Privacy

Privacy policy

Transmit is a private publishing tool used by one small team. This page explains what it stores, what it asks Google and Facebook for, and how to have any of it deleted.

Last updated 9 September 2026. Applies to Transmit at medianovix.site.

What Transmit is

Transmit is a self-hosted tool that one small team uses to schedule and publish its own short videos to its own Facebook Pages and YouTube channels. There is no public sign-up. Accounts exist only because an administrator created them, and the team it serves is capped at ten people.

It is operated by Transmit on Transmit's own server. It is not a service offered to anybody else, and nothing in it is shared with another company.

What it stores about a person

Only what an account needs in order to exist and be accountable for what it published:

• Account details — username, full name, email address, and the role (admin or member) an administrator assigned.
• A password hash, never the password. The stored value cannot be turned back into the password that produced it, which is also why a forgotten password has to be reset by an administrator rather than looked up.
• Sign-in records — for each active session, the IP address it was created from and the browser's user-agent string, so an account holder can see their own sessions and end one they do not recognise. A session ends by itself after 15 minutes of no activity.
• An activity log — who uploaded, scheduled, published, edited or deleted what, and when, with the IP address of the request. This is the record that answers "who posted that", and it is kept deliberately.
• Messages written in the team's internal chat, with any files attached to them.

There is no analytics script, no advertising pixel, and no third-party tracker on any page of this install. Nothing about a visitor to this policy page is recorded beyond the web server's ordinary access log.

What it stores of the team's content

The videos, images, captions, hashtags and scheduling times the team enters, plus the four public engagement counts each published post reports back — views, reactions, shares and comments. Those are whole-post totals. Transmit does not request, receive or store anything about the individual people who watched or reacted to a post.

Google data, and exactly which of it

When an administrator connects Google Drive or YouTube, Google shows a consent screen listing what is being asked for. Transmit asks for the narrowest scopes that let it do its job:

• drive.file — only the files Transmit itself creates. This scope gives no visibility of anything else in the Drive account. Existing documents, photos and folders are not readable, not listable, and not modifiable. Transmit creates one folder, uploads the team's video files into it, reads its own files back when it is time to publish, and deletes its own files when asked to.
• youtube.upload — to publish a video to the connected channel.
• youtube.readonly — to read back the public view count of a video it published.

Google Drive is used as the team's content library. A file uploaded through Transmit is stored in Drive and fetched from Drive at publishing time. When Drive is unreachable the file is kept on the server instead, with a warning shown, and is moved to Drive and removed from the server once it has published.

Connecting an account gives Transmit a refresh token from Google. It is encrypted with AES-256-GCM before it is written down, it is never displayed on any screen in the app, there is no button anywhere that reveals it, and it is redacted out of log output. The same is true of the Google client secret and of every Facebook Page access token.

Transmit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: Google data reaches this install for the sole purpose of publishing the team's own posts and reading back their public counts. It is not sold, not transferred to anybody, not used for advertising, not used to build a profile of anyone, not read by a human at Transmit outside of fixing a fault the team has reported, and not used to train any machine-learning model.

Facebook data

For each connected Page, Transmit holds a Page access token — encrypted the same way — and uses it to publish posts to that Page and to read that Page's own post counts. It does not read the Page's inbox, its followers, or anything about the people who interact with a post.

Who can see what

Only the people with an account on this install, and among them only what their role allows: an administrator can see every post, every account and the full activity log, while a member sees the team's posts and their own account. API keys and tokens are visible to nobody at all — not even to an administrator, who sees only a masked hint confirming that a key is saved.

How long it is kept, and how to have it removed

Content and its publishing history are kept for as long as the team wants them, and can be deleted from within the app at any time. Deleting a post removes it from Transmit; it does not remove anything already published to Facebook or YouTube, which has to be deleted on the platform itself.

A Google or Facebook connection can be disconnected from the Settings screen, which deletes the stored token from this install immediately. Access can also be withdrawn from Google's side at any time, without asking anyone here, at myaccount.google.com/permissions — the connection simply stops working from that moment.

To have an account and everything attributable to it deleted, ask an administrator, or write to the address below. An account holder can also ask for a copy of what is held about them.

How it is protected

Traffic to medianovix.site is encrypted in transit. Every secret is encrypted at rest with AES-256-GCM under a master key that lives only in a file readable by the service account, and never in a place a process listing or a service manager would print. Passwords are hashed. Sign-in attempts are rate-limited and an account locks after repeated failures. Sessions end after 15 idle minutes so an unattended browser does not stay signed in. Backups are encrypted with the same key as the data they contain.

Changes

If this policy changes, the date at the top of the page changes with it. Because the team is ten people who all know each other, a material change is told to them directly rather than announced by banner.

Getting in touch

Questions about this policy, or a request to see or delete what is held about you, should go to Transmit through the channel the team already uses.