Privacy Policy

The short version

• Postard is a workspace for creators, businesses and agencies to plan, review and schedule Instagram and Threads content. To do that it stores your account email, the drafts, posts and images you save, and an access token for each social profile you connect.
• Social access tokens are encrypted before they are stored. Only Postard’s server-side code (the API and its background jobs) can decrypt them. They are never shown in the app, returned by the API or exposed to AI clients.
• An AI assistant can read nothing in your workspace unless you approve it and choose the workspaces to share. You can revoke that access at any time.
• Postard contains no advertising and does not sell personal data.
• Public pages set no cookies. Cookies are used only to keep you signed in and to finish steps such as confirming your email.
• You can ask to see, correct or delete your data. See how to request deletion.

Who is responsible for your data

Postard is operated by Gonçalo Raposeiro, Rua de Bissau, 7C, Sala 9, 2685-313 Prior Velho, Portugal. In this policy, “Postard”, “we” and “us” mean that operator.

For privacy questions or requests, write to support@postard.app. We reply within response time pending.

What we collect and why

Account and sign-in

• Your email address and password. Sign-in is handled by Supabase Auth, which stores passwords only in hashed form.
• Technical details of sign-ins and sessions that Supabase Auth keeps, such as time, IP address and browser type.
• Your latest sign-in: its time, an approximate location (city and country, worked out from your IP address by our hosting provider) and the device type (phone, tablet or computer, worked out from your browser). Only the latest sign-in is kept, and the next sign-in replaces it.
• If you create an account from the free content planner, Postard notes that as where you signed up.
• Why: to create your account, keep it secure, sign you in and show you your latest sign-in under account security and, if you turn on sign-in alerts, in the alert email.

Your workspace content

• Workspace names, members and their roles, and invitations (invitee email address, role and expiry).
• Drafts and posts: title, text, schedule and time zone, the profiles you selected, delivery status and error codes.
• Images: file name, size and dimensions. After you upload an image, Postard converts it to a JPEG with its metadata removed and keeps that copy in private storage. The original upload is deleted once processing succeeds. An upload that is never completed or is rejected can stay in storage until it is cleaned up; there is no automatic clean-up.
• Why: to store, review, schedule and publish your content and to let teammates work together. Members of a workspace can see its content according to their role.

Connected Instagram and Threads profiles

• The network, profile ID, username, the permissions you granted, when the token expires, and the access token itself, which is encrypted (AES-256-GCM) before it is stored.
• Profile metrics Meta returns, saved with the time of each sync: follower and post counts for Instagram, and views, likes, replies, reposts and quotes for Threads.
• The ID and delivery state of posts Postard publishes for you.
• Why: to publish what you schedule and to show status and analytics for your profiles.

API keys and AI client access

• For each API key: its name, a short visible prefix, a one-way hash (the secret itself is shown once and never stored), its permissions and when it was created, last used or revoked.
• Monthly counts of successful API and MCP calls per workspace, and short-lived per-minute counters, to apply plan limits and prevent abuse.
• When a draft is saved through an API key or an AI client, a copy of the request and the response, including the draft’s title and text, is kept so a retry cannot create a duplicate.
• Records of AI client approvals: which client, which workspaces, which permissions and when the approval expires. A URL-only connection (see AI assistants below) also needs OAuth records that Postard keeps in a separate part of its database: a placeholder account entry that holds only your internal account ID, the client’s registration (its name and callback addresses), your consent, and the connection’s sessions and tokens. Tokens are stored hashed.

Email

• Your email preferences, and a queue of messages Postard sends you (a welcome notice, workspace invitations, alerts about posts or connections that need attention, and sign-in alerts and weekly summaries if you opt in). The queue keeps the recipient, the message content and the delivery result so a failed send can be retried safely.
• Account confirmation and password-reset messages are sent by Supabase Auth through the email provider set up for it.
• Delivery events from our email provider (delivered, bounced, complained). For addresses that bounced or complained, a one-way hash of the address is kept so we stop sending to it.
• Weekly summaries and sign-in alerts are off until you opt in. Product notices are on by default. You can change all three in your email preferences.

Billing

• You can create an account without payment details. If you start checkout, Paddle collects payment and billing details to process your trial or subscription. Postard does not receive your full card number.
• Postard keeps your plan, subscription status, billing interval, access end date, whether the plan is set to end, payment provider identifiers, checkout attempts and trial history. We use this information to confirm access, manage billing and prevent trial abuse.

Support messages

• If you email us, we keep your message, your address and our replies so we can help you and follow up.

Technical data and analytics

• Our hosting providers keep standard technical logs, such as IP address, request time and browser details, to run and secure the service. Postard’s own services log fixed status messages and do not write post content, tokens or email text to their logs.
• When an AI assistant starts a URL-only connection, a one-way hash of the IP address of the request is kept with an attempt counter to limit repeated attempts. It is cleared once it is more than a day old, as later requests arrive.
• Vercel Web Analytics and Speed Insights measure visits and performance on public pages when enabled. Pageviews are recorded without query strings or fragments. They are skipped when your browser sends a Do Not Track or Global Privacy Control signal. Vercel states that Web Analytics uses no cookies and identifies visitors with a hash that resets daily.
• The free content planner runs in your browser. Your answers are not sent to Postard.

Why we may process your data (EEA and UK)

If the GDPR or UK GDPR applies to you, we rely on these legal bases:

• Contract: to provide the workspace, publishing, API and notifications you ask for.
• Legitimate interests: to keep Postard secure, prevent abuse, apply plan limits, fix problems and send service notices.
• Consent: when you approve an AI client, connect a social profile, or opt in to weekly summaries or sign-in alerts. You can withdraw consent at any time; this does not affect earlier processing.
• Legal obligation: where the law requires us to keep or share information.

Instagram and Threads (Meta)

You connect a profile by signing in on Instagram or Threads and approving Postard there. Postard never sees your Instagram or Threads password. These are the permissions Postard requests:

• Instagram: instagram_business_basic, instagram_business_content_publish. They let Postard read basic details of your Instagram professional account and publish content to it.
• Threads: threads_basic, threads_content_publish, threads_manage_insights. They let Postard read basic details of your Threads profile, publish to it and read its insights.

Postard stores the permissions you actually granted. It uses data from Meta only to confirm your profile, publish the posts you schedule and show the metrics described above. It does not use that data for advertising and does not sell it. When a scheduled post is delivered, Meta downloads its image from a short-lived link that Postard creates at that moment.

You can stop this at any time. Select Disconnect on the Profiles page in Postard to delete the stored token, profile record and metrics, and remove Postard from the connected apps in your Instagram or Threads account settings to withdraw the permission on Meta’s side. Data that Meta holds is governed by the Meta Privacy Policy and the Meta Platform Terms.

AI assistants (MCP)

Postard does not send your content to an AI model on its own. You may choose to connect an AI assistant, such as Claude, ChatGPT or Cursor, through the Model Context Protocol (MCP). Nothing is shared until you approve the connection on Postard’s consent screen, where you choose which workspaces to share and whether the assistant may also save drafts.

• What the assistant learns about you depends on how it connects. A URL-only connection asks for workspace:read and offline_access: permission to read the workspaces you choose and to stay connected. The assistant sees an internal account ID, not your email address.
• A connection through a registered Supabase OAuth client (the older method) also asks for the identity permissions email and profile. They give the assistant, and the company that provides it, the email address and basic profile of your Postard account.
• A connected assistant can read the names of the workspaces you shared, the names and health of connected profiles (never credentials), saved profile metrics and up to 50 recent drafts. If you allowed it, it can also save a new draft.
• It cannot publish, schedule or delete anything, and it cannot manage social credentials.
• Access expires after 30 days. You can revoke it earlier under Settings, AI connections.

Once information reaches an AI assistant, that assistant’s provider handles it under its own terms and privacy policy. Postard does not control that.

Who we share data with

We share personal data only as needed to run Postard, and we do not sell it:

• Other members of a workspace see its content according to their role. The workspace owner decides who is invited.
• The providers below help us run Postard. Paddle handles checkout data under its privacy notice as merchant of record. For earlier purchases, the payment provider listed on your receipt handles its payment records under its own privacy policy. When you connect a social profile or AI tool, its provider also handles data under its own privacy terms.
• Authorities or others, where the law requires it or where needed to protect people’s safety or Postard’s rights.

Scheduled publishing and email delivery are designed to run as background jobs that Supabase Cron starts on Postard’s API on Vercel, so they use the providers above and need no separate queue or worker host. If we add one, we will list it here.

Where your data is stored

The Postard database and uploaded images are stored with Supabase in Frankfurt, Germany. The website and API run in Frankfurt on Vercel. Public pages can be cached on Vercel’s global network.

Some providers are headquartered outside the EEA and the UK, or process data in other countries (for example, Meta and billing providers). Where personal data leaves the EEA or the UK, the transfer relies on the safeguards the provider offers, such as standard contractual clauses. Write to us if you want details.

How long we keep data

• Account and workspace content is kept while your account is active. You can delete drafts yourself. Posts and uploaded images cannot be deleted in the app; ask us to remove them.
• A connected profile’s token, record and metrics are deleted as soon as you disconnect it.
• AI client approvals and their refresh tokens are valid for 30 days (access tokens for a few minutes), workspace invitations for 7 days, and a social connection attempt for 10 minutes. After that they can no longer be used, but the records are not deleted automatically. They stay until you revoke the approval, the related account or workspace is deleted, or you ask us to remove them.
• When a draft is saved through an API key or an AI client, the copy of the request and response kept for safe retries (including the draft’s title and text) is not deleted automatically, and deleting the draft in the app does not remove it. It is deleted with the workspace or on request.
• Email records and usage counters do not expire automatically. They are deleted when the related account or workspace is deleted, or earlier on request.
• Your latest sign-in record is replaced at your next sign-in and deleted with your account.
• Copies in provider backups and logs are removed on the provider’s own schedule.
• Payment providers retain billing records for the period required by applicable law and their published retention policies.

To delete your data sooner, follow the steps on the data deletion page.

How we protect data

• Workspace data is separated by workspace. The website reads it as the signed-in user, limited by database row-level security, and never holds an administrator database key. The API checks your identity and role before it performs a privileged action.
• Social access tokens are encrypted at rest. API key secrets are stored only as hashes.
• Uploaded images live in a private bucket. Previews and delivery use short-lived signed links.
• Access is role-based, API and AI client use is rate limited, and you can turn on sign-in alerts to hear about new sign-ins.
• No system is perfectly secure. If you find a security problem, please tell us through the support page.

Cookies and similar technologies

Public pages set no cookies. After you sign in, sign up or ask for a password reset, Postard sets only the cookies it needs to keep you signed in securely and to finish the step you started:

• sb-…-auth-token (it may be split into numbered parts). Keeps you signed in and lets Postard check who you are on each request. Set when you sign in or create an account. Removed when you sign out. Your browser may keep it for up to 400 days.
• sb-…-code-verifier (names include “code-verifier”). Helps complete an email confirmation or password-reset link securely in the browser that started it. Set only when you start one of those steps. Cleared when that step completes. If you abandon the step, it stays until it expires or you clear your cookies.
• postard-mcp-signup. Remembers the AI connection request you were approving, so you can finish it after confirming your email. Set only when you create an account from an AI client’s connection request. Scripts on the page cannot read it. Cleared when you confirm your email, and expires after 15 minutes.

Postard does not use advertising or cross-site tracking cookies.

Your choices and rights

In the product you can already:

• edit or delete your drafts and cancel a scheduled post;
• disconnect a social profile (Profiles) and revoke AI client access (Settings, AI connections);
• revoke API keys (Developer access);
• change or stop optional emails (email preferences, or the unsubscribe link in each optional email);
• sign out, which removes the session cookie from your browser.

You can also ask us to give you access to your data, including a copy, to correct it, to delete it, or to restrict or object to its use, and you can withdraw consent where we rely on it. If you are in the EEA or the UK you may complain to your local data protection authority. In Portugal you can contact the Comissão Nacional de Proteção de Dados. Residents of some US states have similar rights. Write to support@postard.app from the email address on your account and we will reply within response time pending. We may ask you to confirm your identity first. We will explain if we cannot do what you ask.

Children

Postard is a business tool and is not directed to children. Instagram and Threads set their own minimum ages.

Changes to this policy

We will post any updated version on this page and change the effective date above. This version took effect on effective date pending.

Contact

Your support contacts are Gonçalo Raposeiro and Yaroslav Levchenko.

Gonçalo Raposeiro
Rua de Bissau, 7C, Sala 9 2685-313 Prior Velho Portugal

Email: support@postard.app. See also the support page and the Terms of Service.