Privacy Policy

77os is operated by Jared McAdam in Santa Monica, California, United States, under the software brand 77systems. This document does not claim that 77systems is a registered LLC, corporation, or other legal entity, and it does not invent a tax identification number.

This policy covers (a) the public website at 77systems.ai, (b) the 77os OAuth and API connector, and (c) related support and deletion requests. It does not replace the privacy notices of Pinterest, TikTok, X, Facebook, Instagram, or any other platform you authorize.

77 Bark Ave OS (and later stamped OS tenants) is the business system that initiates connections, holds approval workflows, and displays evidence. 77os is the connector that performs OAuth, stores tokens for that connection, calls platform APIs, and returns publishing results. Personal data may therefore exist in both the OS tenant record and the connector record. A deletion request is treated as a request against both, as described on the data deletion page.

Depending on how 77os is used, we may process:

• Operator identifiers — name or handle used inside the OS, role, tenant id, and work email if supplied.
• OAuth credentials — authorization codes (transient), access tokens, refresh tokens, token expiry, granted scopes, and connection status.
• Social account metadata — platform user id, username or handle, account type (for example business vs creator where the API provides it), and avatar URL if returned by the platform.
• Publishing payloads and results — captions, media references or hashes, destination (board, account), timestamps, platform post ids, and success or error responses.
• Approval and evidence records — who approved the work, when, and the connector’s record of what was sent.
• Support data — the content of emails you send to our contact addresses, and our replies.
• Technical data — IP address, user agent, request time, and coarse diagnostic logs for security and reliability.

We do not intend to collect government ID numbers, payment card numbers, precise geolocation, or the contents of social Direct Messages. 77os does not request DM or inbox scopes.

Data comes from:

• Operators and tenant administrators using 77 Bark Ave OS
• You, when you complete a platform consent screen or email us
• Pinterest, TikTok, X, Facebook, and Instagram, only after you authorize the relevant app and only within granted scopes
• This website’s hosting logs, at a technical level

We process data to:

• Establish and maintain an authorized social connection
• Publish or manage content the operator has approved in the OS
• Record evidence of what was connected, approved, sent, and returned
• Respond to support, privacy, and deletion requests
• Secure the service, debug failures, and prevent abuse
• Comply with law and platform developer terms

We do not sell personal information. We do not use connected social data to train general-purpose AI models, to build advertising audiences for third parties, or to contact a user’s followers.

Where a legal-basis analysis is required (including if we process data of people in the EEA, UK, or similar jurisdictions), we rely on the following at a high level:

• Contract — providing the connector an operator asked us to run, including token storage and publishing.
• Consent — OAuth authorization granted on Pinterest, TikTok, X, Facebook, or Instagram, which can be withdrawn by disconnecting the app on that platform and by requesting deletion from us.
• Legitimate interests — securing the service, keeping a limited evidence trail, and responding to abuse, balanced against the rights of the people involved.
• Legal obligation — retaining a narrow set of records when law or a lawful request requires it.

For California residents, we describe corresponding rights in the CPRA section below. We do not treat 77os as a “sale” or “sharing” of personal information for cross-context behavioral advertising.

Tokens are the most sensitive artifact 77os holds. They are treated as secrets.

• Storage. Access and refresh tokens are stored only in the connector’s secret store for that tenant connection. They are not placed in source control, client-side storage, or marketing tools. Application logs are designed to exclude plaintext tokens.
• Access. Only systems that perform token refresh, API calls, connection status, or deletion are intended to read them. Human access is exceptional and logged.
• Rotation. Refresh follows each platform’s token lifetime. When a platform issues a replacement refresh token, the previous value is discarded. Expired access tokens are replaced rather than reused.
• Revocation. Tokens are revoked or discarded when an operator disconnects the account in the OS, when the user revokes the app in Pinterest, TikTok, X, Facebook, or Instagram, when a deletion request is completed, or when we suspend a connection for security or policy reasons.

Revoking the app on the platform is the fastest way to stop new API calls. You should still email us so we can delete our stored copy.

After OAuth, platforms return a small identity packet so we can label the connection. We keep that packet so operators can see which account is connected and so we can route deletion correctly. We do not use it to graph your followers, recommend content, or resell audience data.

Pinterest’s developer guidelines restrict storing certain API information except as needed to provide the service (and, where applicable, campaign analytics the account holder authorized). We design 77os to store only what the connector and evidence workflow require, and to refresh live state from the API when a fresh read is the correct approach.

When content is published, 77os may retain the payload or a reference to it, the acting operator, timestamps, and the platform’s response. That record exists so 77 Bark Ave OS can show that approved work was actually sent.

If the platform deletes or materially changes content, or if X or another platform requires stored copies to be updated or removed (including on short timelines such as 24 hours after a removal request), we will update or delete our stored copy as required by that platform’s developer terms and applicable law.

Emails sent to support@77systems.ai, privacy@77systems.ai, legal@77systems.ai, security@77systems.ai, or founder@77systems.ai are read by people operating 77systems and 77os. We keep them long enough to resolve the request and to maintain a record of privacy and security correspondence.

Hosting and application logs may include IP addresses, user agents, request paths, and error codes. They are used for security, uptime, and debugging. Logs are not a substitute for the evidence record and are not used to profile individuals for advertising.

The public 77systems site is a static informational site. It does not require an account and does not set advertising cookies. The host may emit standard server logs and, if we later add a privacy-respecting analytics tool, we will update this section before it collects anything beyond logs. There is no cookie banner because we are not running a marketing pixel on these pages.

• Active connections — tokens and account metadata are kept while the connection is authorized.
• After disconnect or deletion request — tokens and the social connection record are deleted within 30 days, usually sooner. See data deletion.
• Evidence records — kept for the life of the tenant workflow unless the operator or account holder requests deletion, or a platform rule requires earlier removal.
• Support mail — typically up to 24 months, unless a longer period is needed for a legal or security matter.
• Security logs — typically 90 days, unless an incident requires a longer hold.

We may retain a minimal stub (for example, that a deletion was completed on a given date) so we can show we honored the request.

We share data only as needed to operate 77os:

• Platform APIs — Pinterest, TikTok, X, Facebook, and Instagram receive the content and credentials their APIs require when you have authorized the app.
• Infrastructure providers — hosting, DNS, and email delivery vendors process data under contract as subprocessors. This public site is designed to deploy on Vercel. We do not list every vendor here as a marketing claim; the set is small and operational.
• Advisors and process servers — if required to respond to a lawful request, or with counsel when handling a dispute.
• Successor operator — if the product is transferred, notice will be given where required and this policy will be updated.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

77os is operated from the United States. If you authorize a connection or write to us from another country, your information will be processed in the United States and may pass through the infrastructure regions of our host and the social platforms you use. Those platforms have their own transfer mechanisms.

Where a transfer safeguard is required for our own processing, we rely on the necessity of the contract you (or the tenant operator) asked us to perform, and on standard contractual clauses or an equivalent remedy with subprocessors when they are in place.

Controls are designed for a small operator environment. They are not a certification. In particular:

• TLS for 77os traffic and platform API calls
• Least-privilege OAuth scopes
• Secret storage and log hygiene for tokens
• Access limited to people operating the product
• Disconnect and deletion paths that revoke or discard credentials

No method of transmission or storage is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and, where required, regulators, in the manner and time law requires.

Security reports: security@77systems.ai, privacy@77systems.ai, and legal@77systems.ai.

77os is a business connector. It is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided data to 77os, write to privacy@77systems.ai and we will delete it.

Subject to applicable law, you may request access, correction, deletion, a portable copy of data we hold about you, and restriction or objection where those rights exist. You may also withdraw OAuth consent by revoking the app on Pinterest, TikTok, X, Facebook, or Instagram.

We will not discriminate against you for exercising privacy rights. We may need to verify the request (for example, that you control the email or the social account at issue) before we act.

If you are a California resident, you may request: (1) to know the categories and specific pieces of personal information we collected, the categories of sources, the purposes, and the categories of third parties with whom we disclose it; (2) deletion; (3) correction of inaccurate personal information; and (4) to opt out of sale or sharing, which we do not perform. We do not use or disclose sensitive personal information for purposes that require a separate CPRA limit-use right, because we do not collect government ID, financial account credentials, or precise geolocation through 77os.

You may use an authorized agent. We will take reasonable steps to verify the agent and your identity. You may also contact the California Privacy Protection Agency or the California Attorney General if you have a complaint.

Shine the Light: 77os does not disclose personal information to third parties for their own direct marketing.

Email privacy@77systems.ai (copy support@77systems.ai if the request includes a live connection). Use the subject line “77os privacy request” and include:

• Your name and a contact email
• The platform (Pinterest, TikTok, X, Facebook, and/or Instagram)
• The handle or account id, if you know it
• The tenant or business name, if you are an operator
• Whether you want access, correction, or deletion

We aim to acknowledge requests within two business days and to complete deletion within 30 days. Access and correction follow the same mailbox. Details of the deletion path are on the data deletion page.

If we change this policy in a material way, we will update the effective date at the top of this page and, for operators with an active connection, provide additional notice when the change is significant. Continued use of 77os after the effective date constitutes notice of the revised policy. The current version always lives at https://www.77systems.ai/privacy.

Privacy: privacy@77systems.ai

Support: support@77systems.ai

Legal: legal@77systems.ai

Security: security@77systems.ai

Operator: Jared McAdam, Santa Monica, California, United States.