# Privacy, exports and deletion

Know what is stored and how to request removal.

## Workspace boundaries

Credentials remain server-side and access is checked against the workspace owner. Application export excludes passwords, social tokens and assistant credentials.

## Media visibility

Publishing uploads can be retrievable through public object URLs so providers can fetch them. Do not upload confidential material to this delivery flow. Brand-reference storage uses a separate private flow.

## Deletion

Use the account deletion-request control or the published privacy contact. Support reviews shared-login implications. A recorded request is not completed deletion; provider copies and published posts are separate.