Privacy Policy

Last updated: 2026-10-03

Postaro (https://postaro.app) lets you schedule and publish posts to your own social media accounts. This policy explains what information we collect, why, how long we keep it, who we share it with, and the choices you have. Postaro is operated by [상호 / Business name] ("we", "us").

1. Information we collect

Your account

• Name, email address and a securely hashed password.
• Session information used to keep you signed in: IP address, browser user agent, sign-in times.
• Language and time zone preferences.

Social accounts you connect

When you connect a social account (for example X, Instagram, Facebook, Threads, TikTok, YouTube, LinkedIn, Pinterest or Bluesky), we receive and store:

• The account's ID, username or handle, display name and profile picture.
• Access and refresh tokens that let us publish on your behalf, their expiry dates and the permissions you granted. Tokens are encrypted at rest (AES-256-GCM).
• For pages or channels you choose to connect: their IDs, names and pictures.

We only request the permissions needed to publish your posts and show their status. We do not read your private messages.

Content you create

• Post text, images and videos you upload, the accounts you select and the times you schedule.
• Publishing results: the ID and link of each published post, or the error the platform returned.

Billing

Payments are handled by Polar, our merchant of record. We never see or store your full card number. We receive your customer ID, email, country, plan and subscription status from Polar.

Support and technical data

• Messages you send us.
• Server logs (request time, IP address, errors) kept for security and debugging.
• A single sign-in cookie. We do not use advertising cookies.

2. How we use information

• To publish the posts you schedule, at the time you choose, to the accounts you choose.
• To show you whether each post was published, and to alert you by email and in the app when a post fails or an account needs to be reconnected.
• To refresh connection tokens before they expire so scheduled posts keep working.
• To run your subscription, send receipts and trial reminders, and answer support requests.
• To keep the service secure and fix problems.

We do not sell your information, use it for advertising, or use your content or social account data to train AI models. Postaro has no built-in AI writing. If you connect your own AI assistant (for example Claude or ChatGPT) through our API, what you send that assistant is handled by its provider under their terms.

3. YouTube and Google data

Postaro uses YouTube API Services to upload videos you schedule to your YouTube channel and to show their status. By connecting YouTube you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

• We access your channel ID, name and picture, and upload videos and their titles, descriptions and settings that you provide.
• Besides disconnecting YouTube in Postaro, you can revoke our access at any time on the Google security settings page.
• When you disconnect or revoke access, we delete the stored tokens and YouTube data within 7 days. Stored YouTube data is refreshed or deleted at least every 30 days.

Postaro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who we share information with

We share information only with these service providers, only to run Postaro, and under contracts that require them to protect it:

When you publish, your post and media are sent to the social platform you selected, under that platform's own terms and privacy policy. We may also disclose information if the law requires it.

5. International transfers

Our servers are in the United States. Your information is transferred there over encrypted connections when you use the service, and stored there for the periods in section 6. If you do not agree to this transfer, you can stop using the service and delete your account.

6. How long we keep information

• Account and content: while your account is open. Deleted within 30 days after you delete your account.
• Connection tokens: deleted immediately when you disconnect an account.
• Uploaded media: deleted 30 days after the post is published or deleted, unless you keep it in your media library.
• Server logs: 90 days.
• Payment records: 5 years, as required by Korean e-commerce law.

7. Your choices and rights

• Disconnect any social account on the Channels page. Its tokens are deleted immediately.
• To delete your account and all its data, email privacy@postaro.app from your account email. We confirm and complete the deletion within 30 days.
• Facebook, Instagram and Threads users can also remove Postaro in their Meta settings (Settings → Apps and websites). After you remove it, email us to delete the data we stored, or delete your Postaro account.
• You can ask to see, correct, export or delete your information, or object to its processing, by emailing us. We answer within 30 days.
• If you are in the EU, UK or another region with data protection laws, you can also complain to your local authority.

8. Security

We use HTTPS everywhere, encrypt connection tokens at rest, hash passwords, limit staff access, and keep systems updated. No method is perfectly secure, but we will tell you without undue delay if a breach affects your information.

9. Children

Postaro is not for anyone under 16. We do not knowingly collect information from children.

10. Changes

We will post changes on this page and update the date above. For important changes we will also email you before they take effect.

11. Contact

Questions or complaints about privacy:

• Email: privacy@postaro.app
• Privacy officer: [개인정보 보호책임자 / Privacy officer]
• [상호 / Business name], [사업장 주소 / Business address] (business registration [사업자등록번호 / Business registration no.], representative [대표자 / Representative])