Privacy policy

Postfree ("we") processes personal data to provide a social media scheduling service. The controller is the operator of Postfree; contact hello@postfree.app.

Data we process: account data (email, name), workspace content (posts, media, schedules), social network access tokens (encrypted at rest), usage and billing data (via Stripe). We do not sell personal data and do not use your content to train AI models.

Hosting: Google Cloud Platform (EU region). Sub-processors: Google Cloud (hosting, database, storage), Stripe (payments), and the social networks you connect, each under their own terms.

Legal bases: performance of contract (GDPR art. 6(1)(b)), legitimate interest for security and analytics (art. 6(1)(f)), consent for optional AI features (art. 6(1)(a)).

Retention: account data until deletion; posts and media until you delete them or 30 days after account deletion; billing records as required by tax law.

Your rights: access, rectification, erasure, restriction, portability, objection, and complaint to your supervisory authority. Email hello@postfree.app to exercise them; we respond within 30 days.

Social network data. When you connect a social account (X, LinkedIn, Instagram, Facebook, Threads, Bluesky, Mastodon, Telegram, Discord, Reddit, YouTube, TikTok) you authorise Postfree to publish the posts you schedule and to read basic profile information and post statistics. We store the access and refresh tokens the network issues, encrypted with AES-256-GCM, and use them only to publish your scheduled posts, refresh expiring credentials and show analytics inside your workspace. We do not read your private messages, your followers' data or any content you did not schedule through Postfree. Disconnecting a channel deletes its tokens immediately; you can also revoke access from the network's own settings.

Google and YouTube API Services. Postfree uses YouTube API Services to upload the videos you schedule to your own channel and to display your channel's views, likes and subscriber counts. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). The data we obtain through Google APIs is limited to: your channel id, title and avatar; OAuth tokens; and daily analytics figures. Analytics figures are cached for up to 6 hours and then refreshed; tokens are deleted when you disconnect the channel or delete your account. We do not share Google user data with third parties, do not use it for advertising, and do not use it to train AI models. You can revoke Postfree's access at any time at https://security.google.com/settings/security/permissions. Postfree's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok and Meta platforms. For TikTok, Instagram, Facebook and Threads we obtain only the profile fields, tokens and post statistics needed to publish and report on your scheduled posts, under the respective platform policies. Video and image files you upload are stored in our media bucket until you delete them and are fetched by the network at publish time.

Data deletion. Delete any channel from the Channels page, any post from the calendar, and any media from the library at any time. To delete your whole account and all associated data, email hello@postfree.app from the account email; deletion completes within 30 days and is confirmed by email.