Trust and security

Approved by the platforms, no passwords stored

The three questions people ask before connecting their accounts, answered with facts you can check.

Will platforms block a tool like this?

Platforms block tools that scrape, drive a browser or log in with your password. ShortSync does none of that. It posts through the official publishing APIs that platforms built for scheduling tools, and its apps have passed each platform's own review.

You can check this yourself: when you connect an account, the platform's own consent screen shows ShortSync by name and lists exactly what it is allowed to do.

  • Instagram, Facebook, Threads

    Official Meta Graph and Threads APIs

    Passed Meta App Review for publishing, insights, comments and messages

  • TikTok

    Official Content Posting API

    Passed TikTok's Content Posting API audit, so posts can go out public

  • YouTube

    Official YouTube Data API

    Passed Google's OAuth app verification

  • LinkedIn

    Official LinkedIn API for profiles and Company Pages

    Approved by LinkedIn for posting to profiles and Pages

  • Pinterest

    Official Pinterest API

    Approved by Pinterest for API access

  • X (Twitter)

    Official X API

    Paid official API access, no scraping

  • Snapchat, Reddit, Google Business Profile

    Through bundle.social, an approved API partner

    Partner holds the platform approvals; you still sign in on the platform's own page

  • Bluesky, Mastodon, Pixelfed, Tumblr, Telegram, Discord

    Each platform's official open API

    Open APIs with no review process; connected with OAuth, an app password or a bot/webhook you create

Are my passwords stored?

No. ShortSync never sees your passwords. Each account is connected with OAuth: you sign in on the platform's own site, and the platform hands ShortSync a limited access token that can only do what the consent screen listed.

  • Access tokens are encrypted at rest with AES-256-GCM.
  • Your database and files are stored in the EU (AWS Stockholm), and the app runs on EU servers with daily backups.
  • You can disconnect an account in ShortSync, or revoke access from the platform's own security settings, at any time.
  • Deleting your ShortSync account revokes your platform tokens and deletes your files and personal data. See the privacy policy.

What if a small company stops?

ShortSync is a small, independent company, and we would rather say so than hide it. Here is what that means for you:

  • Your posts stay put. Everything ShortSync publishes lives on your own accounts. Nothing published disappears if ShortSync does.
  • 90 days' notice. If ShortSync ever closes, every user gets an email at least 90 days in advance, with time to download files from the library and move scheduled posts elsewhere.
  • No lock-in. Plans are monthly or yearly, you can cancel anytime, and there is nothing to migrate: other tools connect to the same accounts the same way.
  • Used every day. More than 10,000 creators have published with ShortSync since 2025.

Who runs ShortSync

Night Tech Oy

Business ID (Y-tunnus): 3617980-7

Pohjoinen Rautatiekatu 29 A 317

00100 Helsinki, Finland

[email protected]

Trust FAQ

Yes. ShortSync posts through each platform's official API and has passed the platforms' own app reviews: Meta App Review for Instagram, Facebook and Threads, TikTok's Content Posting API audit, Google's OAuth verification for YouTube, and LinkedIn's and Pinterest's API approvals. Snapchat, Reddit and Google Business Profile go through bundle.social, an approved API partner. You sign in on each platform's own page, ShortSync never sees your passwords, and access tokens are encrypted with AES-256-GCM. The company behind it is Night Tech Oy, registered in Helsinki, Finland. See shortsync.app/trust for the details.
No. ShortSync never sees or stores your passwords. You connect each account with OAuth: you sign in on the platform's own site (Instagram, TikTok, Google and so on), and the platform gives ShortSync a limited access token for posting. Those tokens are encrypted at rest with AES-256-GCM. You can revoke ShortSync's access at any time from ShortSync or from the platform's own security settings.
No. Platforms restrict tools that scrape, automate a browser or log in with your password. ShortSync does none of that. It uses the official publishing APIs that the platforms built for scheduling tools, and its apps have passed each platform's review (Meta, TikTok, Google, LinkedIn, Pinterest). When you connect an account, the platform's own consent screen shows ShortSync by name and lists exactly what it can do. Posts made through ShortSync are the same as posts made in the app.
Your posts stay where they are. Everything ShortSync publishes lives on your own Instagram, TikTok, YouTube and other accounts, so nothing published disappears. If ShortSync ever closes, we will tell every user by email at least 90 days in advance, so you have time to download your files from the library and move your schedule to another tool. There are no long contracts: plans are monthly or yearly and you can cancel anytime.
ShortSync is built by Hilma Kokkoniemi and run by Night Tech Oy, a company registered in Helsinki, Finland (business ID 3617980-7). It is a small, independent company, and more than 10,000 creators have published with ShortSync since 2025.