Privacy Policy

1. Introduction

Welcome to PostFast ("we," "our," or "us"), operating at https://postfast.sh. PostFast lets you schedule and publish posts to the social accounts you connect, and shows the analytics those platforms return. This policy explains what we collect, why, how it is stored, and how to have it deleted.

2. Information We Collect

When you use PostFast, we collect the following categories of information:

• Account Information: Email address, name, a hashed password (if you sign up with a password), and organization preferences.
• Connected Social Accounts: For each channel you connect, the platform's account or page ID, name, username, profile picture, and the credentials needed to post on your behalf: access and refresh tokens for OAuth platforms, or the app password, application password or API key you type in for platforms that use one (see section 4).
• Content & Assets: Post text, media files (images, videos), scheduled publication times, per-platform settings, and the post statistics the platforms return.
• Technical Data: The IP address and browser user agent you signed up from, and server logs with IP address, user agent and the pages requested, kept for security and debugging.

3. How We Use Your Information

We use collected data only to provide PostFast to you:

• Authenticating your account and keeping you signed in.
• Publishing the posts you schedule to the accounts you connected, at the time you chose.
• Showing post status and the analytics each platform returns.
• Customer support, security monitoring, and service emails.

We do not sell your data, do not use it for advertising, and do not use data from connected platforms to train AI models.

4. Connecting Social Accounts

Most platforms are connected through their own sign-in screen (OAuth 2.0), so we never see your password for them. X uses OAuth 1.0a: X gives us an access token and token secret, and we never see your X password. A few platforms have no such screen and instead ask you to type a credential into PostFast. For Bluesky this is an app password, which you create in Bluesky and which is separate from your account password; never enter your Bluesky account password. We keep that credential because we use it to sign in to the platform each time we publish for you.

Channels you can connect today, and exactly what each one requests:

The following platforms are not available yet. When we enable them, connecting one will request exactly these permissions, used only to publish the posts and comments you schedule and to show their statistics:

• X (Twitter) (OAuth 1.0a (X issues an access token and token secret; no scopes are involved)): Publish posts, threads and media you schedule, and read the metrics of those posts.
• Facebook Pages (Facebook Login): pages_show_list, business_management, pages_manage_posts, pages_manage_engagement, pages_read_engagement, read_insights
• Instagram (professional account linked to a Facebook Page) (Facebook Login): instagram_basic, pages_show_list, pages_read_engagement, business_management, instagram_content_publish, instagram_manage_comments, instagram_manage_insights
• Instagram (Instagram Login) (Instagram Login): instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_insights
• Threads (Threads OAuth): threads_basic, threads_content_publish, threads_manage_replies, threads_manage_insights
• LinkedIn (OAuth 2.0): openid, profile, w_member_social, r_basicprofile, rw_organization_admin, w_organization_social, r_organization_social
• Pinterest (OAuth 2.0): boards:read, boards:write, pins:read, pins:write, user_accounts:read

You can disconnect a channel at any time from PostFast (click the three-dot menu next to the channel in the channel list and choose Delete) or revoke PostFast's access in the platform's own settings.

5. Google and YouTube Data

PostFast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features you see in PostFast: uploading the videos you schedule, showing their status, and showing your channel analytics.
• We do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your notice.
• We do not use it for advertising, do not sell it, and do not use it to train AI or machine-learning models.
• No person at PostFast reads it unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymized.

PostFast uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke PostFast's access to your Google account at any time at myaccount.google.com/permissions. If you ask us to delete data we obtained from YouTube, we delete it within 7 days.

6. Facebook, Instagram and Threads (Meta) Data

PostFast does not offer Facebook, Instagram or Threads yet. When it does, connecting one of them will give us the Page, Instagram account or Threads account ID, name, username and profile picture, and an access token for the permissions listed in section 4. We use them only to publish the posts and comments you schedule and to show the statistics of those posts. We do not sell this data, use it for advertising, or share it with anyone except the infrastructure providers listed below.

You can remove PostFast from Facebook at any time in Facebook Settings > Apps and Websites (or Business Integrations), from Instagram in Settings and activity > Website permissions > Apps and websites, and from Threads in Settings > Account > Website permissions. How to have Meta data deleted from PostFast is described on our data deletion page.

7. How We Store Tokens and Credentials

Data is stored in a PostgreSQL database, uploaded media in file storage on the server that runs PostFast, and everything is sent over TLS. Access tokens, refresh tokens, API keys and WordPress application passwords are stored in that database without an additional layer of application-level encryption; they are protected by the access controls on our servers and database. The Bluesky app password, and the other details you type in to connect a channel, are additionally kept in an encrypted field whose key is not stored in the database.

8. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal information or connected account data. Your posts are sent only to the platforms you chose. We share data only with the providers we need to run the service (our server host, our email delivery service, and a payment processor if you buy a paid plan), and only for that purpose.

9. Data Retention & Deletion

We keep your account data and posts while your account is active. You can delete your account at any time in Settings > Global Settings > Delete Account. Deleting your account immediately replaces your name and email, and the tokens and credentials of every channel in the organizations you own, with hashes, and marks those organizations and their posts as deleted so they are never published or shown again. To also have your post content and uploaded media erased, or to delete data without deleting your account, email us and we will do it within 30 days. Full instructions are on our data deletion page.

10. Contact Us

If you have any questions regarding this Privacy Policy or your personal data, please contact us at support@postfast.sh.