Privacy

Last Look is a tool by Swift Bot Labs that checks the posts waiting in your Buffer queue. This page says exactly what it reads, what it keeps, for how long, and what it logs.

What Last Look asks Buffer for

• account:read: your account id and display name, and your organizations and channels (name, network, time zone, avatar), so posts can be judged per channel.
• posts:read: your scheduled posts, posts awaiting approval and drafts: text, scheduled time, attached media type and alt text, link previews and first comments. When you open Look back, also your most recent sent posts (up to 90): the same fields plus when each went out and the link to it on the network.
• posts:write: used only when you press a fix button and then confirm, or press Undo within two minutes of an edit. It edits that one post’s text, moves it to drafts, or moves it to the front or end of its queue. After a move, it reads that channel’s queue once more, to see which posts Buffer gave a new time. Last Look never creates, publishes or deletes posts.

The daily digest, only if you turn it on, asks Buffer for a second, separate connection with account:read posts:read offline_access: it can read your queue on its own once a day, and it cannot change, publish or delete anything.

Where the checks run

Our server fetches your queue (and, for Look back, your recent sent posts) from Buffer and passes it straight to your browser. The checks themselves run in your browser tab. The server does not keep the posts after answering. Look back only reads: sent posts cannot be changed, and links in them are not opened.

The try page at /try needs no sign-in. A post you type there is checked in your browser and is not sent anywhere: not to our server, not to Buffer, and links in it are not opened. The sample queue there is made-up data that lives in the page, and it sends nothing either.

What is stored, and for how long

• Your session (encrypted with AES-256-GCM, under a key that needs both our server secret and the random session id held only in your browser’s cookie): your Buffer access token and its expiry, a security token for your browser, a one-way hash of your Buffer account id, your organizations’ ids and names (up to five), your Buffer display name, whether Buffer granted editing, and when the session started. It lives at most one hour, matching Buffer’s access token.
• Usage counters, stored under the one-way hash of your account id: a hash of your current session id, the time of your last scan and last Look back, today’s number of scans, Look backs, fixes, link checks and sign-ins, and how many Buffer requests were made for your account today and in the current 15 minutes. They contain no content and reset every day (UTC); they let us limit use so the app stays available to everyone.
• For one minute only: a hash of each link we checked for you (so the same link is not fetched twice within a minute) and, per linked website (for example “example.com”), how many checks it received in that minute across all users. Cloudflare’s rate limiter also counts requests per network for a minute, under a one-way hash of your IP address (for IPv6, of its /64 block); the address itself is not stored.
• For at most 30 minutes: a one-way hash of each sign-in attempt’s one-time value, so the same sign-in response cannot be used twice.
• App-wide: how many requests Buffer still allows this app, read from Buffer’s replies.
• In your browser: one cookie with the session id (HttpOnly, Secure, SameSite=Lax). During sign-in a second cookie lives for at most 10 minutes with one-time sign-in values. Channel rules you set (phrases to avoid, tags every post needs) are saved in your browser’s local storage under your channels’ ids; they are never sent to our server or to Buffer, and clearing a channel’s rules or your site data removes them.

The daily digest (only if you turn it on)

• Its Buffer key: the long-lived refresh token of the digest’s read-only connection, encrypted (AES-256-GCM, under a key derived from our server secret and the digest’s own id) in one Cloudflare Durable Object. It never goes to a browser. Buffer replaces it each time it is used; the old one stops working. The short-lived access token it gives is used for that one daily read and not stored.
• The digests: the last 7 (one a day), each with the send time, channel name and the first 140 characters of each flagged post, plus the flags. Encrypted the same way. A post with nothing to fix is only counted.
• Settings: the hour you picked, your time zone, your organizations’ ids and names, a one-way hash of your Buffer account id, when the digest was last built and last opened.
• The private address: stored as a one-way hash, plus an encrypted copy so you can see it again in the app when signed in. Anyone who has the address can read the digest, so share it only with your team.
• Off: the button on the digest page or in the app deletes all of the above at once, and Last Look then revokes the connection at Buffer. It also switches itself off, the same way, if nobody opens the page or the feed for 14 days, or if you remove Last Look in your Buffer settings.
• Opening the page or the feed reads only what is stored: it never calls Buffer and never opens a link. Up to 4 links in tomorrow’s posts are checked when the digest is built, the same way as below.

What is not stored

• Outside the daily digest (above), post text, media, links in readable form, and check results are not written to any database, file or log.
• No tracking, no ads, no third-party scripts. The page loads only from this site. Channel avatars load in your browser from Buffer’s image hosts (buffer-channel-avatars-bucket.s3.amazonaws.com, *.buffer.com, *.bufferapp.com); avatars hosted anywhere else are not shown.

Logs

Request logging on Cloudflare (Workers Logs and invocation logs) is switched off for Last Look, so no request URLs, IP addresses or headers are kept by us. Our code writes short event lines such as “connected”, “fix applied” or “disconnected”, with no ids, text, links or tokens; with logging off they are not stored and can only be watched live by the operator. Cloudflare still keeps aggregate counts (requests, errors, CPU time) for the service.

How links in your posts are checked

Our server looks the link’s domain up with Cloudflare’s public DNS resolver, then sends one HEAD request, identifying itself as “LastLook”. Only if the site answers that it does not support HEAD (405 or 501) does it send one GET request, and the response body is never read. It follows at most three redirects, checking each one the same way. Only the status (for example 200 or 404) and where it redirected are used. Links to private or internal addresses, and links written as bare IP addresses, are never opened. Each link is checked at most once a minute for your account, up to 300 checks a day.

Disconnecting

Press Disconnect and your session is refused from that moment; its record, with the Buffer token, is deleted from our store right after (within seconds), and a cached copy can linger in Cloudflare’s storage for up to about a minute without being usable. Signing in again also ends any older Last Look session of the same Buffer account. To revoke Last Look’s access on Buffer’s side, remove it from the connected apps in your Buffer account settings.

Limits

To keep Last Look available for everyone: one scan a minute, 20 scans and 40 fixes a day per account, one Look back every two minutes and 6 a day, at most 15 Buffer requests per 15 minutes and 60 a day per account, and new requests pause when Buffer’s request allowance for this app runs low.

Who runs it

Swift Bot Labs, contact swiftbotlabs@gmail.com. Last Look runs on Cloudflare Workers. It is not made by or affiliated with Buffer.

Last updated 5 November 2026.