Privacy policy

Your account. Your email address and sign-in identifiers. Pushapost uses emailed sign-in codes rather than an app password.

Your content. The brands you create, the posts you write or approve, any images and video you upload, and the schedule you set.

Social account references. When you connect a social profile, the authorisation is handled by our integration provider, which holds the access token. We store only a reference to the connected account, plus the handle and its status. We never receive or store your social platform password, and we do not store access tokens. Publishing a post that has an image attached is the one exception: our server asks the integration provider for the token, uses it for that single upload, and discards it when the request finishes. It is never written to our database or our logs.

Performance data. Figures the social platforms report about your posts and profiles — impressions, engagements, follower counts — collected on a schedule so your reporting stays current.

Activity records. Who created, approved or rejected a post, and which AI assistant queued it, if any. This exists so an agency can answer "who signed this off" about work done for a client.

Billing. Your workspace name and account email are sent to Stripe when the owner opens checkout. Stripe handles card details and billing addresses. We store Stripe account and subscription references, subscription status, payment-period dates, monthly post usage and a single-use trial expiry. We do not receive or store full card numbers.

We do not sell your data. We do not use the content of your posts to train machine learning models. We do not read your social inbox or messages — the access we request is for publishing and for reading performance figures about your own profiles.

Running the service means sharing some data with the companies that host and power it: our cloud host, our database provider, Stripe for payments, our social integration provider, and the social platforms themselves when you publish to them. Each receives only what that job needs.

If you connect a social account, that platform's own privacy policy governs what it does with the post once we hand it over.

Your content stays until you delete it or close your workspace. Activity records are kept for as long as the workspace exists, because their value is in being a complete history. When a workspace is deleted, its content and usage records are removed. An account’s trial-expiry record remains while that account exists so creating another workspace cannot restart the trial. Stripe retains its billing records under its own policy, including records required for accounting or legal obligations.

You can disconnect a social account at any time from the Accounts page, which also revokes the connection at our integration provider. You can delete posts, media and brands from within the app.

You can request a copy of your data, or its deletion, by writing to privacy@pushapost.com. See the data deletion page for how that works and how long it takes.

Pushapost is a business tool and is not directed at anyone under 16.

If this policy changes in a way that affects how we handle your data, we will tell account owners by email before it takes effect.