Privacy Policy

1. Introduction

Postiify (“we”, “us”, “our”) is a multi-platform social media management tool. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and application (collectively, the “Service”).

2. Information We Collect

We collect information you provide directly to us:

• Account Information: When you register, we collect your email address and a password (stored as a bcrypt hash, never in plain text).
• Profile Information: Display name and avatar that you choose to provide.
• Social Media Tokens: When you connect a social media account (Instagram, YouTube, TikTok, Facebook), we store OAuth access tokens and refresh tokens, encrypted at rest using AES-256-GCM. We never store your social media passwords.
• Content: Videos, images, captions, and other content you upload or create through the Service.
• Usage Data: Information about how you use the Service, including posts published, scheduling activity, and feature usage.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To publish content to your connected social media accounts on your behalf
• To generate AI-powered captions and content suggestions
• To collect and display analytics from your connected platforms
• To send you service-related communications (account verification, password resets, scheduled post notifications)
• To enforce our Terms of Service and protect against abuse

4. Third-Party Services

We integrate with the following platforms using their official APIs:

• Instagram / Facebook (Meta Platforms) — via the Instagram Graph API and Facebook Graph API
• YouTube (Google) — via the YouTube Data API v3. Our use of YouTube API Services is subject to Google's Privacy Policy
• TikTok (ByteDance) — via the TikTok Login Kit and Content Posting API

We only request the minimum permissions (scopes) required to provide our Service. You can revoke access at any time from your social media account settings or from the Postiify settings page.

5. Data Security

• All OAuth tokens are encrypted at rest using AES-256-GCM
• Passwords are hashed with bcrypt
• All API communication uses HTTPS/TLS
• We use JWT tokens with short expiration for session management

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data, uploaded media, and revoke all stored OAuth tokens within 30 days. Aggregated, anonymized data may be retained for analytics purposes.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Disconnect any social media account at any time
• Export your data

If you are located in the European Economic Area, you have additional rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

8. Cookies

We use essential cookies and local storage to maintain your session and remember your preferences. We do not use third-party tracking cookies or advertising cookies.

9. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at contact@postiify.com or through our Discord community.