circle session cookies. Circle communities connect through Circle's official API with tokens you create and paste into StickyHive (see section 1.6). Versions of the extension released before this change may still send Circle session cookies to our servers; we reject them and do not store them.
• StickyHive Account: When you log in via our website (stickyhive.ai), we receive:
  • Access and refresh tokens (for authentication)
  • User ID (anonymous identifier)

To provide our community management features, we collect and process content from your designated community platforms:

• Post Content: Post titles, text content, post URLs, post IDs, timestamps, engagement metrics (like counts, comment counts)
• Comments & Messages: Comment text, reply threads, timestamps
• Author Information (Anonymized): Author names are automatically pseudonymized to "First Name + Last Initial" (e.g., "John D.") before being sent to our backend. We do NOT collect full names, email addresses, or other personally identifiable information about post authors
• Community Metadata: Community/group names, community IDs, space IDs, platform-specific identifiers

Network Monitoring & API Interception:

The extension monitors network activity ONLY within your designated community platforms to provide faster content loading and caching:

• API Requests: We intercept GET requests to platform APIs (Skool, Circle, Mighty Networks) to cache post and comment data locally in your browser
• HTTP Requests/Responses: Content of API responses is stored in browser sessionStorage
• URLs/Domains: API endpoint URLs accessed within community platforms
• Browser Storage: Session cookies and authentication tokens from community platforms

Click & Navigation Monitoring:

• Click Events: Document-wide click listener detects navigation within community platforms (used to update extension UI when you navigate between pages)
• Scroll Events: Passive scroll listener for viewport-based content loading optimization
• Page Navigation: URL changes within your community platform

• Extension Data: Extension version, installation ID
• Browser Data: Browser type, version, user agent
• Error Logs: Crash reports and debugging information (currently DISABLED for privacy - errors only logged to console)
• Local Storage: Cached posts, user preferences, draft content stored locally in your browser

When you connect social media accounts through our Social Planner or Comment-to-DM automation features, we collect and process the following data from Meta and other social platforms ("Platform Data"):

Instagram, Threads & Facebook:

• Account Information: Instagram/Threads/Facebook user ID, username, profile name, and profile picture URL
• Page Access Tokens: OAuth access tokens issued by Meta, used to publish content and manage interactions on your behalf
• Page Information: Facebook Page ID and Page name linked to your Instagram Business/Creator account
• Published Content Metadata: Post IDs, media IDs, permalinks, timestamps, like counts, and comment counts for content you publish or manage through our platform
• Comment Data: Comment text, commenter username, and comment IDs for posts where you have enabled keyword-triggered automation

How We Use Meta Platform Data:

• Content Publishing: Scheduling and publishing posts, images, videos (Reels), and carousels to Instagram and Threads on your behalf
• Comment Automation: Reading comments on your posts and sending private reply DMs when configured keyword triggers are matched
• Account Display: Showing your connected account information (username, profile picture) within the StickyHive dashboard
• Token Management: Securely storing and automatically refreshing access tokens to maintain your connection

When you connect a Circle community or a Mighty Network to StickyHive with API credentials you create in that platform, our servers retrieve data from the platform's official APIs on your behalf, to provide member management, moderation, scheduling, messaging and automation for that community:

• API Credentials: The API tokens or keys you paste into StickyHive (for Circle: an Admin API token and, optionally, a Headless API token for the inbox). They are stored encrypted on our servers and used only from our servers
• Member Profiles: Names, email addresses, profile URLs, headlines, member tags, answers to profile questions, join dates, last-seen dates, and activity and gamification statistics of the community's members
• Community Content: Spaces, posts, comments, like and comment counts, and reports members filed
• Direct Messages: If you connect the inbox, the direct messages of the admin you choose, and messages StickyHive sends on your behalf
• Membership and Billing Status: For Circle paywalls, each member's subscription plan, status, renewal, trial and cancellation dates, and amounts paid. We do not receive card numbers or other payment credentials
• API Usage: How many requests we make to the platform's API each month for your community

The following applies to the Chrome extension. Data from community platform APIs you connect is described in section 1.6.

We use the collected information EXCLUSIVELY to provide user-facing features:

• Review Dashboard: Display posts and comments from your community for management and review
• Post Actions: Enable Flag, Swipe File, and Digest buttons for organizing and categorizing content
• Quick Response: AI-powered comment drafting and response tools
• Shared Notes: Team collaboration features for community management
• Content Caching: Cache API responses locally for faster loading and offline access
• Navigation Detection: Update extension UI when you navigate between pages in your community
• Authentication: Maintain secure sessions with community platforms and StickyHive backend

We process your data based on:

• Consent: You explicitly consent by installing and using the extension
• Contract Performance: Processing is necessary to provide the services you requested
• Legitimate Interests: Improving our service, preventing fraud, ensuring security

StickyHive Backend API (stickyhive.ai)

• Data Transferred:
  • Authentication tokens from community platforms
  • Post and comment content (with anonymized author names)
  • Community metadata (IDs, names)
  • Screenshots (optional, when you use Swipe File/Digest features)
• Purpose: Store and process your community data, enable Review Dashboard, facilitate team collaboration, enable backend API access on your behalf
• Security: All transmissions use HTTPS encryption
• Justification: Transfer is necessary to provide the single purpose of the extension (community management tools)

Social Media Platform Data Processors

• Data Transferred:
  • Meta Platform Data (access tokens, user IDs, media content) passes through our infrastructure for the purpose of scheduling, publishing, and managing social media posts
• Infrastructure Providers: Our servers and storage are hosted on Amazon Web Services (AWS). AWS acts as a data processor and processes Platform Data only as necessary to provide hosting and storage services to us
• No Additional Processors: We do not share Meta Platform Data with any other third-party data processors, analytics providers, or advertising platforms

Error Tracking (DISABLED)

• Status: Error tracking via Sentry is currently DISABLED for privacy
• What This Means: Errors are only logged to your browser console, not sent to external services

• Sell your personal information to advertisers or data brokers
• Share your data with marketing companies
• Use your data for targeted advertising
• Provide your information to third parties for their own use

We may disclose your information if required by law, such as complying with court orders, subpoenas, or legal processes; protecting our rights, property, or safety; investigating fraud or security issues; or enforcing our Terms of Service.

Our policies and processes for handling government and law enforcement requests for user data:

• Legality Review: All requests from public authorities for personal data are reviewed for legal validity. We verify that each request complies with applicable laws, is issued by an authorized entity, and is properly scoped before any data is disclosed.
• Right to Challenge: We reserve the right to challenge any government request that we believe is overbroad, legally deficient, or otherwise unlawful. We will push back on requests that do not meet the applicable legal standard or that seek more data than is reasonably necessary.
• Data Minimization: When we are legally compelled to disclose data, we limit disclosure to the minimum information necessary to satisfy the specific legal obligation. We do not provide bulk or unrestricted access to user data.
• Documentation: We maintain records of all government data requests we receive, including the requesting authority, the legal basis cited, the scope of data requested, our response, and the legal reasoning behind our decision to comply or challenge the request.

• Local Storage: Post cache, user preferences, and draft content are stored locally in your browser using Chrome's storage API
• Session Storage: Temporary session data that expires when you close your browser
• Backend Servers: User account data, authentication tokens, and community data are stored on our secure servers

We implement industry-standard security practices:

• Encryption: All data transmitted between the extension and our servers uses HTTPS/TLS encryption
• Token Security: OAuth tokens are stored securely using Chrome's encrypted storage
• Access Controls: Strict access controls limit who can access user data on our backend
• Regular Audits: We regularly review our security practices and update them as needed
• Secure Authentication: OAuth 2.0 with Google for secure user authentication

• Authentication Tokens: Stored until you log out or revoke access
• Cached Posts: Stored locally indefinitely until you clear browser data or uninstall the extension
• Account Data: Retained as long as your account is active
• Social Media Platform Data: Meta access tokens are stored for the duration of their validity (up to 60 days) and refreshed automatically. When you disconnect a social account, all associated tokens and platform-specific data are deleted immediately. Scheduled post content and publishing history are retained as long as your account is active.
• Community Platform API Data: Circle and Mighty Networks credentials are stored until you disconnect the community or delete it in StickyHive. Member, content and message data synced from these APIs is retained as long as the community is in your account.

When you disconnect a social media account or delete your StickyHive account:

• All stored access tokens for that platform are permanently deleted from our servers
• Platform-specific metadata (user IDs, usernames, page information) is removed
• Scheduled posts that have not yet been published are cancelled
• Historical publishing records may be retained in anonymized form for analytics purposes

You can request complete deletion of all your data by contacting us at [email protected].

You have the right to:

• Access Your Data: Request a copy of all personal data we hold about you
• Correct Your Data: Update or correct inaccurate information
• Delete Your Data: Request deletion of your account and associated data
• Export Your Data: Download your data in a portable format
• Withdraw Consent: Uninstall the extension at any time to stop data collection

You can manage cookies through:

• Chrome browser settings → Privacy and Security → Cookies
• Clearing site data for stickyhive.ai domain
• Using Chrome's incognito mode (note: the extension may have limited functionality)

StickyHive Chrome Extension requests the following permissions:

StickyHive is not intended for use by individuals under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately, and we will delete it.

If you are located outside the United States, please note that:

• Your data may be transferred to and processed in countries with different privacy laws
• We ensure appropriate safeguards are in place for international transfers
• For EU users, we comply with GDPR requirements for international data transfers

We may update this Privacy Policy periodically to reflect changes in our practices, legal or regulatory updates, or new features.

When we make significant changes:

• We will update the "Last Updated" date at the top
• We will notify you via email (if you've provided one)
• We will display a notice in the extension
• You will be prompted to review and accept the new policy

Your continued use of the extension after changes constitutes acceptance of the updated policy.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights:

Your Legal Rights Include:

• Right to Access: Obtain confirmation of data processing and access to your data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with your local supervisory authority

Data Protection Authority: If you believe we have not addressed your concerns, you may contact your local data protection authority. For a list of EU data protection authorities, visit: https://edpb.europa.eu/about-edpb/board/members_en

If you are a California resident, you have additional rights:

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell your data)
• Right to Non-Discrimination: Equal service regardless of exercising your privacy rights

To exercise these rights, contact us at [email protected]

By using StickyHive, you acknowledge that you have read and understood this Privacy Policy.