// legal

Privacy Policy

effective date: October 1, 2026 · Postmonster

This policy is written in plain language and is a working document for Early Access. It is reviewed and signed off by the operator. Effective date: October 1, 2026.

1. Who we are

Postmonster is operated by Postmonster, contactprivacy@postmonster.xyz. In this policy, "we", "us" and "Postmonster" refer to this service and its operator; "you" refers to the user of the service or visitor of https://postmonster.xyz.

2. What we collect

  • Account data: your name, email address, password (stored hashed) and workspace membership.
  • Access requests: if you request Early Access, we store the details you submit — name, email, role, main networks, team size and what you want to use Postmonster for — plus the request status.
  • Content: the posts you write and schedule, and the images or videos you upload to the media library.
  • Connected channels: for each network you connect, the identifiers of the account (such as display name, username and avatar URL) and the access tokens needed to publish on your behalf. Disconnecting a channel deletes its tokens.
  • Operational data: publishing results and statuses, error messages from networks, and basic service logs needed to run and secure the service.
  • Communications: emails you send us and the replies.

We do not buy contact lists and we do not enrich your profile with data from third-party brokers.

3. TikTok data

When you connect a TikTok account through TikTok's Content Posting API, we receive and store: your TikTok open_id, display name and username, profile picture URL, the OAuth access and refresh tokens, and the identifiers and statuses of the posts you publish (publish_id and status).

We do not store your TikTok videos outside the content you upload for scheduling, and we do not collect follower analytics or other audience data. Tokens are used only to publish the posts you create. Disconnecting the TikTok channel revokes and removes the tokens immediately.

4. How we use data

  • Provide the service: scheduling, publishing, status tracking, previews.
  • Send transactional emails: account activation, invites, publishing failures, replies.
  • Review Early Access requests and onboard small batches.
  • Keep the service secure: abuse prevention, rate limiting, incident investigation.
  • Comply with legal obligations.

We do not use your content to train models and we do not sell personal data.

Where the GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, improving reliability), consent (where we ask for it — for example receiving non-essential emails), and legal obligation (accounting and law-enforcement requests).

6. Storage and retention

We keep account and content data while your account is active. Publishing history is kept with your workspace so you can audit what went out. When you delete your account, we delete personal data and content without undue delay; access tokens are removed immediately, and residual copies in backups age out within 30 days. Access requests that do not convert to accounts are kept for up to 12 months (or less on request), so we can follow up and avoid duplicates.

7. Sub-processors

We use a small set of sub-processors to run the service:

  • Hosting: the server operator providing the compute and storage.
  • Email delivery: a transactional email provider for activation, invites and notifications.
  • Networks you connect: content is delivered to the platforms you choose (TikTok, YouTube, etc.) under their own terms and privacy policies.

The current list is available on request atprivacy@postmonster.xyz.

8. Cookies and tracking

This website (https://postmonster.xyz) uses no cookies, no analytics and no third-party trackers. The application (app.postmonster.xyz) uses a session cookie that is strictly necessary to keep you logged in.

9. Your rights

Subject to applicable law, you can request access to your personal data, correction, deletion, export (data portability), restriction or objection, and withdraw consent where processing is consent-based. Write toprivacy@postmonster.xyz — we answer within 30 days. You can also lodge a complaint with your local data protection authority.

10. Deleting your account

You can delete your account yourself in Settings (account deletion requires typing your email to confirm). This removes your profile, workspaces you solely own, connected channel tokens (revoked first), media, posts and scheduling data. If you share a workspace with other members, you can leave the workspace and the owner keeps the team content. A confirmation email is sent either way.

11. Security

Traffic is encrypted in transit (HTTPS). Access to production data is limited to the operator, and access tokens for connected channels are stored for use by the service only. No system is perfect: if we learn of a breach affecting your data, we will notify you and the competent authorities as required by law.

12. Children

Postmonster is not directed at children. You must be at least 16 (or the minimum age required in your country, e.g. 13 in the US) to use the service. If you believe a child has given us personal data, contact us and we will delete it.

13. Platform policies

When you connect third-party networks, their own policies apply to the data they process — for example theTikTok Privacy Policy, theGoogle API Services User Data Policy for YouTube and Google, and Meta's policies for Instagram and Facebook. Our use of data received from those platforms is limited to the purposes described here.

14. Changes

If this policy changes materially, we will update this page and note the new effective date. For material changes that affect your rights, we will notify account holders by email.

15. Contact

Privacy questions, data requests and complaints:privacy@postmonster.xyz. General contact:hello@postmonster.xyz. Operator: Postmonster.