Privacy Policy

Effective date: November 1, 2026

This Privacy Policy explains how Phoenix Media Lab ("we", "us") handles information in connection with Affiliate OS Publisher, our private internal content-publishing and scheduling application, its integration with the Pinterest API, and this website, phomedialab.com.

Affiliate OS Publisher is operated by Phoenix Media Lab and is used only by Phoenix Media Lab to publish content to social media accounts that Phoenix Media Lab owns and controls. It is not offered to the public. Because of that, most of the information it processes is about Phoenix Media Lab's own accounts and content.

1. Information We Process

Depending on how Affiliate OS Publisher is used, it may process the following information.

From a connected Pinterest account

Account identity and basic profile information: the Pinterest account ID, username, business or display name, and account type of the account Phoenix Media Lab connects.
Boards and board sections: the names and IDs of the connected account's boards and board sections, read so that we can choose where to publish. The ID and name of the board or section chosen for a Pin are saved with that publication.
Pin IDs and publishing status: the ID Pinterest returns for each Pin we create, and whether each publication is scheduled, publishing, published or failed.
OAuth credentials: the access token and refresh token Pinterest issues when the account is connected, their expiry times, and the permissions (scopes) granted. See OAuth Credentials.
API usage limits: the rate-limit information Pinterest includes in its responses, so that we can stay within Pinterest's limits.

Content we create

Content and media selected for publication: images that Phoenix Media Lab uploads or selects, with their file name, type, size and dimensions, and the Pin title, description, alternative text and destination link that we write.
Scheduling and publication metadata: the scheduled date, time and time zone, the destination account and board, who or what started each publishing attempt (a person or the scheduler), and when it happened.

Operational information

Operational and error metadata: a record of each publishing attempt with its time, result, error category, the HTTP status and error code returned by Pinterest, a short sanitized error message and rate-limit values. This record never contains tokens, authorization headers, OAuth codes or raw Pinterest responses.

People who click links in our Pins

A Pin published by Phoenix Media Lab may link to one of our pages through a tracking link. Some of those pages contain affiliate links: if you follow one and buy a product, we may earn a commission. When someone follows our tracking link, we record a random click identifier, a random session identifier stored in a first-party cookie, the time of each step, which of our posts and campaigns the link belongs to, the host name of the referring website (for example pinterest.com), and a two-letter country code supplied by our hosting provider. We do not store IP addresses, names, email addresses or phone numbers, and we do not use browser fingerprinting.

What we do not collect

We never collect Pinterest passwords or other Pinterest login credentials.
We never collect Pinterest session cookies.
We do not collect information about other Pinterest users, their followers, their boards or their Pins.
We do not access Pinterest advertising accounts or ads data.

2. How We Use Information

We use the information above only to operate Affiliate OS Publisher for Phoenix Media Lab's own accounts, specifically to:

connect Phoenix Media Lab's Pinterest account and keep that connection working;
show which account is connected and list its boards so that we can choose where to publish;
create, schedule and publish the organic Pins that Phoenix Media Lab has approved;
confirm whether each Pin was created, and retry or fix failed publications;
stay within Pinterest's API rate limits;
keep audit records of what was published, when and where;
measure how Phoenix Media Lab's own campaigns perform, using the click records described above.

We do not sell information. We do not use Pinterest data for advertising, to build profiles of Pinterest users, or for any purpose unrelated to publishing Phoenix Media Lab's own content. Affiliate OS Publisher is not used to send unsolicited messages, and it is not used to create fake engagement such as automated likes, follows, comments or saves.

3. Pinterest API Data

Affiliate OS Publisher connects to Pinterest only through Pinterest's official API and requests only the permissions its publishing workflow needs:

user_accounts:read: to identify which Pinterest account is connected;
boards:read: to list the connected account's boards and board sections so that we can choose where to publish;
boards:write, pins:read and pins:write: Pinterest requires these, together with boards:read, to create a Pin.

The current integration makes only these kinds of Pinterest API requests: reading the connected account's identity, listing its boards and board sections, creating Pins, and obtaining or refreshing OAuth tokens. It does not create, edit or delete boards, and it does not read other users' Pins.

It does not request advertising, catalog or other permissions. Data received from the Pinterest API is used only for the purposes in How We Use Information, only for accounts that Phoenix Media Lab controls, and as permitted by Pinterest's developer terms and policies.

When Affiliate OS Publisher creates a Pin, the image is made available to Pinterest at a long, randomly generated web address so that Pinterest can fetch it, and the title, description, alternative text, destination link and board are sent to Pinterest. Pinterest processes that content, and any other data it receives through its API, under Pinterest's own terms and privacy policy, which you can read on Pinterest's website. Pins that have been published are hosted by Pinterest and appear on Pinterest according to Pinterest's settings.

4. OAuth Credentials

Phoenix Media Lab connects its Pinterest account through Pinterest's own OAuth 2.0 authorization screen. Pinterest, not Affiliate OS Publisher, handles the login.
OAuth access and refresh tokens are used only to authenticate authorized Pinterest API requests for the connected account. They are not used for anything else.
Tokens are encrypted at rest with AES-256-GCM before they are stored. The encryption key is held separately as a protected server secret and is not stored with the data.
Tokens are not exposed in the browser after the connection is made. They are kept on the server, and they are never included in web pages, application responses, URLs or logs.
During testing, Phoenix Media Lab may instead connect its own account with a temporary Sandbox access token that Pinterest's developer site issues to the app's owner. That token is entered only into Affiliate OS Publisher's protected settings screen, and it is verified with Pinterest, encrypted and stored in exactly the same way.

We do not sell, rent or trade information. We share it only as follows:

Pinterest: content we choose to publish and the requests needed to publish it are sent to Pinterest through its API.
Infrastructure providers: Affiliate OS Publisher and this website run on Cloudflare, which provides hosting, database, file storage, access control and security services. Cloudflare processes data as necessary to provide those services.
Affiliate networks: if someone follows an affiliate link on one of our pages, the click identifier and our campaign labels are passed to the affiliate network (such as ClickBank) so that a resulting sale can be attributed to us. From that point, the seller's and network's own privacy policies apply.
Legal reasons: we may disclose information if we are required to by law, or if it is necessary to protect the security of our systems or the rights of others.

6. Data Retention

OAuth credentials are kept only while the Pinterest account is connected. Disconnecting the account deletes them.
Account records (account ID, username, display name and connection status) are kept after a disconnect so that the history of what was published to that account stays accurate. They no longer contain credentials.
Publication records and the publishing attempt log are noncredential records. We keep them for security, auditing and operational integrity. The attempt log is append-only by design.
Media files are kept until Phoenix Media Lab removes them. A removed or revoked file is no longer served to anyone.
Click records are kept for campaign measurement. The session cookie expires after 30 days.

We may delete any of these records sooner. Information already sent to Pinterest, such as a published Pin, is kept by Pinterest under Pinterest's policies and can be deleted on Pinterest.

7. Security

All connections to Affiliate OS Publisher, to this website and to the Pinterest API use HTTPS.
OAuth credentials are encrypted at rest with AES-256-GCM, and the key is held as a separate server secret.
Affiliate OS Publisher's administration screens are not public. They sit behind access control that only Phoenix Media Lab can pass, and they include protections against cross-site request forgery.
The Pinterest connection flow checks a random, single-use state value to protect against forged authorization responses.
Logs and error records are designed to exclude tokens and other secrets.

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security. We review and improve these protections as the application changes.

8. User Choices and Disconnecting

Disconnecting in Affiliate OS Publisher: Phoenix Media Lab can disconnect its Pinterest account in Affiliate OS Publisher at any time. Under the application's current behavior, disconnecting immediately deletes the locally stored OAuth credentials (the encrypted access and refresh tokens) and marks the account as disconnected. Noncredential records described in Data Retention may be kept.
Revoking access on Pinterest: disconnecting in Affiliate OS Publisher does not by itself revoke the authorization on Pinterest's side. The account owner can also remove Affiliate OS Publisher's access in the Pinterest account's settings, where apps with access to the account are listed.
Deleting Pins: Pins that were already published stay on Pinterest until they are deleted on Pinterest.
Questions and requests: if you believe we hold information about you, or you want to ask about or request deletion of information described in this policy, contact us using the details below.

9. This Website

This website (phomedialab.com) is a static information site. It does not use cookies, analytics, advertising, tracking pixels or third-party scripts, and it has no forms or accounts. Like any website, its hosting provider (Cloudflare) processes standard technical information, such as IP addresses and browser details, as necessary to deliver the pages and protect the site.

10. Children's Privacy

Affiliate OS Publisher and this website are not directed to children, and Affiliate OS Publisher is used only by Phoenix Media Lab. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this policy when Affiliate OS Publisher, its Pinterest integration or our practices change. When we do, we will update the effective date at the top of this page, and we will describe significant changes on this page.

12. Contact

Phoenix Media Lab operates Affiliate OS Publisher and is responsible for this policy. For questions or requests about privacy, contact us at privacy@phomedialab.com.