Privacy Policy

What we collect

• Account details: your name, email address, timezone, and a one-way hash of your password.
• Connected social accounts: when you connect X, LinkedIn, Facebook, Instagram, Threads, Pinterest, YouTube, TikTok, Bluesky or Mastodon, we receive and store the access tokens that network issues, plus your account's ID, name, username and profile picture. For Pinterest we also store the names and IDs of your boards so you can choose where to pin. Tokens are encrypted at rest.
• Your content: the posts, images, videos and ideas you create in Postly, and their schedule.
• Payments: paid plans are processed by Razorpay, Stripe or PayPal. We store the plan, amount, status and the payment's reference ID. We never receive or store your card, UPI or bank details.
• Technical data: your IP address, used briefly to rate-limit sign-in attempts and protect accounts.

How we use it

• To publish the posts you schedule, at the times you choose, to the accounts you connected.
• To show which account is connected and whether a post succeeded.
• To run your subscription and send service emails such as failed-post alerts and renewal reminders.

We only read data from your social accounts that we need to publish for you (your basic profile, and for Pinterest your boards). We do not read your feed, followers or messages, we do not sell your data, and we do not use it for advertising.

Who we share it with

• The social networks you connect, when we publish your posts to them.
• Your payment provider (Razorpay, Stripe or PayPal), to process payments.
• Infrastructure providers that host our servers, database, file storage and email, under confidentiality obligations.
• Authorities, where the law requires it.

Keeping and deleting your data

Disconnecting a channel in Postly deletes its stored tokens and its scheduled posts immediately. Posts already published stay on the social network; delete them there if you want them gone. Removing Postly from your Facebook, Instagram or Threads settings also revokes our access. To delete your whole Postly account and everything in it, email soepicappsdeveloper@gmail.com from your account's email address and we will do so within 30 days.

Security

We encrypt connected-account tokens with AES-256-GCM, store passwords only as salted hashes, and serve the app over HTTPS. No system is perfectly secure, but we work to protect your data and will notify you of any breach that affects it.

Contact

Questions about this policy: soepicappsdeveloper@gmail.com. We will post any changes on this page and update the date above.