Privacy policy

Postacio is operated by DSV CAPITAL S.R.L., a company registered in Romania (CUI 48291680, trade register number J2023010545400, formerly J40/10545/2023), with its registered office at Calea Moșilor 88, sc. F, ap. F1, Sector 3, 030152 Bucharest, Romania. That company is the data controller for everything described here, and reads what is sent to the address below.

Questions, requests, or complaints: privacy@postacio.com. A person reads it.

Postacio gets data from Google in two ways: when you sign in with Google, and when you connect a YouTube channel. This section lists everything Postacio accesses from Google, what it uses each piece for, and how it is stored, shared, kept and deleted. Postacio uses Google user data for nothing else.

Sign in with Google

Permissions requested: your basic profile and your email address (the openid, email and profile scopes). Postacio receives your email address, your name, your profile picture and the identifier Google uses for your account. It uses them only to:

• create your Postacio account and sign you in to it;
• show your name and picture in the app, to you and to the people in a workspace you work in, and next to your comments to the people a workspace sends a review or approval link to;
• put your name on the invitations you send to join your workspace;
• send you sign-in and account emails, the notifications you switch on, and replies from support, at your email address;
• set up your billing: when you go to checkout, your email address and name are sent to Paddle, which runs it (see Who else processes it), and a one-way hash of the address keeps the free trial to one per person (see Billing);
• tell the people who run Postacio, by email, that a new account was created, with its name and email address.

Postacio requests no other Google permission at sign-in, and does not keep a Google access token from it.

Connecting a YouTube channel

Permissions requested, each used only as described:

• Upload videos (youtube.upload) - to upload each video you schedule to your own channel, at the time you chose, with the title, description, tags, category, visibility and made-for-kids answer you chose for it, and the custom thumbnail you chose, where your channel allows one. These uploads are the only changes Postacio makes on YouTube.
• View your YouTube account (youtube.readonly) - to read your channel’s id, name, handle and picture, so you can see which channel is connected; the channel’s subscriber count; and the view, like and comment counts of the videos Postacio published for you, which also shows whether each video still exists.
• View YouTube Analytics reports (yt-analytics.readonly) - to read the shares, watch time, average view duration and subscribers gained of the videos Postacio published for you. This permission is optional: without it, those figures are simply not shown.

Postacio uses these to publish your videos and to show you, and the people in your workspace, which channel is connected and how its videos are doing, in the calendar, the post view and Analyze. It never reads other channels or the text of comments, never searches YouTube, and never edits or deletes a video once it is uploaded.

How it is stored

Google user data is stored in Postacio’s database, run by Supabase and encrypted at rest. The YouTube access and refresh tokens are additionally encrypted by Postacio with AES-256-GCM, with a key held outside the database. It travels only over encrypted connections, and every request for it is checked against the workspace it belongs to and the permissions of whoever is asking. The full set of safeguards is under How your data is protected.

Who it is shared with

Google user data is never sold, never used for advertising, never used to build a profile of you, and never used to develop, improve or train any AI or machine-learning model. It is never sent to OpenAI: the writing assistant receives only the text and instructions you give it (see Writing assistance). It is shared only:

• with the people you invite to your workspace, in the role you give them;
• with the people your workspace sends a review or approval link to: they see the post as it will appear, with the connected channel’s name and picture, and the names of the people who commented on it;
• with the tools you connect yourself - an API key, an AI assistant signed in through Postacio’s MCP server, or a webhook - which can read the accounts, posts, links and figures of the groups you gave them, and the names of the people who commented (see Tools you connect);
• if you connect Slack, with the Slack channel you chose: the link to each video Postacio publishes is posted there;
• with Paddle, your email address and name, when you go to checkout;
• with the providers that run Postacio for us, only so that they can do so: Supabase stores it, Vercel and Railway process it to show it to you and keep it current, and Resend delivers emails to your address, including a notification you switched on that links to a published video (see Who else processes it).

The people who run Postacio read it only with your permission to look at specific data, when that is needed to investigate a bug or abuse, or when the law requires it. Their console never shows a YouTube channel’s name or handle.

How long it is kept, and how to delete it

Your name, email address and picture are kept while your account exists and are deleted with it (see How long it is kept). What Postacio reads from YouTube is kept only as long as described under YouTube, specifically, and is deleted when you disconnect the channel, on the schedule described there. Links already posted to Slack or sent to you by email stay there until you delete them. You can remove Postacio’s access to your Google account and YouTube channel at any time at myaccount.google.com/permissions, and ask for any of it to be deleted by writing to privacy@postacio.com.

Limited Use

Postacio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google’s own handling of your data is described in the Google Privacy Policy.

If you connect a YouTube channel, Postacio uses YouTube API Services. By connecting it you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. What Postacio reads from YouTube, what it uses it for and who it is shared with are listed under How Postacio uses Google user data.

What Postacio keeps: the channel’s id, name, handle and picture on the connection, kept current from YouTube while it is connected and cleared if they have not been read again within 30 days; and the figures listed there as your analytics history - the numbers only, never the channel’s name or picture - for as long as Postacio can confirm, at least every 30 days, that you still authorise it and that each video still exists. When you disconnect the channel, everything Postacio read from YouTube for it is deleted at once and Postacio asks Google to revoke its access; the video ids and links on your published posts are deleted within a day. A video you delete on YouTube has its figures deleted when Postacio sees it is gone, and so does a video Postacio has not been able to read for 30 days. If you revoke access at Google, or Google refuses to renew it, within 30 days the channel is removed from Postacio and everything Postacio obtained from YouTube under that access is deleted - the channel id, its figures, and the video ids and links on your published posts - and posts still scheduled for it are not sent. You can connect it again at any time, as a new connection. If Postacio cannot confirm your access for 30 days for any other reason, the channel’s figures are deleted and its name, handle and picture are cleared. You can revoke Postacio’s access to YouTube at any time in Google’s security settings.

Postacio shows no advertising, and lets no third party serve content in the app other than Paddle’s checkout when you pay. On your device it places only the essential cookies described under Cookies, never advertising or tracking cookies, and keeps a few working values in your browser’s own storage, such as your theme, a list of recent drafts, and an image or video you edited before it is uploaded. None of it is read by anyone else.

To have YouTube data deleted without disconnecting, or with any question or complaint about how Postacio handles it, email privacy@postacio.com. A deletion you ask for is done within 7 days.

Only what the product needs to do its job. There is no hidden collection, no tracking pixel, and no profile built about you.

Your account

Your email address, and a password that our authentication provider stores only as a hash, never in readable form. If you sign in with Google instead, we receive and store your name, profile picture URL and Google account identifier alongside your email (see How Postacio uses Google user data). We also keep the date your account was created.

The platforms you connect

When you connect X, Telegram, Instagram, Facebook, LinkedIn, TikTok or YouTube, that network issues Postacio a credential on your behalf. OAuth access and refresh tokens, plus Telegram bot tokens, are stored encrypted at rest with AES-256-GCM, using a key held outside the database, so a database copy alone does not yield a usable token. Alongside them we store the connected account’s own public identity as the platform reports it: its id, its display name or handle, its avatar URL, the permissions you granted, and when the token expires.

You can disconnect any platform at any time from the app, and revoke Postacio’s access from the platform’s own settings.

Your posts and media

The text you write, per-platform caption overrides and settings, the images and videos you upload, the cover thumbnail shown in your calendar, when a post is scheduled for, and the result of each publish attempt - including the platform’s own post id and permalink, so we can look up its metrics later. Uploaded media is stored under a key namespaced to your account and served only through short-lived signed links.

Your analytics history

This is the core of the product, so it is deliberate retention rather than incidental logging. Fresh posts are checked often, and checks slow as a post ages. Postacio asks each platform for that post’s current metrics - views, likes, comments, shares, saves, reach and impressions, plus the raw response - and writes them as a new append-only snapshot. Snapshots are never edited or overwritten; the database itself rejects an update. Telegram gives bots no view counts, so for a Telegram channel Postacio reads the views and reactions from the post’s public web page on t.me, the one anyone can open without signing in. We do the same for the account totals each connected network makes available, such as followers, profile views, reach and impressions.

Your preferences

Your timezone, and the weekly posting slots you set per connected account. Your light or dark theme choice is kept in your browser’s local storage and never sent to us.

Billing

If you start or manage a paid subscription, Postacio stores your Paddle customer id and the subscription’s plan, price, billing interval, number of accounts billed, status, trial, renewal, pause and cancellation dates, and whether the account has used its one free trial. To keep the free trial to one per person, a one-way SHA-256 hash of your email address is recorded when a trial starts and kept after the account is deleted; the address itself is not stored with it. If you cancel, we keep the reason you chose and anything you wrote with it, to improve the product. Your Plan page shows the card’s brand, last four digits and expiry, read from Paddle when you open it and not stored by Postacio. We also count your published posts and AI writing actions per social group per month, to apply your plan’s allowances. Payment details are entered in Paddle’s checkout and are not sent to or stored by Postacio.

Support and feedback

If you write to support in the app, Postacio stores the conversation - your messages and our replies - so the person answering can see what was said. If you leave feedback, it stores what you wrote, the kind you chose, and the app page you were on (the path only, never what was on the page). Both are read by the people who run Postacio, are included in your data export, and are deleted with your account.

Your agreement

The date you agreed to the terms of service and this policy, and which edition of them it was.

Teams

If you belong to a workspace with other people, its members see your name, email address and profile picture next to the work you do there, and the workspace keeps a record of who created, approved or changed a post.

Tools you connect

If you create an API key, let an AI assistant sign in through Postacio’s MCP server, or add a webhook, that tool can read the posts in the groups you gave it, and write, schedule or publish them if you allowed it to. What it receives is then also handled under its own provider’s policy. You can revoke a key or an assistant’s access at any time in Settings.

Writing assistance

The writing assistant is optional. When you ask it to draft or revise text, Postacio sends OpenAI the text and context you supplied, your instruction, and the names of the target platforms. When you ask it to learn a group’s voice, it sends excerpts of that group’s own published posts. When you ask it to write alt text for an image, it sends that image, through a link that expires within minutes. It never sends your social-platform tokens, billing details or email address, and sends a media file only for alt text you asked for. Requests tell OpenAI not to store the generated response in its response store.

Postacio runs on a small set of infrastructure providers. They process your data only to provide their service to us, and nothing is sold or handed to anyone else.

• Vercel - hosts the application and serves every page and API request, and counts visits to the public pages and measures how fast they load, without cookies (see Cookies).
• PostHog - product analytics, hosted in the European Union: which pages are visited, where a visit came from, the country, and what is clicked, and a replay of some sessions, so we can see where Postacio is hard to use. Without cookies (see Cookies).
• Supabase - provides sign-in and the Postgres database where your account, posts, connections and snapshots live.
• Cloudflare R2 - stores the media files you upload, until 30 days after they are published.
• Sentry - error monitoring only. It receives crash reports from our servers, never from your browser: there is no Sentry code on the pages you load, no session recording, and no performance tracing. Expected hiccups such as a platform rate limit are filtered out before anything is sent.
• OpenAI - processes text, and an image when you ask for its alt text, only when you deliberately use the writing assistant, to return what you requested.
• Railway - runs the background worker that publishes your scheduled posts and collects their metrics.
• Resend - delivers the emails Postacio sends you: sign-in and account emails, the notifications you have switched on, and a reply from support.
• Paddle - Paddle.com is our reseller and the merchant of record for every subscription: it runs checkout, takes payment, handles sales tax and VAT, and provides the billing portal. Paddle processes your billing details as a controller in its own right, under its own privacy notice. Postacio gives Paddle your email address and name when you go to checkout, and receives subscription state, not your payment details.

The social platforms themselves are not sub-processors - they are the destinations you are publishing to. Postacio sends them the post you wrote and the media you attached, on your instruction, and reads back the metrics for it. The same goes for Slack if you connect it: Postacio posts the link of a published post to the channel you chose, and nothing else.

• Sell your data, or share it with anyone for advertising. There are no advertisers.
• Use your content, media or metrics to train a model. The optional writing assistant sends OpenAI only what a writing action you pressed needs (see Writing assistance).
• Post anything on your behalf that was not asked for by you, a teammate you invited, an automation you set up, or a tool you connected and allowed to publish.
• Read your inbox or your direct messages. On a connected platform, Postacio reads the account’s details, its own posts and their metrics, and - only when you ask - the public post you are replying to or quoting and the public accounts you search for to mention.

Postacio sets no analytics cookies and no advertising cookies - which is why there is no cookie banner asking you to accept any. The only cookies are essential ones: they keep you signed in, protect sign-up and the connection of a platform while it is under way, record that you accepted these terms, remember the workspace you chose, and remember whether you collapsed the sidebar. The pages load no advertising scripts.

To know which pages people find, the public pages - the home page, pricing, the free tools and the guides, not the app - count visits with Vercel Web Analytics. It sets no cookie and stores nothing on your device. For each visit it records the page, the site that linked to it, the country, and the kind of browser, operating system and device, and tells visits apart only by a value derived from the request that is discarded after 24 hours, so no one is identified or followed from day to day. Anything in a page’s address after the “?” is removed before it is sent, except the campaign tags that say where a visit came from. The script is served from postacio.com itself.

To see where Postacio is hard to use, the public pages, sign-in and the app are measured with PostHog, in its European Union region. It sets no cookie and stores nothing on your device, so a visit is known only for as long as its tab is open; once you are signed in, what you do in the app is linked to your account by its id, never by your name or email address. For each visit it records the pages, the site that linked to it, the country, the kind of browser, operating system and device, and what was clicked, and it may record a replay of the session. Whatever you type is masked in every replay, and inside the app and the free tools all text, pictures and video are masked too, so a replay shows how a screen was used, never your posts, your clients’ names or your media; a click there is recorded by its place on the screen, not its words. Addresses are cleaned as above. Pages opened from a review, approval, invitation or password-reset link, the page where you connect an AI agent, the payment page and the administrators’ console are never measured or replayed. Requests go through postacio.com itself, which passes on only what PostHog needs: never your sign-in cookie.

The same pages measure how quickly they load and respond to you, with Vercel Speed Insights. It also sets no cookie. It records those timings with the page, the country and the kind of device, browser and connection, cleaned of the address’s query in the same way.

• Snapshots and posts - posts and stored snapshot records may remain while your account exists. The analytics available in the product use a rolling 365-day window on a paid plan or trial. Without a plan analytics is not shown, and the records are kept.
• Uploaded media - the original file is deleted 30 days after the post has finished publishing, or as soon as you delete the post, unless another post or automation still uses it. Until then you can duplicate or retry the post with its files. The platform keeps its own copy. Media in drafts stays until the draft is published or deleted, and cover thumbnails are kept so your calendar still shows the post. A cover thumbnail is stored at a public address made of random characters, so only someone who has the link can open it.
• Everything described here - removed from Postacio’s database and storage immediately when you delete your account. Records already sent to the analytics, error-monitoring and email providers listed above are not erased by that step and expire under those providers’ own retention. The exceptions: the one-way hash showing that your email address has had its free trial; the invoices Paddle keeps as merchant of record for as long as tax law requires; what you wrote in other people’s workspaces, which stays theirs, attributed by your name; and the record of actions Postacio’s administrators took on your account.

• See and export - Settings downloads the account, content and product records Postacio currently stores for you as one JSON file. Credentials, social-platform tokens, review and approval links, and full payment-card details are deliberately excluded.
• Delete - Settings contains a delete-account control that removes everything described above, with the exceptions listed under How long it is kept, immediately and cannot be undone. The data-deletion page documents the steps, and what to do if you can no longer sign in.
• Correct - your email and password are editable in Settings; posts are editable until they publish. For anything else, write to us.
• Withdraw - disconnect any platform at any time. Postacio’s stored tokens for it are removed. X, Facebook, Instagram, TikTok and YouTube are also asked to revoke Postacio’s access, except while the same account is still connected in another workspace (for Facebook, while you still have another Page connected), and what Postacio read from YouTube for it is deleted. Instagram may not act on the request, and LinkedIn gives apps no way to make it, so for those two remove Postacio in that network’s own settings as well; for Telegram, revoke the bot’s token in @BotFather.

To exercise any of these, or if a request is refused and you want to challenge it, email privacy@postacio.com. You can also complain to a data protection authority: in Romania that is ANSPDCP (dataprotection.ro), or the authority where you live or work.

Two honest limits, stated plainly because finding them out later is worse.

• A post that has already been published lives on the platform you published it to, under that platform’s own rules and privacy policy. Deleting it in Postacio removes only what Postacio holds - the copy on X, Telegram, Instagram, Facebook, LinkedIn, TikTok or YouTube stays until you delete it there. Postacio has no ability to delete published content on any platform.
• In particular, media published to Instagram through Instagram Login cannot be retracted through the API at all - Instagram exposes no endpoint for it. It has to be removed in the Instagram app itself.

These are the safeguards that protect your data, and in particular the sensitive data Postacio holds: the credentials the platforms issue on your behalf, including Google and YouTube access, and the content you have not published yet.

• Encryption in transit - Postacio is served only over HTTPS (TLS), and browsers are told to refuse a plain connection to it. The app’s connections to its database, and its calls to Google, YouTube and every other platform, are encrypted with TLS as well.
• Encryption at rest - the database and the stored media are encrypted at rest by the providers that hold them (Supabase and Cloudflare R2, see Who else processes it).
• Platform credentials - the access and refresh tokens of the platforms you connect, YouTube included, Telegram bot tokens, webhook secrets and Slack tokens are additionally encrypted by Postacio with AES-256-GCM before they are stored, with a key held outside the database, so a copy of the database alone does not yield a usable token. Each value written is bound to its own account and record. Credentials are left out of data exports and scrubbed from error reports. Postacio does not keep a Google token from signing in with Google; the sign-in session in your browser’s cookies may carry one until it ends.
• Passwords and keys - our authentication provider stores your password only as a hash. Postacio handles a password when you set or change it, or when it checks who you are, and never stores it in readable form. API keys and AI-assistant tokens you create are stored only as one-way hashes, so they cannot be read back.
• Access control - every request for your data is checked against the workspace it belongs to and the permissions of whoever is asking, so one account’s data is not reachable from another’s session. Only the people you invite, in the role you gave them, and the people you send a review link to, can see what you share with them. The database cannot be read through any public interface. Your media is stored under your account, and its ownership is checked before a private file is read or a download link is made.
• Access by the people who run Postacio - limited to operating the service and answering requests you make. Administrator access needs two separate grants. Reading the text of a post or exporting a person’s data needs the administrator to confirm their identity again first, and those reads and every administrative change are recorded in an audit log.
• Keeping as little as possible - Postacio asks each platform only for the permissions it uses, deletes uploaded media 30 days after it is published, and deletes what it read from YouTube on the schedule described above. Deleting your account removes your data immediately (see How long it is kept).
• Checks and response - changes to the code are checked automatically for dependencies with known vulnerabilities and for credentials committed by mistake. Password changes and administrators’ identity checks are limited in how many attempts they allow. If a credential is ever exposed, it is rotated and the affected tokens are revoked at the platform where the platform allows it.

No security is absolute, and we will not pretend otherwise - but if something goes wrong that affects your data, you will hear it from us without undue delay, and the authorities will be told where the law requires it.

If what Postacio stores or who processes it changes, this page changes with it and the date at the top is updated. Material changes are announced in the app rather than made quietly.