Privacy Policy
Postifys helps authorized users connect social media accounts and manage publishing workflows through official platform APIs. This policy explains what information we collect, why we use it, when we disclose it, how long we retain it, and the choices available to you.
Information we collect
- Account information such as name, email address, password hash, verification status, and login session details.
- OAuth authorization information returned by platforms such as Meta, Instagram, YouTube, Pinterest, LinkedIn, and TikTok after you explicitly authorize access, including access tokens, refresh tokens, granted scopes, platform user IDs, and token expiration dates.
- Connected asset information such as Facebook Page names and IDs, Instagram account IDs/usernames, YouTube channel details, Pinterest account details, TikTok creator details, and platform permissions.
- Publishing workflow data such as captions, media URLs, selected accounts, post settings, status responses, and error logs.
- Technical information such as IP address, browser data, server logs, and webhook events required to operate and secure the service.
TikTok information and Direct Post
When you connect TikTok, we request only the permissions displayed in TikTok's authorization screen. These are user.info.basic to identify the authorized creator, video.publish when you choose Direct Post, and video.upload when you choose to send a draft to TikTok for further editing. We receive your TikTok open ID, display name, avatar, creator posting capabilities, access and refresh tokens, and the permissions you granted.
When you prepare a TikTok post, we process the video, caption, selected creator, privacy level, and your comment, Duet, and Stitch choices. We query TikTok for the creator's current publishing options before submitting a Direct Post. Postifys sends a Direct Post only after you or an authorized workflow expressly confirms the publishing request. We do not use TikTok information for advertising, user profiling, or sale to third parties.
Postifys additionally requests the following TikTok permissions to power account and post analytics features in the dashboard:
user.info.profile— retrieve the connected account's display name and avatar to show in the Postifys accounts dashboard.user.info.stats— retrieve the connected account's follower count to display alongside each connected TikTok account.video.list— retrieve a list of videos published through Postifys, including title, post date, and status, to display in the post history view.
These permissions are used solely to display information inside your Postifys dashboard. We do not store raw TikTok analytics data beyond what is needed to render the dashboard view, and we never share it with third parties.
How we use information
- To create and secure your Postifys account.
- To verify your email address and help you reset your password.
- To connect social media accounts only after you authorize access through the platform's OAuth flow.
- To publish or manage content only when requested by an authorized user or configured workflow.
- To troubleshoot API errors, prevent abuse, and improve service reliability.
Platform data
Postifys uses official APIs from platforms such as Meta, Instagram, YouTube, Pinterest, LinkedIn, and TikTok. We do not scrape platform data and do not publish without authorization from the account owner or an authorized workspace user. Your use of connected platforms is also governed by those platforms' terms and privacy policies.
Data sharing
We do not sell or rent personal information or connected-platform data. We disclose information to a social platform when you request an action on that platform. We may also share only the information necessary with contracted providers that support hosting, media processing, email delivery, logging, security, and payment processing. Providers may use this information only to perform services for us. We may disclose information when required by law, to prevent fraud or abuse, or to protect users and the service.
Data security
We use administrative, technical, and organizational safeguards appropriate to the nature of the information. Passwords are stored as hashes, production sessions use secure cookies over HTTPS, access is restricted to authorized systems and personnel, and platform credentials are protected in storage and transit. No system can guarantee absolute security.
Data retention and deletion
We retain account information while your account is active and as reasonably necessary for security, dispute resolution, and legal obligations. Connected-platform tokens and profile details are retained until you disconnect that platform, delete your Postifys account, revoke access with the platform, or request deletion. Publishing records and operational logs are retained only as needed to provide history, investigate failures, secure the service, and meet legal obligations, after which they are deleted or anonymized.
You can disconnect TikTok from Postifys at any time from Connected Accounts. You may also revoke Postifys in TikTok's settings. Disconnecting removes the stored TikTok connection and prevents new posts; revocation may require you to reconnect before using TikTok again. To request deletion of your Postifys account, TikTok connection, publishing history, or other personal information, email us using the address below. We will verify and process valid requests as required by applicable law.
When you remove Postifys from your Facebook account, Meta sends us a data deletion request and we delete your connected Facebook and Instagram tokens from Postifys.
You can check the status of a Meta data deletion request at https://postifys.com/data-deletion/YOUR_CONFIRMATION_CODE.
You may also request deletion of your account or connected social data by contacting us.
Your choices and rights
You may access and update account information, disconnect social accounts, revoke platform authorization, and request access to, correction of, or deletion of personal information. Depending on your location, you may also have rights to restrict or object to processing and to receive a portable copy of certain information.
International processing and children
Postifys and its providers may process information in countries other than your own, subject to applicable safeguards. Postifys is not intended for children under 13 or any higher minimum age required in their country, and we do not knowingly collect their personal information.
Policy changes
We may update this policy as our services or legal obligations change. We will update the date above and provide additional notice when required.
Contact
Postifys is operated by Foldious. For privacy questions, rights requests, or deletion requests, contact support@postifys.com.