Security and privacy

What happens to your stuff.

The short version: editing stays on your device, we keep as little as we can, and you can delete everything. Here are the details.

While you edit

Mockups are drawn right on your device. The text you type and the photos you add don’t leave it while you work.
You don’t need an account to edit, and nothing is saved on our side until you export.

On the free plan, exports are posted to Explore under your name, so anyone can see them.
Pro exports can be private. We only show those to you, in your library.
Image files, public and private, are stored with free third-party image hosts such as Postimages and ImgBB, not on our servers. Private files sit at an unlisted address we never show anyone. Think of private as “unlisted,” not encrypted.
Every export gets a small label in its PNG metadata saying it’s a SocialFaker mockup. It doesn’t change a pixel, but it helps fact-checkers and tools tell it’s not a real screenshot.

We store your name, username, email, profile photo, and the posts, comments and likes you make.
Passwords are salted and hashed with PBKDF2-SHA256. We never store or see the password itself.
If you sign in with Google, Apple, GitHub or another provider, we get your name, email and profile photo from them. Never your password.
Sign-ins use a random token in a secure, HTTP-only cookie that page scripts can’t read. We only store a hash of it. Sessions last 30 days.
Requests that change your account must come from our own pages, which blocks cross-site request forgery.

On the website, payments go through Creem, who act as the seller and handle tax.
Your card details never reach us. We only get the plan and whether it’s active.

No ad trackers, no third-party analytics, and no tracking cookies.
We count page views ourselves. To count visitors, we hash your IP address and browser together with the date and a secret, and keep only the hash. Because the date is part of it, we can’t follow anyone from one day to the next. Bots aren’t counted.

When you use SocialFaker through an AI assistant, it only sends us the text, numbers and choices for the mockup. No images.
You connect an app by signing in on our own page and pressing Allow, so the app never sees your password or email. It gets a token that lasts an hour and refreshes on its own, and we only store hashes of it.
A connected app can browse templates and Explore, prepare mockups, and see your AI allowance. It can’t post, comment or change your account. Disconnect it anytime in Settings.
That draft is saved for 90 days so the link works. Anyone with the link can open it, so treat it like any other share link.

Delete any post from its page, and any comment you wrote. We also ask the image host to remove the file.
Delete your whole account at the bottom of Settings. That removes your profile, posts, comments, likes and sign-ins for good.
We keep records of purchases, because tax law requires it.

Please tell us privately through GitHub security advisories rather than in a public issue. We’ll reply as fast as we can and credit you if you like.

Last updated November 2, 2026.