Security and control
OAuth instead of API keys, tokens encrypted at rest and never sent to the assistant, a preview before anything goes public, an audit log of every call, delete everything any time.
Summary
What Pushwing stores
| Data | Where | How long | Delete |
|---|---|---|---|
| Account id, name, handle, avatar | Postgres | While connected; refreshed daily | Disconnect |
| Google / Instagram tokens | Postgres, AES-256-GCM | While connected | Disconnect (revokes at Google) |
| Publish jobs | Postgres | Until account deletion | Delete account |
| Activity log, secrets stripped | Postgres | Until account deletion | Delete account |
| Media you upload | Temporary storage | 24 hours | Automatic |
| Video lists, stats, comments, insights | Not stored | — | — |
How tokens are protected
Provider tokens are encrypted at rest with AES-256-GCM under a key held only by the server. No tool returns a token, the dashboard never displays one, and refresh happens server-side. Disconnecting a YouTube channel revokes the token at Google; removing Pushwing in Instagram triggers Meta's deletion callback.
How your AI client authenticates
Over OAuth 2.1 through Clerk with PKCE and dynamic client registration, or with a pw_ API key stored as a hash. Each credential appears in the activity log by name. Revoke keys on the dashboard's API keys page; revoke OAuth clients from your account's connected apps.
What needs your approval
Public uploads, privacy changes to unlisted or public, every Instagram publish and every comment reply return this envelope and do nothing until the tool is called again with confirm=true. Private YouTube uploads don't need it because nobody can see them.
{ "requires_confirmation": true, "action": "youtube_reply_comment",
"summary": "Reply to @maria_dev on 'Episode 11': …",
"hint": "Nothing was done. Show this summary to the user; if they approve, call the same tool again with confirm=true." }What we refuse to do
No engagement automation; replies are single and user-initiated, 10 per hour per account. No cross-account scraping. No selling data, no advertising, no training models on it, no humans reading it outside a support request you open. One Google Cloud project, never multiplied to dodge quota.
Platform compliance
Pushwing uses YouTube API Services under the API Services Terms and is undergoing the compliance audit; it uses the Instagram Platform under Meta's Platform Terms and is in App Review; use of Google user data follows the Limited Use requirements.
Reporting a problem
Email security@pushwing.com. We acknowledge within two business days.