Privacy Policy

Last updated: October 19, 2026

Poosh (the "Service") is a multi-channel distribution service operated by WIZZO SOFTWARE LTD (company no. 516624699), 3 Totseret Haaretz St., Petah Tikva, Israel ("Wizzo", "we"). The Service lets businesses ("Customers") send content they created themselves, from their own website or app, to push notifications, WhatsApp, Telegram and their own social media accounts (Facebook, Instagram, X, TikTok, YouTube). This policy explains what we collect, why, where it is stored and how it is deleted.

1. Business customer data

Accounts are opened through Wizzo Market. We keep the business name, website address, contact details (name and email) and the billing data required for the chosen plan. Payments are processed by a payment provider; we do not store card numbers.

2. Social accounts a Customer connects

When a Customer connects one of their accounts (Facebook Page, Instagram account, Telegram channel, X account, TikTok account or YouTube channel), we receive from the platform, with their explicit consent, only what is needed to publish on their behalf:

• Access and refresh tokens, stored encrypted (AES-256) and used only to publish the content the Customer sent and to check its publishing status.
• The account ID and public profile details (display name, username, avatar), to show the Customer which account is connected.
• The IDs of published posts or videos and their status, to show the Customer a delivery report.

TikTok: through the TikTok Business API we access only accounts whose owners authorized the connection, and only with these scopes: basic account info (user.info.basic), the account's videos and their metrics (video.list, video.insights) and video publishing (video.publish). We publish only videos the Customer distributed from their own website, with the caption and the comment, duet and stitch settings the Customer chose. We do not read private messages, do not collect follower data and do not use TikTok data for advertising, profiling or sale.

YouTube: the Service uses YouTube API Services. We access only channels whose owners authorized the connection from their Google account, and only with two scopes: uploading videos (youtube.upload) and read-only access to the channel details and to the status of the videos we uploaded (youtube.readonly). We store the channel ID, title, handle and thumbnail, and the ID of each video we uploaded. A video's status (processing, privacy, thumbnail) is read live from YouTube when the Customer opens the distribution report and is not stored. 30-day limit: the channel details (title, handle, thumbnail, verification status) are refreshed from YouTube once a day; a channel that could not be refreshed for 30 days keeps only its ID and the other details are deleted. Messages YouTube returned about a video are deleted after 30 days. Only the channel ID and the video IDs are kept beyond that, so the Customer can open the published video. We upload only videos the Customer distributed from their own website, with the title, description, tags and privacy setting the Customer chose. The video file is kept on our server only during the upload and is deleted right after it. We do not read comments, messages or subscriber data, do not serve ads and do not share YouTube data with any third party. By using the YouTube channel of the Service you agree to the YouTube Terms of Service, and the Google Privacy Policy applies.

Use of information received from Google, Meta and TikTok is also subject to each platform's policies and developer terms, including the Google API Services User Data Policy. POOSH's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Data about Customers' subscribers

When a visitor of a Customer's website or app allows notifications, we store the push token issued by the browser or device, the platform type (web, Android, iOS), the topics chosen, the IP address it registered from (to detect duplicate registrations and abuse) and a user ID if the Customer provides one. Tracking links store country, referrer and a hashed visitor ID, never a plain IP address. The Customer decides what is sent to their subscribers and is responsible to them for their data.

4. How we use data

• To operate the Service: send and publish what the Customer requested, and report what was sent, opened or failed.
• To secure the Service, prevent abuse and respect each platform's rate limits.
• For support and billing.

We do not sell personal data and do not share it with third parties for marketing.

5. Where data is stored and sub-processors

Data is stored on Hetzner servers in the European Union. Sub-processors that handle data for us, only to operate the Service: Google Firebase (push delivery), Meta, X, Telegram, TikTok and Google YouTube (publishing to accounts the Customer connected), and the Wizzo Market payment provider.

6. Retention and deletion

• When a Customer disconnects a channel, that account's tokens are deleted immediately. Access can also be revoked at any time from the platform's own security settings (on TikTok: Settings and privacy, Security, Apps and services; on YouTube: the Google Account permissions page). Disconnecting a YouTube channel in the channels screen also revokes the authorization with Google and immediately deletes the tokens and the channel details. Once a day we refresh the stored channel details, and if the authorization was revoked from the Google Account, the tokens and channel details are deleted in that same check (within 7 days at the latest).
• Data received from YouTube (channel details, messages about a video) is never kept more than 30 days without a refresh; only the channel ID and the video IDs are kept until the channel is disconnected.
• Push tokens that are no longer active are deleted automatically.
• When a Customer account is closed, its data is deleted within 30 days, except what the law requires us to keep (such as invoices).

7. Cookies and storage on your device

The Service keeps a small amount of information in the browser or on the device, only what it needs to work. We use no advertising, tracking or analytics cookies, and we do not read other sites' cookies.

In the Poosh dashboard (for Customers): three display preferences are kept in the browser's local storage (localStorage): dark mode (poosh_dark_mode), collapsed menu (poosh_sidebar_collapsed) and hiding scheduled distributions (poosh_hide_scheduled). They stay until changed or until the site data is cleared in the browser. The dashboard sign-in token is held in the page's memory only and is gone when the page is closed. Sign-in itself goes through Wizzo Market, whose cookies are described in the Wizzo Market Privacy Policy.

On a Customer's website that embeds Poosh (for its visitors):

• poosh_prompt_state (cookie, 30 days): whether the notification request was already shown and how it was answered, so it is not shown again and again.
• poosh_reg (cookie, 30 days): the browser's push token, the time of the last registration and its internal ID, so the same device is not registered twice and the registration is refreshed once a day.
• poosh_fk_drop (cookie, up to 10 years): a one-time marker that an old push subscription of a previous provider was already replaced, so this does not happen on every page load.
• A Service Worker (poosh-sw.js) and the Google Firebase Messaging IndexedDB store, which hold the browser's push subscription. They stay as long as notifications are allowed.
• Tracking links store nothing in the browser: the server keeps a hashed visitor ID derived from the IP address and the browser, with the country and the referrer, and does not keep the IP address itself.

When a YouTube channel is connected: the connection opens in a Google window (accounts.google.com). Google sets its own sign-in and security cookies there, on its own domain and under the Google cookie policy; Poosh does not read or receive them. Poosh itself stores no cookie or other data in the browser during the connection.

How to delete: clear the cookies and site data in the browser settings (in Chrome: Settings, Privacy and security, Third-party cookies and site data), or block notifications for the site from the lock icon next to the address. Revoking the permission also ends the subscription, and the token is deleted on our side by the next automatic check.

8. Security

Traffic is encrypted (HTTPS), access tokens are encrypted at rest, and server access is limited to authorized staff using keys only.

9. Your rights

You may ask to access, correct or delete your data by writing to info@wizzo.co.il. A subscriber who no longer wants notifications can revoke the permission in their browser or device; requests about a specific business are also forwarded to that business. We answer within 30 days.

10. Changes

We will update this policy when the Service changes. The date at the top shows the latest version, and material changes are also emailed to Customers.

11. Contact

WIZZO SOFTWARE LTD, 3 Totseret Haaretz St., Petah Tikva, Israel · info@wizzo.co.il