Privacy Policy

What we collect

We keep only what we need to run the service:

• Account details — your email, and your name if you sign in with Google.
• Your brand profile — the business details, tone, and assets you give us or we detect, used to generate on-brand posts.
• Connected social accounts — a reference to each account and an access token so we can publish on your behalf. We never see or store your social passwords.
• Content — the posts and media you create, generate, schedule, or publish.
• Billing & usage — your credit balance and the records needed to run credits and spending limits. Card details are handled by our payment provider, not by us.
• Support messages — anything you send us through the contact form.

How we use it

To create and publish your content, learn your brand voice, run your credits and spending caps, send you account and notification emails, provide support, keep the service secure, and improve how it works. We do notsell your data, and we don't use your private content to train our own models.

Service providers we share data with

We use a small set of trusted providers to operate Postlefy. Each receives only the data needed for its role:

• Supabase — database, authentication, and encrypted storage of your account, profile, app data, and the access tokens for your connected social accounts.
• Google (Gemini) — generates post text and images from your brand details and prompts.
• Lemon Squeezy — our payment provider and merchant of record; processes purchases and stores card details.
• Resend — sends transactional and notification emails.
• Vercel — hosts the app.
• Google Analytics and Microsoft Clarity — privacy-friendly usage analytics, loaded only after you accept the cookie banner.

Social account access

We connect to social platforms only through their official APIs, and we never store your social media account passwords. Most platforms — such as Instagram, Facebook, and LinkedIn — use OAuth: you authorize Postlefy on the platform's own login screen and we receive a secure access token, never your password. A few open-protocol platforms (such as Bluesky) instead use an app password — a separate, limited, revocable credential you generate, not your main account password — which is used only to establish the connection and is not stored by us.

We request only the permissions needed to publish the posts you schedule, store a reference to the connected account, and use the access token solely to post on your behalf. You can disconnect any account at any time, which revokes that access and stops us posting to it.

Any data we access through a platform's API is handled in line with that platform's developer policies, and your use of each platform remains subject to its own terms — this includes Meta (Instagram, Facebook, Threads), X, LinkedIn, TikTok, Pinterest, and Bluesky. Where Postlefy connects Google services (such as YouTube), our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell platform data or use it for advertising, we keep it only while the account stays connected, and we remove it when you disconnect the account or delete your Postlefy account.

Specifically for YouTube: Postlefy uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. Postlefy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

AI-generated content

Posts are drafted with AI. To do that, your brand details and prompts are sent to our AI provider to generate text and images. You can review and edit anything before it's published.

Analytics & cookies

Analytics only run after you accept the cookie banner, and you can decline — the app works either way. They help us understand usage so we can improve the product; they don't identify you to third parties for advertising.

Data retention

We retain your data while your account is active and for a reasonable period afterward where required for legal, accounting, fraud-prevention, or security purposes. Deleting your account removes your data and revokes connected tokens, subject to those limited retention needs. See our Data Deletion page for step-by-step instructions.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Export your data in a portable form.
• Delete your data and account.
• Withdraw consent where processing is based on consent (e.g. analytics).

You can do most of this from your account settings, or by contacting us.

Security

We use industry-standard security measures including encryption in transit and at rest (access tokens are encrypted before they are stored), row-level access controls, and secure infrastructure. No system is perfectly secure, but we work to protect your data.

International data transfers

Your data may be processed in countries other than your own through our service providers. Where that happens, we rely on those providers' safeguards for handling personal data.

Legal basis for processing

Where applicable (e.g. under GDPR), we process information to provide the service, to comply with legal obligations, to pursue legitimate business interests, and — where required — based on your consent.

Children

Postlefy is for business use and isn't intended for anyone under 16.

Changes

We may update this policy as the product evolves. We'll change the date above when we do; significant changes will be highlighted in the app or by email.

Contact

Questions about your data, or want to exercise a right above? Get in touch through our contact form.