Privacy Policy

Information we collect

• Account information. Your email address and a securely hashed password when you create an account.
• Connected channel data. When you connect a social account, we receive OAuth access and refresh tokens and basic account/channel identifiers (e.g. your YouTube channel name and ID) from that platform.
• Content you create. The templates, projects, collections, media you upload, and the campaigns and post copy you configure.
• Usage and technical data. Logs needed to operate the Service, such as render status and publishing results.

Google and YouTube data

When you connect a YouTube channel, you grant Postleet access through Google OAuth to the following scopes:

• youtube.readonly — to read your YouTube channel name and ID so we can display the connected channel and attribute uploads correctly.
• youtube.upload — to upload the videos you choose to publish, on your behalf, to your channel.

Postleet uses YouTube API Services. By using this feature you also agree to the YouTube Terms of Service, and your data is handled in accordance with the Google Privacy Policy. We only access this data to provide the features you explicitly request — connecting your channel and publishing videos you initiate. We never use it for advertising, and we do not sell it.

You can revoke Postleet’s access to your Google account at any time via your Google Account security settings, or by removing the channel from within the Service.

Limited Use disclosure

Postleet’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving advertisements, and we do not allow humans to read this data unless we have your explicit consent, it is necessary for security or to comply with applicable law, or the data has been aggregated and anonymized.

How we use information

• To authenticate you and operate your account.
• To render videos from your templates and publish them to the channels you connect, when you initiate it.
• To optionally generate or rewrite titles, descriptions, and captions using AI providers, when you use those features.
• To maintain, secure, troubleshoot, and improve the Service.

How we store and protect data

OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being stored in our database. Passwords are stored only as salted hashes. Access to production systems is restricted. While no system is perfectly secure, we take reasonable technical and organizational measures to protect your information.

Sharing and third parties

We do not sell your personal information. We share data only as needed to run the Service:

• The platforms you connect (e.g. YouTube, Facebook) — to publish the content you choose to publish.
• AI providers (e.g. OpenAI) — only the text you submit for caption or title/description generation, when you use those features.
• Infrastructure providers — hosting, storage, and database services used to operate the Service.
• Legal — where required to comply with law or protect rights and safety.

Data retention and deletion

We retain your data while your account is active. You can disconnect any channel at any time, which removes its stored tokens. To delete your account and associated data, contact us at [email protected]. Revoking access in your Google Account settings immediately invalidates the tokens we hold for that connection.

Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. To exercise these rights, contact us at [email protected].

Children

The Service is not directed to children under 13, and we do not knowingly collect data from them.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate we will provide additional notice.

Contact

Questions about this policy or your data? Email us at [email protected].