Privacy policy

1. Who is responsible

Postrooster is a product of SolwareX, based in the Netherlands. SolwareX is the controller for the personal data described here. Contact: info@postrooster.com.

2. What we collect

Account data: your email address, name and a securely hashed password (or your Google sign-in).

Settings: timezone, language and email preferences.

Content: the posts, captions and media you create or upload, and your AI presets, prompts and generated drafts.

Connected accounts: platform handles, display names, avatars, the permissions you granted and encrypted access tokens.

Technical data: IP address, browser and security logs, and delivery status of the emails we send you.

3. What we access on connected platforms

When you connect an account we receive your basic profile for that platform (handle or page name, display name, avatar) so you can recognise the account in the composer, plus the access token that lets us publish on your behalf. Signed in, you find the same overview in plain language under Permissions in the app. Per platform:

• X: your profile name, handle and picture, and permission to publish the posts and media you compose. X bundles read access with posting, we only use it to confirm a post went out.
• Bluesky: a session created from the app password you enter. The app password itself is exchanged immediately and never stored.
• LinkedIn: your name and profile picture, and permission to publish posts on your personal profile. LinkedIn also passes your email address along with its sign-in permission; we do not store or use it.
• Threads: your username and profile picture, and permission to publish posts (threads_basic, threads_content_publish).
• Facebook: the Pages you manage and select during sign-in, with their names and pictures, and permission to publish posts to those Pages (pages_show_list, pages_read_engagement, pages_manage_posts). Nobody can post to personal profiles through an app, including us.
• Instagram: the username, account type and profile picture of your professional account, and permission to publish the photos, carousels and Reels you compose (instagram_business_basic, instagram_business_content_publish). No Facebook Page is involved.
• TikTok: your display name and avatar, plus your posting settings (who can watch, whether comments, Duet and Stitch are allowed, maximum video length). We fetch those settings right before each post so the composer only offers what TikTok allows for your account. And permission to publish the videos and photo slideshows you compose (user.info.basic, video.publish).
• YouTube: your channel name, handle and picture, and permission to upload the videos you compose, with the title, description and visibility you chose (youtube.upload, plus youtube.readonly to find your channel when you connect).
• Discord: a webhook for the single channel you pick on the consent screen Discord shows, plus your username and the server name to label the connection. We can post to that one channel and read nothing.
• Reddit: your username, and permission to submit text posts to the subreddit you choose per post.
• Telegram: nothing from your personal account. You add our bot as an admin of your channel; we store the channel id, name and picture, and can post there.
• Tumblr: your blog name and avatar, and permission to publish posts to your primary blog.
• Pinterest: your username and picture, your list of boards (so you can pick one per pin), and permission to create pins.
• Mastodon and Pixelfed: your account name and avatar on your instance, and permission to publish posts and upload media.

We only read what is needed to show your accounts and validate posts. We never read your feeds, messages, followers or analytics, and we never publish anything without an action you took in Postrooster.

Data we receive from a platform is used for one thing: giving you the publishing features of Postrooster. We do not sell it, do not share it with data brokers, do not use it for advertising, and do not use it to train AI models.

4. Google and YouTube data

If you sign in to Postrooster with Google, we receive your name, email address and profile picture from Google to create your account, and nothing else.

The YouTube features of Postrooster use the YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy.

From your Google account we access only what is listed above for YouTube. We store your channel id, name, handle and picture plus encrypted access and refresh tokens, and we re-fetch the name, handle and picture from YouTube every 7 days so our copy never goes stale. Disconnecting the channel deletes the tokens, name, handle and picture immediately and asks Google to withdraw the grant; only the channel id stays with your post history, so a reconnect relinks it, until you delete your Postrooster account or ask us to remove it.

The use and transfer of information Postrooster receives from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it and do not use it to train AI models. No human reads it, unless you ask us for support, it is needed for security, or the law requires it.

You can revoke the access at any time on the Google security settings page, or by disconnecting the channel in Postrooster, which deletes the stored tokens and asks Google to withdraw the grant.

5. Why we use it

To run Postrooster: publishing and scheduling on your behalf, showing your calendar and queue, and sending transactional email such as publish-failure alerts and reconnect warnings.

To keep the service reliable and secure, prevent abuse, and comply with legal obligations.

We do not run ads, do not track you across the web, and never sell your data.

6. Legal bases

Performing our contract with you (running the service), our legitimate interest in security and reliability, and your consent where the law requires it, which you can withdraw at any time.

7. Where your data lives

Your data is stored in EU data centers. We use a small set of processors: Supabase (database, authentication, media storage), Vercel (hosting), Resend (transactional email) and OpenAI (AI drafting: only the prompts, presets and draft text you submit when you use the AI assistant, which the OpenAI API terms exclude from model training). The platforms you connect receive only the content you choose to publish there.

Where a processor transfers data outside the EU, it happens under EU-approved safeguards such as Standard Contractual Clauses.

8. Platform access tokens

Access tokens for your connected platforms are encrypted at rest (AES-256-GCM) and never reach your browser.

Disconnecting an account deletes its tokens immediately. Where the platform offers a way to do so (X, LinkedIn, TikTok, YouTube, Reddit, Discord) we also ask the platform to withdraw our access on their side; everywhere else you can remove Postrooster in the settings of the platform itself. The platform id, name, handle and picture of a disconnected account stay stored, so your post history keeps its context and reconnecting the same account restores everything. They are deleted when you delete your Postrooster account, or earlier if you email us.

9. Retention

We keep your data while your account is active. Videos are deleted from our storage as soon as every platform they were meant for has published them; images stay with your post history until you delete the post.

Deleting your account immediately removes your posts, media, AI history, settings, workspaces and tokens; residual copies in encrypted backups roll off within 30 days. Once paid plans exist, we keep the minimal billing records tax law requires.

10. Deleting your data

You never need our help to delete anything:

• One connected account: Settings, Accounts, Disconnect. Its tokens are deleted on the spot.
• Everything: Settings, Profile, Delete account. This permanently removes your posts, media, AI history, settings, workspaces and every connected account with its tokens.
• Removed Postrooster from inside Facebook, Instagram or Threads? Those platforms notify us automatically and we delete or revoke the stored connection, with no action needed from you. The details are on our data deletion page.
• Rather ask us? Email info@postrooster.com from the address on your account and we delete your data within 30 days.

11. Your rights

Under the GDPR you can access, correct, delete and export your data, and restrict or object to certain processing. Most of this works directly from your settings; for the rest, email info@postrooster.com and we respond within 30 days.

You can also complain to your data protection authority, in the Netherlands, the Autoriteit Persoonsgegevens.

12. Cookies

We only set functional cookies: your session, your language preference and the workspace you last used. No advertising or cross-site tracking cookies, so there is no cookie banner to click away.

13. Security

Encryption in transit (TLS) and at rest, row-level security on every database table, encrypted platform tokens and least-privilege access. Found a vulnerability? Tell us at info@postrooster.com and we will respond quickly.

14. Children

Postrooster is not intended for children under 16, and we do not knowingly collect their data.

15. Changes

We post updates to this policy here and note the date at the top. For material changes we notify you by email.

16. Contact

Privacy questions and requests: info@postrooster.com.