# Privacy Policy > What PostMesh collects, why, who it is shared with, how long it is kept, and your rights, including how each connected network’s data is handled. Effective 2026-11-01. This Privacy Policy explains what information the company that makes PostMesh (“we”, “us”, or “our”; see [Who we are](https://postmesh.app/legal/privacy#who-we-are)) collects when you use postmesh.app, the PostMesh app, the API and MCP server, our free tools, and related services (the “Services”), how we use and share it, and the choices and rights you have. It is shown before you sign up and remains available at /legal/privacy. Words defined in our [Terms of Service](https://postmesh.app/legal/terms) mean the same here. **We do not sell your personal information, and we do not use it for advertising.** We use it to run the Services you asked for. This policy describes: - [What we collect](https://postmesh.app/legal/privacy#information) and [how we use it](https://postmesh.app/legal/privacy#purpose) - How we handle data from [X](https://postmesh.app/legal/privacy#x), [LinkedIn](https://postmesh.app/legal/privacy#linkedin), [TikTok](https://postmesh.app/legal/privacy#tiktok), [Facebook, Instagram, and Threads](https://postmesh.app/legal/privacy#meta), [Reddit](https://postmesh.app/legal/privacy#reddit), and [Google and YouTube](https://postmesh.app/legal/privacy#google) - [Post performance metrics](https://postmesh.app/legal/privacy#post-metrics) and [AI features, Clip Factory, and free tools](https://postmesh.app/legal/privacy#ai) - [Who we share it with](https://postmesh.app/legal/privacy#sharing), and [cookies and analytics](https://postmesh.app/legal/privacy#analytics) - [How long we keep it](https://postmesh.app/legal/privacy#retention), [where](https://postmesh.app/legal/privacy#transfers), and [how we protect it](https://postmesh.app/legal/privacy#security) - [Your rights and choices](https://postmesh.app/legal/privacy#your-controls), [children](https://postmesh.app/legal/privacy#children), and [changes to this policy](https://postmesh.app/legal/privacy#changes) - [Who we are](https://postmesh.app/legal/privacy#who-we-are) and [how to contact us](https://postmesh.app/legal/privacy#requests) ## 1. What we collect **Information you give us.** - **Account data:** your email address, password (stored by our authentication provider as a hash, never in plain text), sign-in method, and any passkeys you add (the provider keeps each passkey’s public key and name; the private key stays on your device). If you sign in with Google, we receive your Google account email. We email you one-time codes to confirm your address or reset your password. - **Connected account data:** for each social account you connect through a network’s sign-in, its identifiers, handle, display name, avatar, the authorization tokens the network issues, and the permissions granted. Details for each network are below. - **Content:** drafts, captions, uploaded media, schedules, imported CSV drafts, preferences, publishing outcomes (including destination post IDs, links, and status), AI agent chats, brand-voice samples and profile, and Clip Factory jobs (the YouTube link, title, and suggested clips). - **Billing data:** your plan, billing interval, subscription status and dates, and Stripe customer and subscription references. Stripe collects your card details and billing address; we never see or store your full card number. - **Support data:** messages you send us and our replies. - **Free tools:** the text you type into the free AI tools on our website, which you can use without an account (see [AI features](https://postmesh.app/legal/privacy#ai)). **Information collected automatically.** When you use the Services, we and our providers record technical data such as IP address, browser and device type, pages viewed, referring page, and product events like saving a draft or a publish result. See [Cookies and analytics](https://postmesh.app/legal/privacy#analytics). **Information from networks.** When you connect a network through its sign-in, it sends us the account details and tokens described in that network’s section below. For posts published through PostMesh, we also ask the network for performance metrics; see [Post performance metrics](https://postmesh.app/legal/privacy#post-metrics). **No sensitive categories.** We don’t ask for special categories of personal data (such as health, religion, or biometric data) or information about criminal convictions. Please don’t include them in your Content unless you intend to publish them. ## 2. How we use it and why We use this information to authenticate your account, store your work, publish and schedule the posts you request, show history and performance, run the AI features you use, manage subscriptions and offers, send service emails, prevent abuse, investigate failures, keep the Services secure, provide support, and comply with law. Your posts and media are sent to the networks you select, and those networks apply their own terms and privacy policies, including X’s Privacy Policy, LinkedIn’s Privacy Policy, TikTok’s Privacy Policy, Meta’s Privacy Policy, Reddit’s Privacy Policy, and the Google Privacy Policy. **Legal bases (EU and UK).** Where the GDPR applies, we rely on: - **Contract:** to provide the Services you signed up for, including publishing, scheduling, billing, and support; - **Legitimate interests:** to keep the Services secure, prevent fraud and abuse, understand how the Services are used through analytics, credit referrals, and improve the Services, where those interests aren’t overridden by yours; - **Consent:** where we ask for it, such as connecting a network account; you can withdraw it at any time by disconnecting; and - **Legal obligation:** to keep billing records and respond to lawful requests. **What we don’t do.** We don’t sell personal information, share it for cross-context behavioral advertising, build advertising profiles, or use social account data for surveillance, credit, insurance, or employment decisions. ## 3. X (Twitter) **Connection and publishing.** If you connect X, PostMesh uses official Sign-in with X / OAuth 2.0. We request scopes needed to identify your account, stay connected, upload media, and create posts you approve: users.read, tweet.read, tweet.write, media.write, and offline.access. We store X OAuth access and refresh tokens, your X user ID, @handle, display name, avatar URL, and verification flags when provided. We store drafts and history for posts you create in PostMesh, including text and media you attach and the resulting X post ID when publish succeeds, and we read public metrics (such as impressions, likes, reposts, and replies) for posts published through PostMesh. We do not ask for or store your X password. We do not request Direct Message access. We do not read your X Direct Messages. We do not use the X API for surveillance, credit or insurance decisions, sensitive inferences about people, competitive benchmarking of X, bulk spam actions, or selling engagement. PostMesh’s use of the X API and X Content is intended to comply with the X Developer Agreement, X Developer Policy, Automation Rules, and related X policies. **Sharing.** We share information with X when you connect an account or when you publish or schedule a post: the caption and media you chose are sent to X through the official API so X can create the post on your account. Connection and token data is stored with our infrastructure providers that process data on our behalf under contract (see [Who we share it with](https://postmesh.app/legal/privacy#sharing)). We do not sell X user data. We do not share X tokens or X Content with advertisers or data brokers. We do not redistribute X Content datasets to third parties. Stripe does not receive X OAuth tokens from PostMesh. **Consent before we post.** Connecting X alone is not consent to publish. Before PostMesh creates a post on X, you compose or review the content in Create post, choose destinations including X, and explicitly publish now or schedule, or you send a publish or schedule request yourself with your API key, including from an MCP client you connected. We do not add geolocation tags to X posts. Scheduled posts use the content you approved and fire only at the time you set. You can disconnect X in Connections or revoke PostMesh in your X account settings at any time. **Retention and deletion.** We retain X connection data only while you keep X connected or as needed to finish a publish or schedule you requested, unless a longer period is required or permitted by law. When you disconnect X in Connections, or when you delete your account in Settings under Data & privacy, we delete the X OAuth tokens and the connection record from our database right away; copies in our database provider’s backups expire on their normal schedule. Revoking PostMesh in your X account settings stops the tokens working at once, but the stored connection stays in PostMesh until you disconnect it there. Publishing history in PostMesh may retain captions you wrote, media references, status, metrics, and X post IDs until you delete that history or your account. If X or you ask us to delete or modify stored X Content that is no longer available on X, we will delete or update our stored copy as soon as reasonably possible and within 24 hours of a valid request, unless law requires otherwise. Disconnecting PostMesh does not delete a post already published on X. ## 4. LinkedIn **Connection and publishing.** If you connect LinkedIn, PostMesh uses official OAuth 2.0 with Sign In with LinkedIn using OpenID Connect and Share on LinkedIn. We request openid, profile, email, and w_member_social. We store LinkedIn OAuth access and refresh tokens, your LinkedIn person ID (sub), name, profile photo URL, and email when LinkedIn returns them. We store drafts and history for posts you create in PostMesh, including text and media you attach and the resulting LinkedIn post URN when publish succeeds. These permissions don’t include LinkedIn’s access for reading post metrics, so PostMesh can’t show LinkedIn reaction or comment counts. We publish only to your connected member profile. Organization / Company Page posting is not supported in the current integration. We do not ask for or store your LinkedIn password. PostMesh’s use of LinkedIn APIs is intended to comply with the LinkedIn API Terms of Use and LinkedIn developer best practices. **Sharing.** We share information with LinkedIn when you connect an account or when you publish or schedule a post: the caption and media you chose are sent to LinkedIn through the official API so LinkedIn can create the post on your profile. Connection and token data is stored with our infrastructure providers under contract. We do not sell LinkedIn user data. We do not share LinkedIn tokens with advertisers or data brokers. Stripe does not receive LinkedIn OAuth tokens from PostMesh. **Consent before we post.** Connecting LinkedIn alone is not consent to publish. Before PostMesh creates a LinkedIn post, you compose or review the content in Create post, choose destinations including LinkedIn, and explicitly publish now or schedule, or you send a publish or schedule request yourself with your API key. You can disconnect LinkedIn in Connections or revoke PostMesh in your LinkedIn authorized apps at any time. **Retention and deletion.** We retain LinkedIn connection data only while you keep LinkedIn connected or as needed to finish a publish or schedule you requested, unless a longer period is required or permitted by law. When you disconnect LinkedIn in Connections, or when you delete your account in Settings under Data & privacy, we delete the LinkedIn tokens and the connection record from our database right away; backup copies expire on their normal schedule. Revoking PostMesh in LinkedIn stops the tokens working, but the stored connection stays in PostMesh until you disconnect it there. Publishing history may retain captions, media references, status, and LinkedIn post URNs until you delete that history or your account. Disconnecting PostMesh does not delete a post already published on LinkedIn. ## 5. TikTok **Connection and publishing.** If you connect TikTok, PostMesh uses official Login Kit / OAuth 2.0 on TikTok for Developers. We request user.info.basic, video.publish, and video.upload so we can identify your TikTok profile, Direct Post content you approve, and fall back to Inbox upload when Direct Post is unavailable. We store TikTok OAuth access and refresh tokens, your TikTok open_id, username, display name or nickname, and avatar URL when TikTok returns them. We store drafts and history for posts you create in PostMesh, including captions, media references, privacy and interaction settings you choose, commercial disclosure flags, publish IDs, and status. We don’t request TikTok’s video list permission, so PostMesh doesn’t receive view, like, comment, or share counts for TikTok posts. We do not ask for or store your TikTok password. We do not request research, portability, Direct Message, or advertising scopes. PostMesh’s use of TikTok APIs is intended to comply with the TikTok Developer Terms of Service, TikTok Platform Terms, Content Sharing Guidelines, and related TikTok developer policies. **Sharing.** We share information with TikTok when you connect an account or when you publish or schedule a post: the caption, media, and post settings you chose are sent to TikTok through the official Content Posting API so TikTok can create or draft the post on your account. Photos and preferred video transfers use HTTPS URLs on a media domain PostMesh verifies with TikTok when Pull from URL is available; otherwise video bytes are uploaded to TikTok with FILE_UPLOAD. Connection and token data is stored with our infrastructure providers under contract. We do not sell TikTok user data. We do not share TikTok tokens with advertisers or data brokers. Stripe does not receive TikTok OAuth tokens from PostMesh. **Consent before we post.** Connecting TikTok alone is not consent to publish. Before PostMesh sends content to TikTok, you compose or review the caption and media in Create post, choose TikTok as a destination, manually select who can watch, set interaction and commercial disclosure options when shown, and explicitly publish now or schedule. We show Music Usage Confirmation consent copy (and Branded Content Policy language when branded content is selected). TikTok may sometimes limit a post to private viewing, or send it to your TikTok inbox to finish in the app. You can disconnect TikTok in Connections or revoke PostMesh in your TikTok account settings at any time. **Retention and deletion.** We retain TikTok connection data only while you keep TikTok connected or as needed to finish a publish or schedule you requested, unless a longer period is required or permitted by law. When you disconnect TikTok in Connections, or when you delete your account in Settings under Data & privacy, we delete the TikTok tokens and the connection record from our database right away; backup copies expire on their normal schedule. Revoking PostMesh in TikTok stops the tokens working, but the stored connection stays in PostMesh until you disconnect it there. Publishing history may retain captions, media references, status, and TikTok publish IDs until you delete that history or your account. Disconnecting PostMesh does not delete a post already published on TikTok. ## 6. Facebook, Instagram, and Threads **Facebook Pages.** If you connect Facebook, PostMesh uses Facebook Login for Business and the Facebook Pages API. We request pages_show_list, pages_read_engagement, and pages_manage_posts so we can list Pages you manage, publish text, photo, or video posts you approve to those Pages, and ask for reactions, comments, shares, and impressions for posts published through PostMesh, as far as these permissions allow. We store Facebook user and Page access tokens, your Facebook user id (for deauthorization and data-deletion callbacks), Page id, Page name, and Page avatar when returned. We store drafts and history for posts you create in PostMesh, including captions, media references, status, metrics, and Facebook post ids when publish succeeds. We publish only to Pages you select during Connect, not to personal profiles. We do not ask for or store your Facebook password. We do not request Messenger, ads, or comment-moderation permissions. PostMesh’s use of Facebook APIs is intended to comply with Meta Platform Terms, Developer Policies, and Facebook Pages API requirements. **Instagram.** If you connect Instagram, PostMesh uses Instagram API with Instagram Login (Business Login for Instagram). We request instagram_business_basic and instagram_business_content_publish so we can identify your professional Instagram account, publish image or Reel posts you approve, and ask for like and comment counts, and impressions and reach where Instagram provides them, for posts published through PostMesh. We store Instagram OAuth access tokens, your Instagram user id, username, verification flag, and profile photo URL when returned. We store drafts and history for posts you create in PostMesh, including captions, media references, container and media ids, metrics, and status. Instagram requires media; text-only posts are not supported. Videos publish as Reels with share_to_feed enabled so they can appear in Feed. We do not ask for or store your Instagram password. We do not request Instagram messaging or comment-moderation permissions. PostMesh’s use of Instagram APIs is intended to comply with Meta Platform Terms, Developer Policies, and Instagram Platform content-publishing requirements. **Threads.** If you connect Threads, PostMesh uses Threads OAuth and the Threads API. We request threads_basic and threads_content_publish so we can identify your Threads profile, publish text, image, or video posts you approve, and ask for views, likes, replies, and reposts for posts published through PostMesh, which Threads returns only where these permissions allow. We store Threads OAuth access and refresh tokens, your Threads user id, username, display name, and profile photo URL when returned. We store drafts and history for posts you create in PostMesh, including captions, media references, container and post ids, metrics, and status. We do not ask for or store your Threads password. We do not request reply management or deletion permissions. PostMesh’s use of Threads APIs is intended to comply with Meta Platform Terms, Developer Policies, and Threads API requirements. **Sharing.** We share information with Meta (Facebook, Instagram, or Threads) when you connect an account through Meta’s sign-in or when you publish or schedule a post: for accounts connected that way, the caption and media you chose are sent through the official Graph or Threads APIs so Meta can create the post on the destination you selected. Media for Instagram, Facebook photo/video, and Threads image/video must be reachable over HTTPS so Meta can download it; PostMesh stages that media on Cloudflare R2 when needed. Connection and token data is stored with our infrastructure providers under contract. We do not sell Meta user data. We do not share Meta tokens with advertisers or data brokers. Stripe does not receive Meta OAuth tokens from PostMesh. **Consent before we post.** Connecting Facebook, Instagram, or Threads alone is not consent to publish. Before PostMesh creates a post on those networks, you compose or review the caption and media in Create post, choose the destinations, and explicitly publish now or schedule, or you send a publish or schedule request yourself with your API key. You can disconnect each network in Connections or revoke PostMesh in Facebook, Instagram, or Threads settings at any time. **Retention and deletion.** We retain Facebook, Instagram, and Threads connection data only while you keep each network connected or as needed to finish a publish or schedule you requested, unless a longer period is required or permitted by law. We delete the tokens and connection records from our database when you disconnect that network in Connections, when Meta sends us a verified deauthorization or data-deletion request for that network (which happens when you remove PostMesh in Facebook, Instagram, or Threads settings or ask Meta to delete your data), or when you delete your account in Settings under Data & privacy; backup copies expire on their normal schedule. Publishing history may retain captions, media references, status, metrics, and destination post ids until you delete that history or your account. Disconnecting PostMesh does not delete a post already published on Facebook, Instagram, or Threads. **Meta deletion requests.** If you remove PostMesh from Facebook, Instagram, or Threads, or submit a data deletion request there, Meta sends PostMesh a signed request. We verify it and delete the connections stored for that user on that network. A confirmation page is available at /legal/data-deletion. ## 7. Reddit **Connection and publishing.** If you connect Reddit, PostMesh uses Reddit’s official OAuth 2.0. We request identity, submit, mysubreddits, read, and flair so we can identify your Reddit account, list the communities you belong to and their post flairs, submit posts you approve, and read the score and comment count of posts published through PostMesh. We store Reddit OAuth access and refresh tokens, your Reddit username, and your Reddit account identifier. We do not ask for or store your Reddit password, and we do not read your private messages. **Sharing, consent, and deletion.** The title, text, link, flair, and media you choose are sent to Reddit through the official API when you publish or schedule. Connecting Reddit alone is not consent to publish. When you disconnect Reddit in Connections, we ask Reddit to revoke the token and delete the connection record. We do not sell Reddit user data. Disconnecting PostMesh does not delete a post already published on Reddit. ## 8. Google sign-in and YouTube **What we access.** If you sign in with Google, PostMesh receives your Google account email so we can create or match your PostMesh account. If you connect YouTube, PostMesh asks for OAuth access to see the YouTube channel you manage (youtube.readonly) and to upload videos you send from Create post (youtube.upload). It also asks for youtube.force-ssl, used only to make a scheduled video private, or delete it, when you cancel that schedule in PostMesh. We store Google OAuth access and refresh tokens, your channel identifier, channel name or handle, and related upload metadata on our servers only to finish an upload or schedule you requested and to show results. We do not read your YouTube watch history, comments, subscriptions, or playlists you created. The only YouTube channel data we read is your channel identifier, name, handle, and avatar, to show which channel is connected; right after you send a video, the titles of your channel’s few most recent uploads, to confirm that video arrived and avoid uploading a duplicate; and the view, like, and comment counts of videos you published through PostMesh, to show them in Analytics. Clip Factory doesn’t use your Google sign-in or YouTube connection. We do not sell Google or YouTube user data. We do not use Google user data for advertising, personalized ads, credit decisions, or unrelated AI or data-broker products, and we do not use it to train AI models. **Limited Use.** PostMesh’s use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. **Sharing, transfer, and disclosure.** We do not transfer or disclose Google user data to third parties for purposes other than providing PostMesh. With whom we share, transfer, or disclose Google user data: (1) Google and YouTube, when you publish or schedule a video, we send the video file, title, description, and related upload settings you provide so YouTube can accept the upload; (2) our infrastructure providers that process data on our behalf under contract: Supabase (authentication and database storage of OAuth tokens and account records), Vercel (application hosting), and Cloudflare (media staging when another destination also needs the file or the browser cannot reach YouTube directly); (3) you or someone you authorize, when you export workspace data or we fulfill a verified support request; (4) our AI provider (OpenAI), only when you open the AI video read in Analytics: the video’s title, its view, like, and comment counts, and a short excerpt of its public captions (which our servers read from the video’s public YouTube page, not through your Google account), so the provider can write suggestions for you (never OAuth tokens); and (5) authorities or others when required by law, legal process, or to protect PostMesh, our users, or the public from fraud or security threats. We do not share Google user data with advertisers or data brokers. Stripe does not receive YouTube OAuth tokens or YouTube channel content from PostMesh. **YouTube Terms of Service, Google Privacy Policy, and revoking access.** PostMesh uses YouTube API Services to upload videos you send to your YouTube channel. By connecting a YouTube channel to PostMesh, you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms. YouTube data accessed through PostMesh is also subject to the Google Privacy Policy: https://policies.google.com/privacy. You can revoke PostMesh’s access to your Google account and YouTube channel at any time in your Google Account security settings: https://myaccount.google.com/connections. You can also disconnect YouTube in PostMesh Connections, which also asks Google to revoke the token. **Retention and deletion.** We retain Google user data only for the length of time needed to provide PostMesh, unless a longer period is required or permitted by law. Google sign-in email and authentication identifiers are kept while your PostMesh account exists. YouTube OAuth tokens and channel connection records are kept while YouTube remains connected so we can publish or schedule on your behalf. When you disconnect YouTube in Connections, we ask Google to revoke the token and delete the tokens and channel record from our database right away; we do the same when you delete your account in Settings under Data & privacy. Backup copies expire on their normal schedule. If you revoke PostMesh only in your Google Account permissions, the token stops working, but the stored channel record stays in PostMesh until you disconnect it in Connections. You may request deletion of your Google user data from PostMesh by disconnecting YouTube in Connections, revoking PostMesh under your Google Account permissions, and deleting your account in Settings under Data & privacy for full workspace deletion. Scheduled YouTube jobs that still depend on a revoked connection fail and are not retried with those tokens. Publishing history may retain the fact that a YouTube upload was attempted or completed (such as time, status, and metrics) until you delete that history or your account; it does not keep the OAuth token. Deleting Google data from PostMesh does not delete a video already published on YouTube. ## 9. Post performance metrics To show how your posts perform, PostMesh asks each network for metrics on posts published through PostMesh, using the permissions described above: impressions, likes, reposts, and replies on X; reactions, comments, shares, and impressions on Facebook; likes, comments, impressions, and reach on Instagram accounts connected with Instagram Login; views, likes, replies, and reposts on Threads; score and comments on Reddit; and views, likes, and comments on YouTube. A network returns only what the permissions we hold allow, so some figures can be missing. We don’t hold the permissions TikTok and LinkedIn require for post metrics. **Where a network doesn’t return a view or impression count, Analytics shows views as not reported and gives no engagement rate for those posts; PostMesh doesn’t estimate them.** We store these figures with the post’s history. We don’t read metrics for posts you published outside PostMesh, and we don’t read information about the people who engaged with your posts. ## 10. AI features, Clip Factory, and free tools **Providers.** AI features are powered by OpenAI. When you use them, we send OpenAI what that feature needs: for the AI agent, your messages, relevant workspace context such as drafts, recent posts and their metrics, and your brand-voice profile, and the text of links you share with it (which our servers fetch); for analytics insights and the AI video read, your post content and metrics and, for a YouTube video, its title and a short excerpt of its public captions; for Clip Factory, the video’s title, channel name, description, and timed caption excerpts; and for the free tools, the text you type and the options you choose. We never send connected-account tokens or passwords to AI providers. **Training and storage.** We don’t use your Content to train AI models. We send requests to OpenAI with its response storage turned off, and OpenAI doesn’t train on API data by default; OpenAI may keep API data for a limited time to monitor abuse, under its API terms. Your agent chats and brand-voice samples are saved in your PostMesh account until you delete them or your account. **Clip Factory.** When you give Clip Factory a YouTube video or channel, our servers look up its public details through the YouTube Data API with our own API key, or, when that isn’t available, by reading YouTube’s public web pages; read the video’s public captions from its YouTube watch page; download the video file from YouTube with the open-source tools yt-dlp and ffmpeg, which run on our own servers; and cut and reframe the clips there. For the CTA stitcher, the video you upload is processed the same way. Downloaded videos and finished clips are kept in temporary storage on those servers, not with your account. The job’s link, title, and suggested clips are saved in your account so you can come back to them. Clip Factory doesn’t use your Google sign-in or YouTube connection. **Free tools.** The free AI tools on our website send the text you enter to OpenAI to write suggestions, and we don’t save that text. To limit use, we keep a request counter keyed to a one-way hash of your IP address, which allows a few requests per visitor each day. ## 11. Who we share it with **Service providers.** We share information with providers that process it on our behalf, under contract, only to run the Services: - **Supabase:** authentication (passwords, passkeys, sign-in codes) and database, including connected-account tokens. - **Vercel:** application hosting, server functions, scheduled jobs, request logs, and Vercel Web Analytics. - **Cloudflare (R2):** storage of media you upload, at public web addresses so networks can download it. - **Stripe:** payments, subscriptions, discounts, invoices, and the billing portal. Checkout also carries your PostMesh account ID, plan, and any referral or traffic-source values described in [Cookies and analytics](https://postmesh.app/legal/privacy#analytics). - **Resend:** service emails such as welcome, trial reminder, payment failed, plan ended, failed post, and security notices. - **OpenAI:** AI features, as described in [AI features](https://postmesh.app/legal/privacy#ai). - **Google (YouTube Data API):** Clip Factory sends it the YouTube video and channel addresses you give it, to look them up. YouTube also receives our servers’ requests when Clip Factory reads captions or downloads a video. - **Mintlify:** hosts our documentation at postmesh.app/docs, so it receives the requests (including IP address and browser details) for those pages. - **PostHog:** product analytics, error and crash reports, and masked session replays, as described in [Cookies and analytics](https://postmesh.app/legal/privacy#analytics). - **Google Analytics, Mixpanel, and Ahrefs:** site and product analytics, as described in [Cookies and analytics](https://postmesh.app/legal/privacy#analytics). **The networks you choose.** Your posts, media, and settings go to the networks you publish to, as described above. Content you publish becomes public on that network under its own rules. **Our Discord community.** If you join the PostMesh Discord, Discord handles what you share there under its own terms and privacy policy. **Legal reasons and business transfers.** We may disclose information when required by law, legal process, or a governmental request, or to protect PostMesh, our users, or the public from fraud, abuse, or security threats; we disclose only what is necessary. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that deal, and this policy will continue to apply to it. **No sale.** We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws such as the California Consumer Privacy Act. ## 12. Cookies and analytics **How consent works.** There is no cookie banner. Analytics run when you visit unless your browser sends a Do Not Track or Global Privacy Control signal, as described below. Google’s consent settings start with analytics storage allowed, and advertising storage, ad user data, and ad personalization denied. **Cookies and local storage.** - **Sign-in:** Supabase session cookies with auth-token in their name, kept until you sign out or they expire. - **Network sign-in protection:** postmesh-oauth-, set when you start connecting a network, for 10 minutes. - **Language:** postmesh-locale, for 1 year. - **Region:** pm_region, the two-letter country of your network location, so our site shows the offers for your country (such as a sale that runs only in India), for 1 day. - **Referral and traffic source:** fl_aff_program, fl_aff_click, and fl_aff_code (from FoundrList referral links) and datafast_visitor_id and datafast_session_id (DataFast). PostMesh doesn’t set these itself; if your browser has them when you start checkout, we copy their values into the checkout’s details at Stripe so a referral or traffic source can be credited. - **PostHog:** a first-party cookie and a local storage entry named ph__posthog, which recognize your browser between visits, for up to 1 year. - **Google Analytics:** _ga and _ga_, set by Google, for up to 2 years. - **Mixpanel:** a local storage entry named mp__mixpanel. - **PostMesh local storage:** preferences such as sidebar and composer settings, cached drafts and agent chats for speed, plan status, and sign-in hints, under keys starting with postmesh, post-, or fl_oauth_. They stay until you clear them. You can clear cookies and local storage in your browser; you may then need to sign in again. **Analytics.** - **PostHog** records page views, product events (such as saving a draft or a publish result), errors and crashes, page performance, heatmaps, and session replays of how the site is used, so we can find and fix problems. It is linked to your account ID, never your email. Replays mask everything you type, and inside the workspace they also hide all text and your photos and videos, so the content of your posts is never recorded. Tokens and codes are removed from page addresses before anything is sent. Our servers also report publish results (the network and whether it worked, never the caption), subscription changes, and server errors. PostHog does not load at all when your browser sends Do Not Track or Global Privacy Control. - **Google Analytics** records page traffic on the live site, with Google Signals and ad personalization turned off. If your browser sends a Do Not Track or Global Privacy Control signal, we switch Google’s analytics storage to denied, so it sets no cookies; Google may still receive basic measurement requests without cookies from the page. - **Mixpanel** records product events such as a page view, draft save, or publish result, linked to your account ID, with limited properties such as platform and plan. We tell it not to use your IP address for location, and it doesn’t receive page addresses, captions, uploaded content, passwords, or tokens. It records no session replays and stays off when your browser sends Do Not Track or Global Privacy Control. - **Vercel Web Analytics** and **Ahrefs Web Analytics** count visits and page views so we can see which pages are read. They load whatever your Do Not Track or Global Privacy Control settings are. We don’t use advertising cookies or ad pixels. You can block analytics with your browser’s privacy settings or extensions, or use the Google Analytics opt-out add-on: https://tools.google.com/dlpage/gaoptout. ## 13. How long we keep it **While you have an account.** We keep information for as long as your account is active or as needed to provide the Services. Drafts, history, agent chats, brand voice, Clip Factory jobs, and other Content stay until you delete them or delete your account. Connected-account tokens are kept only while the account stays connected and are deleted from our database when you disconnect it, as described for each network above. **Uploaded media.** Files you upload are stored in Cloudflare R2 at long, random web addresses that anyone with the address can open. Deleting your account deletes all of them. Deleting a draft or a history entry doesn’t yet delete its files automatically; some files staged only for a YouTube upload are deleted once it finishes. If you want your files deleted without closing your account, email hello@postmesh.app from your account email and we’ll delete them by hand. **When you delete your account.** You delete your account yourself in Settings under Data & privacy, which asks you to confirm. It cancels your Stripe subscriptions at once and expires any open checkout, asks Reddit and Google to revoke PostMesh’s tokens, deletes your uploaded media files, deletes your account and the data linked to it from our database, and then deletes your sign-in. We keep limited records longer where we must, such as billing and tax records (Stripe keeps its own payment records), records needed to resolve disputes, prevent fraud, or enforce our Terms, and copies in backups until they expire on their normal schedule. If you started a free trial, we also keep a keyed one-way hash of the card’s Stripe fingerprint and of the social account IDs you had connected, no longer linked to your account, so the same card or social account can’t start another free trial. **Other data.** Analytics data is kept under each analytics provider’s retention settings. ## 14. Where we store it The Services are run from the United States, and our providers may process information in the United States and other countries where they operate. These countries may have data protection laws different from yours. Where the law requires, we rely on safeguards such as the Standard Contractual Clauses in our providers’ data processing terms for transfers out of the EU, UK, or Switzerland. ## 15. How we protect it Security procedures are in place to protect the confidentiality of Google user data, X user data, LinkedIn user data, TikTok user data, Meta user data, Reddit user data, and other information. Data travels over HTTPS / TLS between your browser, PostMesh, and our providers, and our providers encrypt stored data at rest. Connected-account tokens are encrypted by PostMesh (AES-256-GCM, with a key kept outside the database) before they are saved, and the database is also encrypted at rest. Access rules let only our servers read them, never the browser. API keys are stored only as a hash. Uploaded media is stored at long, random web addresses so networks can download it; anyone who has an address can open that file. Access is limited to systems and people that need it to run publishing, scheduling, support, or security work. Secrets stay in server-side configuration and are not embedded in the public app. No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the authorities as the law requires. ## 16. Your rights and choices **In the app.** You can edit or delete drafts and history, disconnect accounts in Connections, revoke API keys, cancel your subscription in Billing, turn off failed-post alerts and tips in Settings, and export your workspace data in Settings under Data & privacy. The export contains your account ID and email, drafts, publishing history, connected accounts (network, handle, and ID, never tokens), posting-time settings, and plan status. It doesn’t include uploaded media files, agent chats, brand-voice samples, Clip Factory jobs, or API key details; email us for a copy of those. Deleting PostMesh history does not delete a post already published to a social network. **Your rights.** Depending on where you live, you may have the right to: - access the personal data we hold about you and get a copy; - correct inaccurate data; - delete your data; - receive your data in a portable format; - object to or restrict certain processing, including processing based on legitimate interests; - withdraw consent where we rely on it, without affecting processing already done; and - not be discriminated against for exercising these rights. **How to exercise them.** Email hello@postmesh.app from your account email. We may need to verify that the request comes from you before acting on it. An authorized agent can make a request for you with proof of your permission. We respond within one month (45 days where U.S. state law sets that period), and we’ll tell you if we need longer. Requests are free unless they are clearly unfounded or excessive. **U.S. state privacy laws.** If a U.S. state privacy law such as the California Consumer Privacy Act applies to you: in the last 12 months we collected identifiers (such as your email address, account IDs, and IP address), commercial information (your plan and billing history), internet activity (analytics events), and the content you create, from you, your browser, and the networks you connect, for the purposes described above. We disclosed them for business purposes to the providers listed in [Who we share it with](https://postmesh.app/legal/privacy#sharing). We don’t sell or share personal information for cross-context behavioral advertising, and we don’t use sensitive personal information to infer characteristics about you. Global Privacy Control turns off PostHog and Mixpanel and stops Google Analytics from storing cookies in that browser. **Complaints.** If you have a concern, contact us first and we’ll try to resolve it. If you’re in the EU, UK, or Switzerland, you also have the right to complain to your local data protection authority. ## 17. Children The Services are for people 18 and older and are not directed to children. We don’t knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email hello@postmesh.app and we’ll delete it. ## 18. Links to other websites The Services link to social networks and other websites we don’t operate. This policy doesn’t apply to them; their own privacy policies do. ## 19. Changes to this policy This policy may change as the product, our providers, or the law change. The date at the top shows when the current version took effect. For material changes, we’ll tell you by email or in the Services before they take effect. ## 20. Who we are OG APPS, LLC, which makes and sells PostMesh, is “we” in this policy and the controller of the personal data described here, including for the purposes of the EU and UK General Data Protection Regulation (GDPR) and the “business” under U.S. state privacy laws. ## 21. Contact and data requests Contact hello@postmesh.app from your account email for access, correction, export, deletion, or other privacy questions. We may verify ownership before fulfilling a request. To delete data from a specific network, disconnect it in Connections, which deletes the stored tokens and connection. Revoking PostMesh in a network’s own settings stops our access, but for X, LinkedIn, TikTok, and YouTube the stored connection stays in PostMesh until you disconnect it: - **Google and YouTube:** disconnect YouTube in Connections (we also ask Google to revoke the token), and revoke PostMesh under your Google Account permissions if you wish. - **X:** disconnect X in Connections and revoke PostMesh in your X account settings. - **LinkedIn:** disconnect LinkedIn in Connections and revoke PostMesh in your LinkedIn authorized apps. - **TikTok:** disconnect TikTok in Connections and revoke PostMesh in your TikTok account settings. - **Facebook, Instagram, or Threads:** disconnect that network in Connections, or remove PostMesh in the network’s settings or use Meta’s data deletion request, which tells us to delete the connection. - **Reddit:** disconnect Reddit in Connections; we revoke the token with Reddit for you. Delete your account in Settings under Data & privacy to remove the full PostMesh workspace and your uploaded media files. See [Data deletion](https://postmesh.app/legal/data-deletion) for every step. --- Page: https://postmesh.app/legal/privacy · Updated 2026-10-25 · Contact: hello@postmesh.app