Privacy Policy

This policy explains what Postlite collects, why we collect it, who helps us process it, and how you can see or delete it. Postlite is run from Ontario, Canada, and follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

• Account details: your name, email address and account ID from the Apple, Google or X account you sign in with. If you use Apple's Hide My Email, we only see the relay address. We never see your password.
• Connected social accounts: when you connect a profile, we store its account ID, handle, display name, profile link, account type, follower count and the access tokens the platform gives us. We copy its profile photo to our storage so it shows in the app. Tokens are encrypted at rest.
• Your content: drafts, threads, scheduled posts, media you upload, keywords you set for editors, and the results of posts we publish for you (post IDs and links).
• Posts we read for you: mentions of your connected accounts and public posts that match your keywords, so you can review them and choose whether to reply.
• Slop Check reports: when anyone enters a public handle, we fetch up to 40 recent public posts from that account, score them, and keep the report so repeat checks do not call the platform again.
• Browser extension: the extension reads the text of posts on the page you are viewing and sends it to us to score. We keep only a one-way hash of the text and its score, for up to an hour, to avoid scoring the same post twice.
• Billing: Stripe handles payments. We store your plan, credit balance and Stripe customer ID. We never see or store your card number.
• API tokens: if you create one, we store only a hash of it, its name and when it was last used. Drafts sent through the API are handled like drafts you write in the app.
• Calendar link: if you create one, anyone with the link can read your scheduled and posted items. We store only a hash of the link. Reset or turn it off on the Calendar page.
• Notifications: if you turn on notifications, we store the push address your browser vendor gives your device, its encryption keys and a short device label. We delete them when you turn notifications off on that device.
• Usage and security data: IP address, request counts and error logs, used to enforce rate limits and keep the service running.

How we use it

• To publish and schedule posts you write or approve.
• To score your writing and draft replies and posts for you to review.
• To show you mentions and matching posts you may want to answer.
• To bill you, track credits and enforce plan limits.
• To keep accounts secure and stop abuse.

We do not sell your data, share it for advertising, or use it to build profiles for anyone else. We never post, reply, like or follow on your behalf without your action, unless you turn on Publish without review for an editor.

Who processes it

We use these providers to run Postlite. Each only gets what it needs for its task.

• Supabase (database, sign-in and file storage, hosted in Canada)
• Vercel (web hosting, United States)
• Anthropic (AI drafting; receives post text and your drafts, United States)
• TypeSafe AI (writing scores; receives post text)
• Stripe (payments)
• Upstash (rate limits and short-lived caches)
• OpenAI (only if we route a drafting task to it; receives the same text as Anthropic, United States)
• Google Cloud (AI cover images; receives the title and text of the draft you make a cover for, United States)
• Apple, Google and X (sign-in, if you choose them)
• Apple, Google and Mozilla push services (deliver notifications you turn on; receive the notification title and a short message)
• X, Threads and Bluesky (the platforms you connect or check; we use their official APIs)

Some providers store data outside Canada, so it may be subject to the laws of those countries. Anthropic does not train its models on data sent through its API.

X data

We use the X API under X's Developer Agreement and Policy. We only request the permissions we need: reading your profile, reading posts and mentions, and publishing posts you approve. You can revoke Postlite's access at any time in X under Settings, Security and account access, Apps and sessions, Connected apps. When you disconnect, we delete your stored tokens.

YouTube and TikTok data

Postlite uses YouTube API Services. When you connect YouTube, we read your channel name, handle, photo and subscriber count, upload videos only after you approve them, and read view counts and YouTube Analytics (watch time, average percentage viewed, subscribers gained) for videos you posted through Postlite, so we can show you how each one did next to its score. By connecting YouTube you also agree to the Google Privacy Policy. You can revoke Postlite's access at any time at security.google.com/settings/security/permissions. When you connect TikTok, we read your display name, avatar and follower count, publish videos you approve, and read view, like, comment and share counts for videos you posted through Postlite. You can revoke access in the TikTok app under Settings and privacy, Security, Apps and services. When you disconnect either account, we delete your stored tokens, photo and profile details at once, and we delete other YouTube data we hold within 30 days.

Instagram and Threads data

When you connect Instagram, we read your username, name, profile photo, account type and follower count, and publish posts, Reels and Stories only after you approve them. When you connect Threads, we read your profile, publish posts you approve, read replies and mentions of your posts so you can answer them in Postlite, post replies you approve, and search public Threads posts for keywords you choose. We do not sell this data or use it for ads.

You can remove Postlite at any time: in Instagram under Settings and activity, Website permissions, Apps and websites; in Threads under Settings, Account, Website permissions; or by disconnecting the profile in Postlite. When you remove Postlite on Instagram or Threads, Meta tells us and we delete your stored tokens, photo and profile details for that account at once. You get a confirmation code, and you can check its status at postlite.app/data-deletion/ followed by that code. To delete everything else, delete your Postlite account in Settings or email us at the address below.

How long we keep it

• Account data and content: until you delete your account.
• Access tokens: until you disconnect the account or delete your Postlite account.
• Profile photos and details: until you disconnect the profile or delete your Postlite account. We refresh them about once a week.
• Slop Check reports: until the account owner asks us to remove them.
• Security logs: up to 90 days.
• AI usage records (task, token counts and cost, no content): kept for billing and cost tracking, and unlinked from you when you delete your account.
• Billing records: as long as tax law requires, usually 6 years in Canada.

Cookies

We use cookies only to keep you signed in and secure. We do not use advertising or tracking cookies.

Your rights

You can ask us to:

• show you the personal data we hold about you;
• correct it;
• delete your account and data (you can also do this yourself in Settings);
• remove a Slop Check report about your public account;
• withdraw consent, which may mean we can no longer offer some features.

Email privacy@postlite.app from the address on your account. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. People in the EU, UK or California have the same rights under their local laws.

Security

We encrypt access tokens, use HTTPS everywhere, and limit who can reach production data. No system is perfectly secure. If a breach puts your data at real risk of significant harm, we will tell you and the Privacy Commissioner as the law requires.

Children

Postlite is not for anyone under 16. We do not knowingly collect data from children.

Changes

If we change this policy in a way that matters, we will email account holders before the change takes effect. The date at the top shows the latest version.

Contact

Questions or requests go to our Privacy Officer at privacy@postlite.app. We reply within 30 days.