We never hold your social media passwords
SNS TOWN never receives the passwords for X, Threads, Instagram, Facebook Pages or LinkedIn. When you connect, the account owner presses "Allow" on each network's own screen, and the network passes SNS TOWN a key (token) used for posting and similar actions. Keys are stored encrypted and are not shown on screen or in exports.
We use only the official APIs that each network publishes. We do not operate screens automatically or read and write by unofficial means. You can revoke permission at any time from each network's settings, and also disconnect from the SNS TOWN screen. How to connect is explained in Connect a social media account.
| How we protect it | In practice |
|---|---|
| Social media passwords | Not received. The owner gives permission on each network's screen |
| Social media keys (tokens) | Stored encrypted. Not shown on screen |
| APIs we use | Only each network's official API |
| Revoking permission | From both each network's settings and the SNS TOWN screen |
Login protection
An SNS TOWN account can't be used until its email address has been confirmed. Passwords are not stored as they are; they are converted into a form that can't be reversed (a hash) before saving. For the cookie that remembers your login, too, we store only a hash, not the contents.
| How we protect it | In practice |
|---|---|
| After repeated failures | After 5 failures with the same email address, or 20 from the same connection, within 15 minutes, login stops for a while |
| Two-factor authentication | Log in with an authentication app code. 10 recovery codes are issued |
| Requiring two-factor for a company | Each company or brand can require two-factor authentication from all members |
| Unfamiliar devices | You are notified by email when a login comes from a device we haven't seen |
| Unused devices | Login expires after 14 days of not being used |
| Device list | You can see the devices that are logged in and log them all out together |
| Password reset | We send a one-time link by email that works for only 1 hour |
The sign-up and login screens include a check (Cloudflare Turnstile) that stops mass applications by machines. How to use two-factor authentication and login protection is in Account protection, and the thinking behind it in Two-factor authentication.
Limit access by company
For each company or brand, you can restrict where and on which devices the screens can be opened. You can allow your company network's IP address or make it open only on registered devices. It is off at first. For a smartphone, you open a one-time link, valid for 30 minutes and created on a computer, to register it.
When you apply a setting, if it would lock out the person making the change, SNS TOWN will not accept it. See Access restrictions for details.
We don't let AI readers or automated tools in
On the screens you use after logging in, we do not let in AI crawlers, automated tools, or reads from browsers without a screen. We identify and stop them by how they identify themselves and the characteristics of their connection, and the login screen lets in only search engines. Users do not need to switch anything.
Protecting communication and storage
SNS TOWN runs on Cloudflare. Communication is always encrypted with HTTPS, and old encryption methods (before TLS 1.2) are not accepted. We send the browser instructions every time, such as not letting other sites embed our screens and loading only from places we have decided.
| How we protect it | In practice |
|---|---|
| Communication | Always HTTPS. TLS 1.2 or higher. HSTS has the browser remember to use HTTPS |
| Embedding screens | Our screens can't be embedded inside other sites |
| Loading restrictions | A Content Security Policy narrows where content can be loaded from |
| Access by machines | Cloudflare WAF, bot protection and rate limits |
| Domain | DNSSEC prevents spoofed responses |
Personal information and cookies
How we handle the personal information we collect is gathered in the Privacy Policy, and how we use cookies in About cookies. Analytics cookies are used only when you have given consent. The fonts used to display text are also not fetched directly from an outside service but delivered through SNS TOWN.
Frequently asked questions
Will I ever be asked to enter my social media password?
No. You enter a social media password only on each network's own official permission screen. SNS TOWN's screens never ask for your social media passwords.
Can I cut off access when a staff member leaves?
If you remove them from the member list, they can no longer open the screens of that company or brand. Permission to the social networks stays with the company, so you don't need to reconnect the networks.
Can I stop people from opening the screens from outside the company?
Yes. For each company or brand, you can set it so the screens open only from allowed IP addresses or registered devices. It is off at first.
可免费试用 7 天，无需绑定信用卡。
免费开始
