Your information, handled with care.

Scope and operator

This policy applies to www.markish.tech, related Markish marketing pages and early-access forms, the application at app.markish.tech, and Markish integrations, including its Model Context Protocol (MCP) service where enabled. It does not govern information a social platform or an external AI client collects under its own terms.

“Markish,” “we,” “us,” and “our” refer to Markish. For privacy questions or requests, contact the Markish team at privacy@markish.tech. If an organization provides workspace information and determines how it is used, that organization may be responsible for its instructions and should also be contacted.

Information handled

The information depends on the feature you or your organization uses. It can include:

• Waitlist and support details: information submitted through an early-access form, such as name, email, organization or studio, phone number, work type, and the content of a support request.
• Account and workspace information: account name and email, authentication and session records, workspace membership and roles, Brand details, team assignments, and preferences.
• Content and collaboration: drafts, captions, media, comments, tags, approvals, assignments, schedules, and other material users create, upload, or manage in a workspace.
• Social-platform information: account identifiers, profile or Page details, permissions and scopes, content status, comments or messages where a feature is authorized, and reporting data returned by the platform.
• Technical and operational data: security events, request and service diagnostics, bounded error categories, timestamps, and technical information needed to operate and protect the service. Some infrastructure logs may include network or device details; they are handled for operational and security purposes.

Connected social accounts

When you authorize a social connection, Markish uses the applicable platform API for the scopes and features presented in that connection flow. Depending on the platform and feature, this may support account setup, content preparation, scheduling or publishing at your instruction, comment or message workflows, and reporting. Available permissions, data, and actions vary by platform, account type, review status, and platform rules.

Markish stores connection credentials needed to provide an authorized feature and applies application safeguards to those credentials. We do not ask for your social-platform password. You can disconnect a connection in Markish when that control is available or revoke it with the platform. Revocation prevents subsequent access when recognized; it does not itself remove information already stored in Markish or information held by the platform.

How information is used

• Provide accounts, workspaces, Brand collaboration, content preparation, review, scheduling, publishing, and reporting features.
• Carry out actions requested by an authorized user, including sending content or related data to a connected social platform.
• Authenticate users, maintain sessions, protect accounts, and detect abuse or technical problems.
• Respond to support requests and send service or early-access communications.
• Understand product use through limited analytics where enabled and permitted by applicable law; users can turn it off in their account settings.
• Meet legal obligations and establish, exercise, or defend legal claims.

Markish does not sell personal information. It does not use connected-platform information for targeted advertising.

Operational diagnostics and product analytics

Operational diagnostics help us operate, secure, and troubleshoot Markish. The application and infrastructure may produce logs, metrics, and traces, including request counts and durations, service health, bounded error or outcome categories, and MCP tool or authorization event categories. Grafana Cloud may receive observability telemetry when this monitoring integration is enabled. Telemetry is limited to metric and trace attributes needed for monitoring; some MCP exception paths also record technical error messages, whose contents depend on the error. Operational diagnostics are separate from optional product analytics and are not controlled by the product analytics preference.

We do not use third-party advertising pixels on the public marketing website. When marketing analytics is activated, the website uses the PostHog JavaScript SDK and Markish's US PostHog Cloud project to collect limited, anonymous events. These events describe a broad page category, when the pricing section is viewed, and clicks on existing sign-up, plan, and contact links. The site may include only bounded, allowlisted utm_source, utm_medium, and utm_campaign values for acquisition attribution. It does not send raw page URLs, arbitrary query parameters, form contents, contact inquiry contents, names, email addresses, phone numbers, account or workspace identifiers, or access tokens. Automatic click and form capture, automatic pageview collection, session recording, person profiles, and persistent PostHog browser storage are disabled. The SDK uses an anonymous identifier held only in memory while the page is open; Markish does not identify visitors or connect marketing events to application accounts.

Marketing analytics is off unless the production deployment has been explicitly approved and configured. Where the applicable legal basis permits the opt-out model, limited analytics is on by default without a banner. Use “Turn off optional analytics” in the website footer to disable it; the change stops subsequent events immediately. A marketing-site preference is saved in browser storage and applies to this browser on www.markish.tech. It is separate from preferences on app.markish.tech and is not shared across those hosts. If browser storage is unavailable, marketing analytics stays off. Where applicable law requires affirmative consent, analytics remains off until you provide that consent and an approved consent flow is in place.

The Markish application separately uses PostHog for product analytics when that feature is enabled. Where the applicable legal basis permits the opt-out model, limited analytics is on by default without a banner. You can turn it off in Profile menu → Analytics preferences; the change takes effect immediately for later events and resets the browser's anonymous application analytics identifier, though an event already sent cannot be recalled. Where applicable law requires affirmative consent, analytics remains off until you provide that consent.

When enabled, the application sends a small allowlisted set of feature events and coarse properties such as feature area, workflow type, bounded platform category, success or failure category, environment, and validated application version. It does not intentionally send post text, captions, media, account tokens, user or workspace identifiers, private Brand identifiers, raw routes or query strings, error messages or stack traces. Automatic event capture, automatic URL/page collection, session replay, profiles, and persistent PostHog browser storage are disabled. PostHog is a third-party provider and receives events for this feature.

The application preference is stored separately in its browser context and shared across accounts in that browser; it is not an account-wide or cross-device setting. A previously stored “denied” choice remains off, while a prior “granted” choice remains on. Missing or legacy “unknown” values follow the opt-out default only when analytics is enabled and legally permitted. If neither local storage nor the preference cookie can be read, analytics stays off. If the browser cannot save a preference, the current page honors the choice but persistence across reloads cannot be guaranteed when all browser storage is blocked.

Cookies and similar technologies

The application uses cookies to maintain authentication sessions and related security controls. Certain website-analysis flows also use temporary browser cookies to protect access to an analysis result. The application analytics preference is stored in browser local storage and a first-party preference cookie fallback, so it can be read across sign-out and account changes in the same browser. The marketing-site preference is a separate namespaced value in that website's local storage. These values record only a preference and are not analytics identifiers. PostHog browser persistence is disabled. The public marketing website does not use third-party advertising scripts or advertising cookies. Blocking cookies may prevent sign-in or some requested features from working.

AI features and MCP integrations

Some Markish features send user-provided prompts, selected workspace context, or requested content to third-party model providers to return generated text, ideas, or analysis. The specific provider and model can vary by feature. Outputs may be inaccurate or incomplete and should be reviewed by a person. Each provider's terms and settings govern its handling of information submitted to it, which may include retention or use to improve its services. Review the applicable provider information before submitting information through an AI feature.

Where MCP access is available, an external AI client can request OAuth authorization for a named client and specific Markish scopes. The user sees the requesting client and requested permissions and chooses whether to authorize. Read scopes can expose authorized workspace, Brand, idea, post, calendar, analytics, social-account status, or media information. Write scopes can allow eligible idea and post edits, media uploads, workflow actions, and scheduling changes. Current Markish role, workspace and Brand access, granted scopes, and feature entitlements are checked by the service. MCP currently does not provide immediate publishing, deletion, social-account disconnection, or permission changes.

Information returned to an external AI client is also handled under that client's and its provider's terms. Markish does not control the client's retention, model use, or onward sharing. OAuth grants can be revoked through the available connection management flow; revocation invalidates the associated tokens and removes the grant. Review the external client's and provider's terms to understand their data practices before authorizing access.

Service providers, sharing, and transfers

Markish uses service providers for infrastructure, security and observability, communications, social platform connectivity, analytics when enabled, and AI processing when requested. The providers used can change as the service changes. Information is shared with a connected platform when necessary to carry out a user-authorized action, with a user's workspace colleagues according to access rules, or when disclosure is required to address legal obligations, safety, or a business transaction.

Markish and its providers may process information in countries other than where you live. The locations, transfer mechanisms, and contractual safeguards applicable to a particular service depend on the provider and configuration. Contact us for questions about a specific processing activity. We do not claim a universal data residency location.

Retention and security

Information is kept while needed to provide the feature, maintain security and service records, honor user or organization instructions, and address legal obligations or disputes. Retention periods vary by information type and system. Disconnecting an account, closing a workspace, or deleting an account may not immediately remove every backup, log, or copy held by another provider.

Markish uses administrative, technical, and organizational safeguards intended to protect information, including access controls and protections for credentials. No system or transmission method can be guaranteed completely secure. If a security incident affects personal information, Markish will assess and respond under applicable law and its operational procedures, including notices where required.

Your choices and privacy requests

Depending on applicable law, you may request access to, correction of, export of, or deletion of personal information, or object to, restrict, or withdraw consent for certain processing. We may need to verify a request and may coordinate with the organization that controls the workspace. We will respond as required by applicable law.

Use in-product controls to disconnect social accounts or change optional analytics preferences where available. To submit a privacy request, including a request about waitlist or connected-platform information, email privacy@markish.tech. For information held directly by a social platform or external AI client, use that provider's privacy and account controls as well.

Children and eligibility

Markish is a business service and is not directed to children. The service is intended for people eligible to enter into the applicable service terms. We do not knowingly collect children's personal information in violation of applicable law. Contact us if you believe a child has provided personal information.

Policy changes

We may update this policy when the service, data practices, or legal requirements change. The updated version and effective date will be posted here. We will provide additional notice of material changes where required.