Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains how Postinger ("Postinger", "we", "us") collects, uses, shares and deletes information when you use our website, web app, API, CLI and MCP server (together, the "Service"). By using the Service you agree to this policy. If you do not agree, please do not use the Service.

1. Who we are

Postinger is operated by Tuna Öcal, an individual based in Türkiye, who is the data controller for the personal data described in this policy. You can reach us at support@postinger.dev.

2. Information we collect

2.1 Account information

When you sign up we collect your name, email address and profile picture, either directly or from the provider you sign in with (for example Google). Authentication is handled by Clerk.

2.2 Connected social media accounts

When you connect a social media account (such as Instagram, Facebook, TikTok or YouTube), you authorize Postinger through that platform's official login. We then receive and store:

  • OAuth access and refresh tokens, and the permissions (scopes) you granted. Tokens are encrypted at rest.
  • Account details such as your account or Page ID, username, display name, profile picture and account type.
  • Performance data for the posts you publish through Postinger and for your account, such as reach, impressions, views, likes, comments, shares, saves and follower counts.

We only request the permissions needed for the features you use: publishing content you create or schedule, listing the Pages or accounts you choose to connect, and showing you analytics. We do not read your direct messages, and we do not collect data about your followers as individuals.

2.3 Content you create

We store the posts you draft, schedule or publish, including captions, images and videos you upload, publishing times and the result of each publishing attempt.

2.4 Billing information

Payments are processed by Polar, which acts as our merchant of record. Polar collects your payment details; we never see or store your full card number. We receive your subscription status, plan and billing email.

2.5 Technical and usage data

We collect logs needed to run and secure the Service, such as IP address, browser type, API requests, API key usage and error reports. If you contact us through the in-app chat or by email, we keep that conversation.

3. How we use information

  • To provide the Service: publishing and scheduling your posts and showing you analytics.
  • To keep your connections working, for example refreshing tokens before they expire.
  • To process payments and manage your subscription.
  • To secure the Service, prevent abuse and enforce rate limits.
  • To provide support and send service messages such as billing notices or connection problems.
  • To comply with legal obligations.

We do not sell your data. We do not use data received from connected platforms for advertising, and we do not use it to train AI models.

Under the GDPR and Türkiye's Personal Data Protection Law No. 6698 (KVKK), we rely on the following legal bases: performance of our contract with you, our legitimate interest in operating and securing the Service, your consent where it is required, and compliance with legal obligations.

4. AI agents, API and MCP access

Postinger lets you connect your own AI agents and tools through our API, CLI and MCP server. When you do, the agent can read and act on your workspace data according to the access you give it. Data sent to your agent is then processed by that agent's provider under your own agreement with them. You can revoke an API key or connected app at any time from your settings.

5. How we share information

We share information only with:

  • The social platforms you connect, to publish content on your behalf and to fetch your analytics. Their own privacy policies apply to the content once it is on their platform.
  • Service providers that run parts of the Service for us, under contracts that limit their use of your data:
    • Clerk: authentication and account management
    • Supabase: database hosting
    • Amazon Web Services: application hosting
    • Cloudflare (R2): media file storage
    • Polar: payments and subscriptions (merchant of record)
    • Unkey: API key management
    • Sentry: error monitoring
    • Crisp: customer support chat
  • Members of your workspace, who can see the projects, posts and analytics you share with them.
  • Authorities, when required by law, or to protect our rights and the safety of users.
  • A successor, if Postinger is sold or merged. We will notify you before your data becomes subject to a different privacy policy.

6. Platform-specific terms

Meta (Instagram and Facebook)

Data we receive from Instagram and Facebook is used only to provide the features described above and is handled in line with the Meta Platform Terms. You can remove Postinger's access at any time from Facebook Settings > Business Integrations, or from Instagram Settings > Apps and Websites.

YouTube and Google

Postinger uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can revoke Postinger's access at any time from your Google security settings. Postinger's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok

Content you publish to TikTok through Postinger is also subject to TikTok's terms and privacy policy. You can remove Postinger's access from your TikTok app settings.

7. Data retention

  • Account data is kept while your account is active.
  • Access tokens are deleted immediately when you disconnect an account in Postinger or when the platform tells us you removed our access.
  • Posts, media and analytics are kept while your account is active, or until you delete them.
  • Error logs are kept for up to 90 days.
  • Billing records are kept by Polar for as long as tax and accounting laws require.

When your account is deleted, we delete or anonymize your personal data within 30 days, except where we are legally required to keep it. Residual copies in backups are overwritten in the normal backup cycle.

8. How to delete your data

You can disconnect an account in Postinger, remove our access from the platform, or ask us to delete your account and all its data. Step-by-step instructions are on our Data Deletion page.

9. Security

All data is encrypted in transit with TLS. Access tokens are encrypted at rest, and access to production systems is limited. No system is perfectly secure, but we work to protect your data and will notify you of a breach that affects you as required by law.

10. Your rights

Depending on where you live, including under the GDPR and KVKK, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. To exercise these rights, email support@postinger.dev. We respond within 30 days and may ask you to verify your identity. You may also complain to your local data protection authority, which in Türkiye is the Personal Data Protection Authority (KVKK).

11. International transfers

Our service providers may process data in countries other than yours, including the European Union and the United States. Where required, these transfers are protected by safeguards such as Standard Contractual Clauses.

12. Cookies

We use cookies that are needed for the Service to work, such as keeping you signed in and running the support chat. We do not use advertising or cross-site tracking cookies.

13. Children

The Service is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new date, and notify you by email of material changes before they take effect. See also our Terms of Service.

15. Contact

Questions or requests about privacy: support@postinger.dev.