Privacy Policy

1. What We Collect

• Account data — name, email, and avatar from your sign-in method (Google or X); your Posty settings; your connected X handle and profile info.
• X authorization data— OAuth tokens granted through X’s official consent, stored encrypted server-side. We never see or store your X password.
• Material you provide — text, images, notes, and other raw material you hand to Posty to inform your content; your chats with the agent.
• Drafts and publishing data — drafts the agent prepares, your published-post history, and performance metrics of your posts.
• Reference material — public posts from accounts you select or from your niche, saved with source attribution for your use inside the Service.
• Feed-derived suggestions — in the desktop app, your own logged-in X session reads your own For-You/Following feeds at human scale to suggest engagement. We do not bulk-scrape third parties.
• Billing data — subscription status, plan, and transaction records from our merchant of record. Card numbers are handled by Lemon Squeezy and never reach our servers.
• Usage and device data — product analytics events, app/browser type, approximate location from IP, diagnostic logs, and cookies (see Section 8).

2. Why We Use It

• Operate the Service — generate drafts, study the reference accounts you select, schedule and publish with your authorization, and read/write on your X account within the scopes you granted.
• AI processing — send relevant content (drafts, chats, your material, account context) to the AI providers in Section 3 to produce the output you asked for.
• Account and billing — authentication, subscriptions, receipts.
• Service integrity — preventing spam, abuse, and security incidents.
• Improvement — analytics and debugging. Legal — complying with law and enforcing our Terms.

Legal bases (GDPR/UK GDPR): performance of contract, legitimate interests (security, abuse prevention, product analytics), consent where required, and legal obligation. We do not sell personal data. We access AI providers through their APIs under terms that prohibit using your data to train their models, and we do not train models on your content ourselves.

3. Service Providers

These providers process data on our behalf to run the Service:

We may update this list as the Service evolves; material changes will be reflected here.

4. How We Handle Your X Data

• Tokens — stored encrypted server-side; used only within the scopes you granted.
• What we read — your profile, your posts and their metrics, your own feeds via your own logged-in session in the desktop app, and public posts of accounts you select for study.
• What we write — posts, replies, and quotes, only with your authorization, published from your own device.
• What we never do — bulk-scrape third parties, harvest credentials, or access your X password.
• Revocation— disconnect your X account anytime in the app (or via X’s connected-apps settings); we delete our stored tokens.

5. Retention

• Account data, drafts, history, chats, reference material — kept while your account is active.
• X OAuth tokens — deleted on disconnect or account deletion.
• Billing records — kept as required by applicable tax and commerce law (generally up to 5 years); most billing records are held by our merchant of record.
• Deleted data may persist in encrypted backups for up to 30 days before being purged.

6. Deletion

You can disconnect X at any time (we delete stored tokens), and you can request full account deletion in-app or by emailing hi@posty.chat. We delete your account data within 30 days, except records we must keep by law (for example, billing).

7. Your Rights

• Everyone — you may access, correct, export, or delete your data by contacting us; we respond within the timelines applicable law requires.
• EEA/UK (GDPR) — rights of access, rectification, erasure, restriction, portability, and objection; the right to withdraw consent; and the right to complain to your supervisory authority.
• California (CCPA/CPRA)— rights to know, delete, correct, and opt out of “sale”/“sharing.” We do not sell personal information and do not share it for cross-context behavioral advertising.
• Korea (PIPA) — rights to access, correct, delete, and suspend processing of personal information under the Personal Information Protection Act.

We may need to verify your identity before acting on a request.

8. Cookies and Analytics

• Essential — sign-in and security cookies required for the Service to work.
• Product analytics — PostHog, for signed-in product usage (events, device info, approximate location from IP).
• Marketing-site analytics — privacy-friendly, cookieless page-view measurement on posty.chat.

You can control cookies in your browser settings; blocking essential cookies may break sign-in.

9. Children

The Service is for adults. You must be 18 or older. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete it.

10. International Transfers

We operate globally and our providers process data primarily in the United States. Where data is transferred across borders (for example, out of the EEA/UK or Korea), we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK Addendum, and — where a provider is certified — the EU–US Data Privacy Framework.

11. Security

We use industry-standard measures: encryption in transit (TLS), encrypted storage of X OAuth tokens and backups, access controls, and least-privilege service credentials. No system is perfectly secure; if a breach affects your data, we will notify you and regulators as required by law. We will only access your account content to help you with a problem you have raised or to fix a fault, never to browse it.

12. Changes to This Policy

We may update this Policy. For material changes we will notify you (for example, by email or in-app) before they take effect. The date at the top reflects the latest version.

13. Contact

Posty (sole proprietorship, Republic of Korea) · hi@posty.chat