Privacy Policy

Last updated: October 9, 2026

PostyPop ("we," "us," or "our") operates the postypop.app website and the PostyPop Chrome extension. PostyPop writes social media posts with AI and can schedule and publish them to social accounts you connect. This Privacy Policy explains how we collect, use, and protect your information.

Information We Collect

Account Information

When you create an account, we collect your name, email address, and a hashed version of your password. We never store your password in plain text.

Content You Provide

When you use PostyPop, you paste or submit content (text, URLs) for AI processing. We temporarily process this content to generate your social media posts. Your input content and generated outputs are stored in your generation history so you can access them later.

Posts, Media and Automations

When you schedule or publish with PostyPop, we store the posts you write or schedule, the media you upload, your posting schedule and time zone, and any automations you set up, such as RSS feeds we check for new items. The section on connected social accounts explains this in detail.

Usage Data

We track basic usage metrics: number of AI generations and scheduled posts per month (for plan limits), platforms selected, and feature usage. This helps us improve the product and enforce plan limits.

Payment Information

Payments are processed by Lemon Squeezy. We do not store your credit card number, billing address, or other payment details on our servers. Lemon Squeezy handles all payment processing. See their privacy policy at lemonsqueezy.com/privacy.

Analytics

We use Google Analytics to understand how visitors find and use our website (for example, which pages are viewed and where traffic comes from). Google Analytics sets cookies and collects standard usage data such as pages visited, approximate location, browser, and device type. This data is aggregated and helps us improve the product. You can opt out across all sites using the Google Analytics Opt-out Browser Add-on. See how Google uses this data at policies.google.com/privacy.

Cookies and Local Storage

We keep your sign-in tokens in your browser's local storage and in a secure, HttpOnly sign-in cookie. When you sign in with Google or Apple, or connect a social account, we set short-lived cookies that protect that step and hand your sign-in to the app. They expire within 15 minutes. Aside from these and the Google Analytics cookies described above, we do not set tracking cookies. PostyPop doesn't show ads. The Chrome extension stores your authentication token and preferences (theme, layout, font size) in Chrome's local storage.

How We Use Your Information

  • To provide the service: Your content is sent to AI providers to generate social media posts.
  • To publish what you schedule: We send your posts and media to the networks you choose, at the time you choose.
  • To maintain your account: Email for login, password reset, and account communications.
  • To keep you informed: We email you when a post fails, when a connection needs reconnecting, when it's time to post to a reminder channel, and when a reviewer responds to an approval link.
  • To enforce plan limits: Usage tracking ensures plan limits are respected.
  • To improve the product: Aggregated, anonymized usage patterns help us improve PostyPop.

AI Processing and Third-Party Providers

Your content is processed by third-party AI providers to generate social media posts. This includes posts you ask the AI to write or rewrite, evergreen reposts set to use fresh wording, and posts written from RSS feed items. These providers may include:

  • Groq (groq.com): primary AI provider for all tiers
  • OpenAI (openai.com): emergency fallback provider
  • Anthropic (anthropic.com): backup provider if the others are unavailable

Your content is sent to these providers solely for the purpose of generating social media posts. We do not use your content to train AI models. Each provider has its own data handling policies, and we encourage you to review them.

Important: Do not submit sensitive personal information, confidential business data, or proprietary content through PostyPop. The service is designed for content you intend to publish publicly on social media.

Connected Social Accounts

You can connect social accounts to PostyPop, such as an X account, a LinkedIn profile, a Facebook Page, an Instagram professional account, a Threads, Bluesky, Mastodon, TikTok, YouTube or Pinterest account, a Telegram channel or a Discord channel. Depending on the network, you either approve PostyPop's access on the network's own sign-in screen, or paste in a token, webhook URL or app password you create there.

What we store when you connect an account

  • The account's ID on that network, its name or handle, and the URL of its profile picture.
  • The access tokens the network gives us, and refresh tokens where the network issues them. For Telegram and Discord, the bot token or webhook URL you paste in. For a custom webhook, its address and signing secret. All of these are encrypted at rest with AES-256-GCM, and the encryption key is kept separate from the database.
  • For Bluesky, we use your App Password once to sign in and don't store it. We keep the session tokens Bluesky issues instead.
  • The posts and media you schedule, the options you pick for each network (like a board, a privacy setting or a first comment), and the result of each attempt, including the link to the published post or the error the network returned.

What we do with it

We use your connection only to publish what you create, schedule or set up as an automation in PostyPop, to refresh access before it expires, and to check that the connection still works. Publishing sometimes needs a small read, like listing your Pages or boards so you can choose one, or checking your own recent posts to confirm one went out. Beyond that, we don't read your feed, your messages or your followers. We never sell your data.

When a post publishes, its text and media go to the network you chose and are covered by that network's own privacy policy from then on.

Media you upload

Media you upload is stored on our servers so we can publish it at the scheduled time. Networks that fetch files themselves get a private link that expires. It stays in your media library until you delete it. You can delete any file that isn't attached to a post still waiting to publish, and we delete your media when you delete your account.

Approval links and the API

On the Pro plan you can share a post with a client for approval. Anyone with that link can see the post, its media, the accounts it's going to, and your name (not your email address), and can leave a name and a note with their decision, which we store with the post. You can withdraw an approval request at any time. API keys you create are stored as a one-way hash; we show the full key only once.

Disconnecting and deleting your data

  • Disconnect on the Channels page. We delete the account's stored tokens, ID, name and profile picture right away and cancel any posts still waiting to go to it. Posts that already published stay in your post history, with the link to the published post, until you delete them or your account.
  • Remove access on the network. You can also revoke PostyPop from the network's own app settings. Posts to that account will then fail until you reconnect, and you can disconnect it in PostyPop to delete what we stored. For Facebook, Instagram and Threads, Meta tells us when you remove PostyPop and we delete the stored tokens straight away.
  • Facebook, Instagram and Threads. If you remove PostyPop in your Meta settings and ask for your data to be deleted, Meta notifies us and we automatically delete those connections and cancel posts still queued for them.
  • Everything else. To delete your account, post history and media, email support@postypop.app.

YouTube

PostyPop uses YouTube API Services to upload videos to your YouTube channel. By connecting YouTube, you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

From your YouTube connection we store your channel ID, channel name, profile picture URL and the encrypted tokens described above. We use them only to upload the videos you schedule, with the title, description and visibility you choose, and to check each upload's status afterwards. We don't share YouTube data with anyone else, except people you send an approval link to, as described above. You can remove PostyPop's access at any time on Google's security settings page, or disconnect the channel on the Channels page. Disconnecting revokes PostyPop's access at Google straight away. We refresh the stored channel details at least every 30 days, and if a connection stops working because access was revoked, we delete its tokens and channel details within 7 days.

Data Retention

  • Account data: Retained until you delete your account.
  • Generation history: Stored for as long as your account is active. You can request deletion at any time.
  • Social connections: Kept until you disconnect the account, revoke access through Meta's data deletion process, or delete your PostyPop account.
  • Posts and media: Kept until you delete them or your account.
  • Usage metrics: Retained for billing and analytics purposes.

Data Security

We protect your data with:

  • HTTPS encryption for all data in transit
  • Bcrypt password hashing
  • AES-256-GCM encryption for social account tokens and credentials
  • JWT-based authentication with token expiration
  • API keys stored only as one-way hashes
  • Database access controls and secure hosting

Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your generation history

To exercise any of these rights, contact us at support@postypop.app.

Children's Privacy

PostyPop is not intended for users under 13 years of age. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes via email or a notice on the website. Your continued use of PostyPop after changes constitutes acceptance of the updated policy.

Contact

Questions or complaints about this Privacy Policy or how we handle your data? Contact us at support@postypop.app.