Privacy Policy

1. What we collect

Account data: your email address and sign-in credentials (or Google sign-in identity).

Connected accounts: when you connect X, Instagram, LinkedIn or Threads, we store the OAuth access tokens and basic profile info (handle, name, avatar) needed to publish on your behalf. Tokens are stored encrypted at rest in our backend and are never exposed to other users or to the AI assistants you connect.

Content: the posts you draft, their scheduling data, and the media (images, videos, files) you upload.

Usage data: technical logs needed to operate and secure the service (request timestamps, error logs, publishing outcomes).

2. How we use it

We use your data only to run the service for you: authenticating you, publishing scheduled posts to the platforms you chose, rendering previews, powering the AI writing features you invoke, and keeping the service reliable and secure.

We do not sell your data. We do not use your content or connected-account data to train AI models, and we do not show your content to other users.

3. Third-party processors

PostGP runs on Lovable Cloud (hosting, database, file storage) and uses an AI gateway for post generation. When you publish, your content is transmitted to the platform you targeted (X, Meta, or LinkedIn) under their own privacy policies.

When you connect an AI assistant (Claude, ChatGPT, Gemini, Codex and similar) through our MCP server, that assistant acts under your authorization and can only access your own PostGP data. What the assistant's provider does with your conversation is governed by that provider's policy.

4. Retention and deletion

We keep your data while your account is active. When you disconnect a social account, its tokens are deleted. When you delete a post or media item, it is removed from active storage; backups roll off within a reasonable period.

You can request full account deletion at any time by emailing support@postgp.com — we will delete your account, content, and stored tokens.

5. Security

Access to your data is enforced by row-level security in our database: every read and write is scoped to your account. OAuth tokens live in service-only tables that no other user can query. Publishing runs server-side over HTTPS to the platforms' official APIs.

6. Your rights

Depending on where you live (including the EEA, UK, and California), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email support@postgp.com to exercise any of these — we respond within 30 days.

7. Changes

We may update this policy as the service evolves. The current version is always at postgp.com/privacy, and material changes will be noted in the app before they take effect.

8. Contact

Privacy questions or requests: support@postgp.com.