Privacy
How ReviewLink uses your data
Last updated 13 November 2026.
What this app is
ReviewLink is a Buffer Commit 2026 entry. It helps a social media manager share a private, no-login link so a client can approve scheduled Buffer posts. It is an independent project, not an official Buffer product.
What we collect
When you click Connect Buffer, ReviewLink receives an OAuth grant and reads your Buffer account name, email, timezone, organizations, connected channels, and scheduled posts (caption, scheduled time, and media thumbnails). If a client submits a review, we store their decisions and optional comments, and we write those back to Buffer as collaboration Notes on the relevant posts.
How we store it
Access and refresh tokens are encrypted (AES-256-GCM) and stored in a private Redis database, keyed by your Buffer account. Your session cookie holds only a random session id — never a Buffer token. Review-link URLs use an unguessable 128-bit token, stored as a SHA-256 hash. Links expire after 30 days. We do not log Authorization headers, tokens, or raw review-link tokens.
Who we share it with
We send API requests only to Buffer (auth.buffer.com and api.buffer.com) to act on your behalf. We do not sell your data. A person with a review-link URL can see the snapshot of posts you chose to share, plus the client name you entered — not your Buffer login, and not your access tokens.
How long we keep it
Sessions last 7 days of inactivity. Review links expire after 30 days (or sooner if you revoke them). Logging out ends your session; use “Disconnect Buffer” (when available) or revoke the app in your Buffer settings to drop stored tokens. You can also email the operator and ask for your data to be deleted.
Contact
Questions: the operator of this Buffer Commit entry, Eromonsele Michael Osagie. You can revoke ReviewLink at any time from Buffer settings.