Privacy policy

Cojani Labs, based in Nairobi, Kenya, operates Clockpost and is the controller of the personal information collected through this website. This policy covers useclockpost.com, sign ups, accounts, referral links and the interactive product examples. Contact [email protected] about your information or privacy choices.

What we collect and why

• Sign ups: your email address, the page where you signed up, and the time. If present in the link you followed, we also store campaign tags (such as utm_source), the name of the website that referred you (not the full address) and any referral code. We use these to set up your account, contact you about it and understand which pages and campaigns bring sign ups. We don’t send you unrelated marketing.
• Accounts: when you create an account we store your email address, the time you confirmed it, and your password as a salted hash that cannot be turned back into the password. We email you a 6 digit code to confirm your address, and a link if you ask to reset your password; both are stored only as hashes and expire. To keep you signed in we store a record of each session. If you choose Continue with Google, Google tells us your email address and an identifier for your Google account so we can sign you in; we don’t receive your Google password or anything else from your Google account.
• Optional sign up answers: what you do, where most of your customers find you and your country, if you choose to answer. We use them to set up Clockpost for the way you work and to decide which features and platforms to improve first.
• Referral links: everyone who signs up gets a personal link. When someone joins through it, we record that your code referred them, so we can see which invitations brought sign ups.
• Funnel measurement without cookies: when you use certain parts of the site, such as the product demo or the sign up steps, your browser sends us the event name and the page path. We store only those and the date. No cookies, device identifiers, email addresses or typed text are included.
• Security and delivery: Cloudflare processes network and browser information needed to deliver the website and prevent abuse. To limit repeated submissions and password guessing we store a temporary hash derived from your IP address or email address and a short time window. We don’t store your raw IP address.
• Optional analytics: if you allow it, Cloudflare Web Analytics measures page visits, referring sites, browser and device categories, and page performance. It doesn’t use advertising cookies or persistent visitor identifiers.
• Results of the accounts you connect: when you connect a social account we read the words, pictures and numbers of its past posts, including those you made directly on the platform, and its follower counts, so we can show your results. Ticky reads each post’s words once to say what kind of post it is. Who follows an account is read only when you ask, as totals and never as named people, and kept for a few hours.
• Messages: the details you include when you email us, so we can answer.
• People who write to a business on Clockpost: when someone comments on a post or sends a message to an account connected to Clockpost, we keep a copy of their profile picture so the inbox can show who wrote. We keep it while they keep writing and for up to 90 days after the last thing they sent, and we delete it with their conversations.

People you send to

If you use Clockpost for clients, you can name people outside your workspace, such as a client who approves posts or receives a report. We keep each person’s name and email address for the brand you named them on, and use them only to send what you asked us to send: a link, one reminder, or a report each month. You can remove someone at any time, and they can stop a monthly report from its own page. Under Agency, you are responsible for having their agreement to be contacted. Someone who approves a post gives a name, which we keep with their answer.

AI assistants you connect

You can connect an AI assistant of your choice to a workspace, such as Claude or ChatGPT. It only happens if a person who runs the workspace agrees on the sign-in screen, and they choose what it may read and do. Once connected, what you ask it for reaches that assistant: your posts, what Clockpost knows about your brand, and the comments and direct messages people send to your connected accounts, with their names. That assistant’s provider then handles it under its own terms and privacy policy, which are between you and them, so choose one you are content to share this with.

Clockpost keeps a record of which assistant was used, when, and how each call ended, with no copy of what was sent, and it keeps what an assistant saves, such as a draft, like anything you save yourself. You can see what is connected and switch it off at any time in Settings, AI assistants.

Legal bases

We process sign up and account details to give you the account you ask for and to take the steps you ask for before you use Clockpost. Referral records, funnel measurement, website security and administration rely on our legitimate interest in running and improving a reliable service, balanced against your rights; the data involved is minimal and never used for advertising. Optional analytics relies on your consent. We may also process information to meet a legal obligation.

Cookies and your choices

Optional analytics is off until you select Allow analytics. Choose Essential only to use the whole website, including signing up, without it.

A first party cookie called clockpost_privacy remembers your choice for up to 180 days. It contains a preference value, not an advertising or visitor ID. We don’t set advertising cookies. Funnel measurement doesn’t use cookies or other storage on your device.

When you log in, a second first party cookie called __Host-clockpost_session keeps you signed in for up to 30 days. The account cannot work without it. It holds a random value and no personal details, cannot be read by scripts on the page, and is removed when you log out.

Use Cookie settings in the footer to change your choice at any time. Turning analytics off reloads the page to stop the measurement script.

Interactive product examples

Sample posts, comments and replies stay in your browser and reset when you reload. They don’t connect to social accounts, send messages or use an AI provider. Please don’t enter confidential information.

Who handles the information

Authorised members of Cojani Labs handle sign ups and messages. Cloudflare provides hosting, security, the database used for sign ups, accounts and events, the service that sends account emails, and optional Web Analytics. Our email provider processes correspondence. We don’t sell personal information. We may disclose information when legally required or to protect rights and investigate abuse.

Our providers may process information outside your country, including outside the UK and European Economic Area. Where UK or EU data protection law applies, we rely on appropriate safeguards such as the providers’ standard contractual clauses.

How long we keep information

We keep sign up details until you ask us to remove them, until you open a Clockpost account (when the account terms take over), or for up to two years after the website stops accepting sign ups. We keep account details until you ask us to delete the account. A session ends after 30 days or when you log out, a code expires after 10 minutes and a reset link after 30 minutes. Funnel events are kept without identifiers, in a form suited to aggregate reporting. Rate limit records expire within two hours. The preference cookie expires after 180 days.

Your rights

You can ask to access, correct or delete your information, object to or restrict processing, receive a copy in a portable format, or withdraw consent for optional analytics. Email [email protected], ideally from the address you signed up with. We may ask for proportionate information to confirm a request is yours, and we respond within one month. See also how to delete your data.

You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU and EEA, the supervisory authority where you live or work; in Kenya, the Office of the Data Protection Commissioner.

Changes

We’ll update this page when our practices change and show the new date above. Connected social accounts and paid plans come with their own privacy information, which you see before you decide to use them.