How Heropost protects your account

What protects your account#

• Your email is confirmed. Email sign-ups confirm their address with a code or link before they can sign in.
• Password rules. Passwords need at least 7 characters, with a letter, a number and a special character, and no spaces. See Reset or change your password.
• Too many wrong passwords lock the account. After 5 wrong tries, sign-in is locked for 15 minutes.
• Reset links are short-lived. A password reset link works for 2 hours and only once. The reset page doesn't reveal whether an email has a Heropost account.
• Connecting Google or Facebook is checked. The first time someone uses Google or Facebook with an email that already has a Heropost account, Heropost may email that address a "Confirm it's you" link, valid for 30 minutes, before connecting them.
• Changing your email cuts other ways in. A new email removes Google and Facebook sign-in from the account. See Profile settings.
• Payments. From the Privacy Policy: "We will not store or collect your payment card details." Card payments go through the payment processor.

Your social accounts#

• You sign in on the network's own page to connect most networks, so Heropost never sees those passwords. Bluesky asks for a password and Telegram for a bot token instead: see Bluesky and Telegram.
• Clients don't share passwords with you. With Invite Profile they connect their own accounts to your workspace.
• Teammates get their own login. Invite them with a role instead of sharing your password, and remove them when they leave. See Invite your team.
• AI tools get their own link, with the permissions you choose, and you can remove a link at any time. See Safety: what an AI tool can and can't do.
• To withdraw Heropost's access to a social account, delete it in Heropost and remove Heropost in the network's own settings. See Your data.

What isn't available#

• Two-step sign-in (a code from an app or text message) for Heropost logins.
• A list of the devices or browsers you're signed in on, and a way to sign out of all of them at once.

What you can do instead:

• Sign in with Google or Facebook, and turn on two-step verification there. If you never set a Heropost password, signing in always goes through Google or Facebook, including their second step.
• Protect your email account. Anyone who can read your email can reset your Heropost password, so give your email two-step verification too.
• Use a password you don't use anywhere else, and don't share it.
• Log out on shared computers, and untick Remember me there. See Sign in, stay signed in and sign out.

If you think someone else used your account#

Emails that ask for your password#

Heropost never asks for your password by email. Heropost's sign-in pages are on login.heropost.io, and the app is on app.heropost.io. If an email asks for your password or sends you to another address to sign in, don't use it: forward it to support@heropost.ai.

Your data#

The Privacy Policy explains what Heropost keeps and why. On data from your social accounts, it says: "We never sell platform data, never use it for advertising, and never share it with third parties except the service providers needed to operate the Service." To delete data or your account, see Your data.

If it doesn't work#

Questions#