Privacy Policy

Effective November 8, 2026

This policy explains what personal data Postology (postology.app) collects, what it does with it, who else handles it and the choices you have. It covers the Postology website and app, and the social media accounts you connect to it.

1. Who we are

Postology is operated by Pixelite SL, a company registered in Andorra (registration L-710633-B), with its address at Ed. La Llobatera Bloc B 1-2, Coll D'Ordino, Andorra. In this policy, "Pixelite", "we" and "us" mean Pixelite SL.

Pixelite is the controller of the personal data described here. When you put content in a workspace that is about other people (a video that shows someone, or a caption that names them), you decide what goes in, and we handle it on your behalf to run the service for you.

2. What we collect

Your account

• Your name, email address and timezone, and the time you last logged in.
• Your password, which we store only as a one-way hash. We cannot read it.
• The workspaces you belong to and your role in each. When someone invites you, we keep the email address they invited, the role and who sent the invitation.

Your workspace content

• Brands: name, color, logo, website, timezone, description, link tracking defaults and the storage region you pick.
• Topics, variations and their tags, publishing slots and experiments.
• Posts: title, caption, hashtags, first comment, link, schedule, status and notes, and who created them.
• The videos and images you upload, with their file name, size, dimensions, duration and checksum.
• Performance figures you enter, import from a file or that we read from the networks.
• An activity log of what happens in the workspace, such as who scheduled, changed or deleted a post and when.
• The client ID and client secret of the developer app your workspace registers on each network, which you save under Account settings. Secrets are encrypted before we store them.
• API tokens you create for the Postology API. We store only a hash of each token.

Connected social accounts

When you connect a channel, we store the access tokens the network gives us and some details about the account. Section 4 lists what we access on each network.

Technical data

• While you use the site, our server keeps a session record with your IP address, your browser's user agent and the time of your last request.
• To slow down password guessing, we count recent login and password reset attempts per email address and IP address. These counts cover the last 15 minutes only.
• When a network sends us a webhook that fails its signature check, we count it against a one-way hash of the sender's IP address, not the address itself.
• Our servers keep error and event logs. These can include IDs of workspaces, channels and posts, and error messages returned by the networks. Access tokens and signatures are removed from the logs of our publishing jobs.

Messages

Postology does not use an email delivery service. Password reset links, workspace invitations and alerts about posts that need a look are written, with the recipient's email address, to a log file on our server. When we need to tell you about the service, these terms or this policy, we email you ourselves at the address on your account.

3. How we use it

• To provide the service: log you in, keep your workspace, publish the posts you schedule to the channels you connect at the times you choose, check whether they went live and read back their performance figures.
• To keep the service secure and working: limit login attempts, check the signatures on webhooks, find and fix errors.
• To answer you when you contact us.
• To meet legal obligations.

We do this to perform our agreement with you (the Terms of Service), for our legitimate interest in running a secure and reliable service, to meet legal obligations and, when you connect a social account, because you chose to give us that access. You can withdraw that access at any time (see section 4).

We do not sell personal data, we do not use it for advertising and we do not use third-party analytics or advertising trackers. We read your content and your connected accounts only to do what you ask in Postology, or to help when you ask us to look into a problem.

4. Connected platforms

You can connect channels on the networks below to a brand. For every network except Bluesky, you sign in on the network's own site and approve the permissions listed, so Postology never sees your password there. The access tokens the network issues are encrypted before we store them, and we use them only for the posts and channels in your workspace.

Each workspace registers its own developer app on each of these networks (except Bluesky) and saves its client ID and secret in Postology. The network's permission screen and its list of connected apps show the name of the app your workspace registered, which is Postology only when your workspace uses Pixelite's own app.

For every connected channel we store the account or page ID, its name or handle, its public profile link, the tokens and when they expire, and the permissions granted. For every post we publish we store the network's post ID and link, its status and the figures we read back, such as views, likes, comments and shares.

When you disconnect or delete a channel in Postology, we delete its stored tokens and, where the network offers a way to do it, ask the network to revoke them. Removing your workspace's app in the network's own settings stops our access as well; the channel then shows as needing to be connected again, and disconnecting it in Postology removes the stored tokens. Disconnecting keeps the channel's ID, name and link and the figures already read for its posts, so those posts keep their history; deleting the channel removes them together with its posts.

TikTok

• Permissions: user.info.basic, video.publish, video.upload and video.list.
• We read your TikTok open ID, union ID, display name, avatar link and username, and the posting options TikTok allows your account (privacy levels, maximum video length and whether comments, duets and stitches are turned off).
• We upload the videos you schedule with their caption and settings, check their publishing status, and read view, like, comment and share counts for videos published through Postology. When the result of an upload is unclear, we list your most recent videos so you can match the right one to the post.
• TikTok can send us webhooks about the status of those posts.
• To revoke access, disconnect the channel in Postology (we ask TikTok to revoke the token), and remove your workspace's app from the apps listed in your TikTok privacy and security settings.

YouTube (Google)

• Postology uses YouTube API Services to upload, schedule and manage videos on the YouTube channels you connect.
• Permissions: the Google scopes youtube and youtube.force-ssl.
• We read your YouTube channel ID, title and link. We upload the videos you schedule with their title, description, thumbnail and publish time, post a first comment when you ask for one, change a scheduled video's publish time when you reschedule its post or make it private when you hold or pull it, and read view, like and comment counts for videos published through Postology. When the result of an upload is unclear, we list your most recent uploads so you can match the right one to the post.
• When you disconnect a YouTube channel, we delete its tokens but keep its channel ID, title and link, and the view, like and comment counts already read for its posts. Deleting the channel in Postology deletes those as well, together with its posts. To have them deleted without deleting the channel, contact us (section 13).
• Postology's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to provide the features described here, we do not transfer it to others except to provide those features, to comply with the law or with your consent, and we do not use it for advertising.
• By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
• To revoke access, disconnect the channel in Postology (we ask Google to revoke the token), and remove your workspace's app on your Google Account's third-party connections page.

Instagram (Meta)

• Permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_insights.
• We read your Instagram user ID, username and account type. We publish the Reels you schedule, post a first comment when you ask for one, and read insights and like and comment counts for posts published through Postology. Instagram fetches each video from a link to our storage that expires after two hours.
• To revoke access, disconnect the channel in Postology, which deletes the stored token, and remove your workspace's app under apps and websites in your Instagram settings. When you remove the app there or ask Meta to delete your data, Meta tells us and we disconnect the matching channels and delete their tokens.

Facebook (Meta)

• Permissions: pages_show_list, pages_manage_posts, pages_read_engagement, pages_read_user_content, publish_video and business_management.
• We read the Facebook user ID and name of the person who connects, and the ID, name and category of the Pages they manage, with a token for the Page you choose. We publish the videos and Reels you schedule to that Page, change or delete them when you reschedule or pull their post, post a first comment when you ask for one, and read engagement counts and video insights for posts published through Postology.
• To revoke access, disconnect the channel in Postology (we ask Facebook to remove our permissions unless another Facebook channel in the same workspace uses the same login), and remove your workspace's app under business integrations or apps and websites in your Facebook settings. Meta's removal and data deletion notices work as described for Instagram.

Threads (Meta)

• Permissions: threads_basic, threads_content_publish, threads_manage_replies, threads_manage_insights, threads_read_replies and threads_delete.
• We read your Threads user ID and username. We publish the posts you schedule, reply with a first comment when you ask for one, read insights for posts published through Postology, and delete a post when you pull it. Threads fetches each video from a link to our storage that expires after two hours.
• To revoke access, disconnect the channel in Postology, which deletes the stored token, and remove your workspace's app from the website permissions in your Threads settings. Meta's removal and data deletion notices work as described for Instagram.

X

• Permissions: tweet.read, tweet.write, users.read, media.write and offline.access.
• We read your X user ID, username and name. We upload the videos you schedule and post them, reply with a first comment when you ask for one, read public and non-public metrics for posts published through Postology, and delete a post when you pull it.
• To revoke access, disconnect the channel in Postology (we ask X to revoke the token), and remove your workspace's app from the connected apps in your X security settings.

LinkedIn

• Permissions for posting as yourself: openid, profile and w_member_social. For posting as an organization page: r_basicprofile, w_member_social, r_organization_admin, w_organization_social and r_organization_social.
• We read your LinkedIn member ID and name, or the organizations you administer. We upload the videos you schedule and post them as you or the organization, post a first comment when you ask for one, read likes and comments (and, for organization posts, share statistics) for posts published through Postology, and delete a post when you pull it.
• To revoke access, disconnect the channel in Postology (we ask LinkedIn to revoke the token), and remove your workspace's app under permitted services in your LinkedIn data privacy settings.

Bluesky

• Bluesky has no permission screen. You give us your handle and an app password you create in Bluesky's settings (never your main password). We store the app password encrypted and use it to sign in to your account.
• We read your handle and account identifier, publish the posts you schedule with their videos, reply with a first comment when you ask for one, read like, repost and reply counts for posts published through Postology, and delete a post when you pull it.
• To revoke access, disconnect the channel in Postology, which ends our session and deletes the stored app password, and delete the app password in your Bluesky settings.

Webhooks

TikTok, Meta and Threads can send Postology webhooks about your accounts and posts. These can include comments and replies by other people, with their usernames. We check each one's signature and store it, as received, with the workspace it belongs to. Today we act only on TikTok's publishing status updates, which mark a post live or failed sooner; the others are stored and not used.

5. Cookies and local storage

Postology sets two first-party cookies. Both are HttpOnly, so scripts on the page cannot read them.

• socials_session keeps you logged in and protects forms. It is set when you visit the site and is removed when you close your browser; the session behind it expires on our server after 24 hours without activity.
• socials_remember is set only when you choose "Keep me logged in" and lasts 30 days. We store a hash of its value, not the value itself.

The calendar remembers the view you picked in your browser's local storage; it never leaves your device.

There are no analytics, advertising or other third-party cookies, and the pages load no scripts from other sites.

6. Where your data is kept and who handles it

• DigitalOcean hosts the server that runs the Postology website, its database and its scheduler, in Sydney, Australia. Your account, workspace content (apart from uploaded files), connected account tokens, brand logos, sessions and logs are kept there.
• Google Cloud stores the videos and images you upload, in a private Cloud Storage bucket in the region you choose for each brand. Today that is United States (Iowa); Europe (Belgium), Asia Pacific (Singapore) and Australia (Sydney) are available on request. Your browser uploads files straight to that bucket; when it cannot, files up to 50 MB pass through our server on the way to the bucket. At publishing time, a Google Cloud Run job in the channel's region downloads the file from the bucket and uploads it to the network. For that upload it receives an access token for the channel, never the refresh token or the app's client secret, which stay on our server. The logs of these jobs are kept in Google Cloud Logging.
• The networks you connect receive the posts, videos and captions you choose to publish, and their own terms and privacy policies apply to what you publish there.

Files uploaded before a brand used regional storage, or while it was not available, are kept on our server in Sydney and published from there.

7. International transfers

Pixelite is based in Andorra, our server is in Australia and your uploaded files are in the region you choose, so your data is handled outside your own country. The networks you connect handle data in their own locations. These countries may not have the same data protection laws as yours. Google Cloud and DigitalOcean publish data processing terms that cover international transfers, and you can keep your uploaded files in Europe by choosing that region for a brand when it is available.

8. How long we keep it

• Your account and workspace content stay until you delete them or ask us to delete them. When you delete an uploaded file in Postology, it is removed from storage.
• Tokens for a connected channel stay until you disconnect or delete the channel, or Meta tells us you removed the app.
• A session expires after 24 hours without activity and is then deleted. If you choose "Keep me logged in", that sign-in lasts 30 days.
• Password reset links stop working after one hour and invitations after 7 days.
• A disconnected channel's ID, name and link and the figures read for its posts stay until you delete the channel or ask us to delete them.
• The activity log and stored webhooks are kept while the workspace exists. Our server logs, including the mail log with recipient email addresses and the links in each message, are not yet deleted on a schedule. The logs of our publishing jobs are kept for Google Cloud Logging's default retention period.

Postology has no button to delete your whole account or workspace, or to export your data. To do either, contact us (section 13) and we will do it for you.

9. Security

• The site is served over HTTPS, and our session cookies are marked HttpOnly and SameSite=Lax.
• Passwords are stored as one-way hashes. API tokens and "Keep me logged in" tokens are stored as hashes too.
• Access tokens, refresh tokens, Bluesky app passwords and developer app secrets are encrypted before they are stored, with a key held on our server.
• Uploaded files are kept in private storage. A network that has to fetch a file gets a signed link that expires after two hours.
• Login and password reset attempts are rate limited, and webhooks and our publishing jobs' requests are checked by signature.
• Workspace roles (owner, admin, member and viewer) limit what each member can do.

No service is perfectly secure. If we learn of a breach that affects your personal data, we will email you at the address on your account and tell the authorities, as the law requires.

10. Your rights

Depending on where you live, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format, and you can withdraw consent you gave (for example, by disconnecting a channel). You can change your name and timezone yourself under Account settings. To reset your password, or for anything else, contact us (section 13). We answer within one month.

If you think we have not handled your data properly, you can complain to the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, APDA) or to the data protection authority in your country.

11. Children

Postology is not meant for anyone under 18, and we do not knowingly collect data from them. If you think a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this page when Postology changes the way it handles data, and change the effective date at the top. If a change matters to how your data is used, we will email workspace owners at the address on their account before it takes effect.

13. Contact

For questions about this policy or your personal data, or to make a request, write to Pixelite SL, Ed. La Llobatera Bloc B 1-2, Coll D'Ordino, Andorra.