Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains what personal data Posty (“Posty”, “we”, “us”) collects when you use the website at posty.live and the Posty application at posty.live/app (together, the “Service”), why we collect it, how long we keep it, who we share it with, and the choices you have. Posty is a tool that publishes the posts you write to your own Instagram, Facebook, Telegram and TikTok accounts, now or on a schedule.

The operator of the Service is the controller of your personal data. You can contact the operator at [email protected].

1. Data we collect

Data	Details
Account data	Your email address, a hashed password (we never store your password in readable form), your timezone, and the date your account was created.
Session data	When you log in we create a session. We store a hash of the session token, the IP address and user agent (browser and device description) that created it, and its creation, last-used and expiry times.
Connected social accounts	For each Instagram, Facebook Page, Telegram or TikTok account you connect: the platform’s identifier for the account, its name or username, its type and connection status, and the access tokens (or Telegram bot token) needed to publish for you. Tokens are stored encrypted.
Posts	The text, scheduled time, per-account overrides and options of the posts you create, and which accounts they target.
Uploaded media	Images and videos you upload, and processed copies of them that Posty creates for publishing, together with file metadata such as type, size and dimensions.
Publish logs	A record of each attempt to publish a post to a platform: time, outcome, any identifier or link returned by the platform, and error messages.
Email correspondence	Messages you send to us, and transactional emails we send you (for example password reset and failed-post notices).

We do not use advertising or analytics trackers on the website or in the application. We do not ask for your social media passwords: you connect accounts through each platform’s own authorisation screen (or, for Telegram, by adding a bot).

Media files you upload are made available at long, unguessable web addresses so that Instagram, TikTok and other platforms can fetch them when publishing. Anyone who knows an address can view that file until the file is deleted, so do not upload anything you would not be willing to publish.

2. How we use your data and our legal basis

Purpose	Data	Legal basis (GDPR)
Create and secure your account, log you in, reset your password	Account data, session data	Performance of a contract (providing the Service you asked for)
Connect your social accounts and publish or schedule posts on your behalf	Connected accounts and tokens, posts, media, publish logs	Performance of a contract; your consent when you authorise a platform connection (you can withdraw it at any time, see “Disconnecting”)
Email you about failed posts and account matters	Email address, publish logs	Performance of a contract
Protect the Service: rate limiting, abuse and fraud prevention, debugging, reliability	Session data (IP, user agent), publish logs	Our legitimate interests in keeping the Service secure and working
Respond to your requests and comply with law	Email correspondence and any data needed to answer	Legitimate interests; legal obligation where applicable

We do not sell your personal data, we do not use it for advertising or profiling, and we do not make decisions about you by automated means that have legal or similarly significant effects.

3. Data from Meta, TikTok and Telegram

Posty acts only on your instructions. We use access you grant to publish the posts you create to the accounts you choose, at the time you choose. We only post on your behalf; we do not post anything you did not create and schedule. We do not read your private messages, and we do not collect data about your followers or audience.

Data we obtain through the Meta (Facebook and Instagram) and TikTok APIs is not sold, is not used for advertising or marketing, and is not shared with data brokers or used to build profiles. It is used only to provide the features you see in Posty and is shared only as described in this policy.

Facebook and Instagram (Meta)

You connect through Facebook Login. Depending on what you connect, we request these permissions:

pages_show_list: to list the Facebook Pages you manage so you can choose which to connect.
pages_read_engagement and business_management: to read basic information about your Pages and the assets they belong to, as required by Meta to publish to a Page and to discover the Instagram account linked to it. Posty does not display or store engagement statistics.
pages_manage_posts and publish_video: to publish text, photos and videos to the Pages you connect.
instagram_basic and instagram_content_publish: to identify the Instagram professional account linked to your Page and to publish photos, videos, Reels, carousels and Stories to it.

Instagram publishing is available only for professional (Business or Creator) accounts linked to a Facebook Page.

TikTok

You connect through TikTok Login Kit. We request these scopes:

user.info.basic: to identify the TikTok account you connect (its identifier and display name).
video.publish and video.upload: to publish the videos and photos you create in Posty to your TikTok account. Before each post we also ask TikTok for your account’s posting options, such as the privacy levels available to you.

Until Posty’s app has passed TikTok’s audit, posts made through Posty are private on TikTok.

Telegram does not use sign-in authorisation. You add the Posty bot (or your own bot) to your channel or group as an administrator with permission to post messages. We store the chat identifier and username of the channel or group, and, if you use your own bot, your bot token (encrypted). We post only to channels and groups you connect.

The platforms handle your data under their own policies: see the Meta Privacy Policy, the TikTok Privacy Policy and the Telegram Privacy Policy.

We share personal data only with the following recipients, and only as needed to provide the Service:

Meta Platforms (Facebook and Instagram): the content, media and tokens needed to publish to the accounts you connect.
TikTok: the content, media and tokens needed to publish to the accounts you connect.
Telegram: the content and media you post to the channels and groups you connect.
Our email (SMTP) provider: your email address and the text of the transactional emails we send you, such as password resets and failed-post notices.
Hosting: Posty runs on a server that we operate ourselves, and your data is stored there. Routine backups of that server are made for disaster recovery.

We may also disclose data if required by law or a valid legal request, or to protect the rights, safety and security of our users and the Service. If the operator of Posty is ever merged with or acquired by another organisation, we will tell you before your data becomes subject to a different privacy policy.

5. How long we keep data

Account, posts and connected-account data: kept while your account is active.
Sessions: expire after 30 days of inactivity and are removed when you log out.
Media files: when you delete a media item, the files are purged 24 hours later. The delay lets platforms finish fetching files for posts that are in progress.
Publish attempt logs: kept for 90 days, then deleted.
Account deletion: when you delete your account, scheduled posts are cancelled, your social accounts are disconnected, your user data is soft-deleted immediately and your media files are purged within 7 days.
Backups: routine server backups may contain copies of deleted data for a limited period after deletion until those backups are rotated out. We do not restore deleted data except to recover from a failure.
Correspondence: emails you send us are kept as long as needed to deal with your request and for a reasonable time afterwards.

6. Disconnecting a social account and revoking access

You can disconnect any connected account at any time in Posty under your connected accounts. Disconnecting stops publishing to it, cancels pending posts for it and deletes the stored tokens. Where the platform supports it, we also ask the platform to revoke the token.

You can also revoke Posty’s access directly at the platform:

Facebook and Instagram: in Facebook, go to Settings, then Apps and Websites (or Business Integrations), select Posty and choose Remove. Meta then notifies us and we remove the related connections.
TikTok: in the TikTok app, go to Settings and privacy, then Security and permissions, then Apps and services (Manage app permissions), select Posty and remove access.
Telegram: remove the Posty bot (or your own bot) from the channel or group’s administrators.

7. Data deletion

You can have your data deleted at any time:

In the app: log in, open Settings and choose Delete account.
By email: write to [email protected] from the email address of your account and ask for deletion. We may ask you to confirm that the request comes from you.
Through Meta: if you remove Posty in your Facebook or Instagram settings and ask Meta to delete the data Posty holds, Meta sends a signed request to our data deletion callback at https://posty.live/webhooks/meta/data-deletion. We verify the request and remove the Facebook and Instagram connections and stored tokens associated with that Facebook user. To delete the rest of your Posty data, also use one of the options above.

What happens when you delete your account: scheduled posts are cancelled; connected social accounts are disconnected and their tokens deleted; your user data is soft-deleted straight away (the account can no longer be used) and your uploaded media is purged within 7 days. Publish attempt logs that remain are deleted when they reach 90 days. Posts that Posty has already published on Instagram, Facebook, Telegram or TikTok are on those platforms and are not removed by us; delete them on the platform.

We will confirm once your request has been completed. If you have questions about a deletion request, email [email protected].

8. Cookies

Posty sets a single cookie, posty_session. It is strictly necessary: it keeps you logged in. It is HTTP-only, sent only over HTTPS, restricted to same-site use, and valid for 30 days of activity. We do not use advertising, analytics or tracking cookies, and we do not load third-party scripts or fonts on the website. Because the cookie is essential, we do not show a cookie consent banner. The marketing pages set no cookies.

9. Security

Passwords are stored only as salted hashes made with Argon2id.
Social account tokens are encrypted before they are stored.
Sessions use random tokens of which only a hash is stored; the session cookie is HTTP-only and secure.
Traffic to the Service is encrypted in transit with HTTPS.
Login and registration are rate limited, and state-changing requests are checked against cross-site request forgery.
Access to the server is restricted to the operator.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

10. Children

Posty is not intended for anyone under 16 years of age, and you must not create an account if you are under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, email [email protected] and we will delete it.

11. International transfers

Our server may be located in a different country from yours, so your data may be transferred to and processed in another country. When we publish your content, we send it to Meta, TikTok and Telegram, which operate globally, including in countries outside your own. Where the law requires safeguards for such transfers, we rely on appropriate mechanisms such as standard contractual clauses or an adequacy decision, or on your request to publish content to those platforms.

12. Your rights

Depending on where you live (including under the GDPR and UK GDPR, and under the CCPA/CPRA for California residents), you have the right to:

Access the personal data we hold about you and receive a copy;
Correct inaccurate data (most of it you can change yourself in Settings);
Delete your data (see “Data deletion”);
Portability: receive your data in a structured, commonly used format;
Restrict or object to processing based on our legitimate interests;
Withdraw consent at any time, for example by disconnecting a social account, without affecting processing before the withdrawal;
Complain to your local data protection authority.

We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against anyone for exercising these rights. To exercise a right, email [email protected] from the address of your account. We aim to respond within 30 days.

13. Changes to this policy

We may update this policy, for example when the Service or the law changes. The date at the top shows when it was last updated. For material changes we will notify you by email or in the application before they take effect.

14. Contact

Questions, requests and complaints about privacy: [email protected].