Privacy Policy

What we collect

We collect the information you provide (name, email, workspace details) and the data required to publish on your behalf, including OAuth tokens, account handles, profile avatars, post content, media files, and publishing logs. If you join the waitlist, we keep the email address you give us to invite you. After you sign up we may send up to five short emails to help you get started; each one has a link to stop them.

How connected-platform data is handled

TikTok, Instagram, Facebook, Threads, and YouTube provide only the data and permissions you approve on their consent screens. Post Social does not receive your social-network password. Access and refresh tokens are encrypted and kept on the server; they are never returned to the browser. We share post data with a connected platform only when needed to perform the publishing action you requested or approved.

Platform data categories

• Identity: platform user ID, display name, handle, avatar URL.
• Tokens: OAuth access and refresh tokens, encrypted server-side.
• Content: captions, media files, scheduled times, and publishing settings.
• Results: status updates, live post URLs, and sanitized error details.
• Developer access: API key hashes and prefixes, webhook URLs, encrypted webhook signing secrets, delivery attempts, and request identifiers.

Google user data and YouTube API Services

Post Social uses YouTube API Services to publish videos to your YouTube channel. When you connect YouTube, we request a single Google permission (the youtube.upload scope), which allows uploading videos you compose to your own channel. We do not read your channel, subscriber, or viewing data. The only Google user data we store are your OAuth access and refresh tokens, encrypted at rest (AES-256-GCM) on the server and never exposed to the browser, plus the video ID and public watch link of posts you publish. Google user data is shared only with YouTube itself to perform the upload you requested; it is never sold, used for advertising, or shared with other third parties.

By using the YouTube connection you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can disconnect YouTube in Post Social at any time — we revoke our access with Google and delete the stored tokens — or revoke Post Social's access yourself from your Google security settings.

Service providers and security

We use service providers only to operate Post Social: InsForge for the database, sign-in, backend and the background service that publishes posts; Cloudflare R2 for media storage; Vercel for hosting the website; Stripe for payments (Stripe collects and stores your card details; we receive only billing status and invoice records); Resend for sending email; ScrapeCreators to read public view and follower counts for posts and accounts you connect; PostHog for product analytics and error reports; DataFast for website visitor analytics; Rewardful for affiliate tracking; and Crisp for the support chat. We limit stored permissions to the product features in use, encrypt platform credentials at rest, and keep a time-stamped security and publishing record. No internet service can guarantee absolute security.

Product analytics and error reports

We use PostHog to understand how the website and app are used and to find bugs: pages visited, buttons used, errors, and session recordings of how pages are used. Recordings never include what you type, and inside the signed-in app they hide your text, images and videos, so they show where you click, not your posts. When you are signed in, this activity is linked to your account ID, never your email. Error reports from our servers contain the error and technical context, with tokens and keys removed. We do not use this data for advertising.

On our public website (not inside the signed-in app), DataFast counts visits and where visitors came from, using two cookies (datafast_visitor_id and datafast_session_id); when you add a card, those two IDs are passed to Stripe so DataFast can tell which channel led to a payment. When search engines, AI assistants or other automated crawlers request our public pages, our server sends DataFast the page address, the crawler's user agent and its IP address; ordinary visits by people are not sent this way.

On our public website and the billing page, Rewardful, which runs our affiliate program, sets a referral cookie when a visitor arrives through an affiliate's link. When you add a card, the referral ID is passed to Stripe and Rewardful so the affiliate can be credited for the payment.

The support chat on our website and in the app is run by Crisp. If you use it, Crisp stores the messages you send and any details you choose to give (such as your email address) so we can reply, and sets cookies so your conversation stays open between visits.

How we use data

We use your data only to operate the service: authenticating you, publishing posts, refreshing tokens, showing status, and maintaining an audit trail. If you configure a webhook, we send the selected publishing event and its safe result details to the URL you provide. We do not sell personal data.

Data retention and deletion

We keep account data and posts until you delete them or close your workspace. You can disconnect individual accounts or delete your workspace to remove associated data. When a workspace is deleted, we attempt to revoke connected-platform access before removing locally stored encrypted credentials. Already-published content remains on the social platform and must be deleted there directly.

Deletion-request receipts contain a one-way hash and a confirmation status and are retained for no more than 30 days. Expired OAuth state and rate-limit records are routinely purged. See the data deletion page for details.

Your choices

You may disconnect a social account at any time, delete an unpublished post and its unused media, delete a workspace, or delete your Post Social sign-in identity after all workspaces are removed. Disconnecting Post Social does not delete content already published on a third-party platform.

Contact

For privacy questions, contact support@postsocial.xyz.