Privacy policy

Last updated: October 8, 2026

Postwith (“Postwith”, “we”, “us”) is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. This policy explains what we collect when you use postwith.app, our web application, MCP server, CLI and API (together, the “Service”), why we collect it, and the choices you have.

The short version

• We only access your social accounts through each platform’s official API, with the permissions you approve.
• Platform access tokens are encrypted, never shown to you, your AI agent, or anyone else, and deleted when you disconnect.
• We use your data to publish what you approve and to show you how your posts performed. We do not sell it, and we do not use it to train AI models.

What we collect

• Account information: your email address and authentication details, managed through our identity provider.
• Connected social accounts: when you connect Instagram, Facebook, TikTok, YouTube or Pinterest, we receive an access token and basic profile information for the accounts and Pages you choose (such as account ID, name, handle and avatar), plus the permissions you granted.
• Content you create: post text, media you upload, schedules, approvals and the platform-specific versions of each post.
• Performance data: metrics the platforms provide for posts published through Postwith and for your connected accounts (for example views, reach, impressions, likes, comments, shares, saves and watch time), with the time each value was measured.
• Usage and technical data: request logs, IP address, device and browser information, used for security, debugging and abuse prevention. Logs never contain your access tokens.

How we use it

• To publish, schedule and track the posts you approve, on the accounts you connected.
• To show you and your authorized AI agent normalized analytics and learnings about your own posts.
• To operate, secure and improve the Service, and to contact you about your account.

We do not sell personal data, use it for advertising, or use your content or platform data to train AI models.

Your AI agent

If you connect an AI agent (for example through our MCP server, CLI or API), that agent can read and act on your Postwith data only within the permissions you grant it. Your agent never receives your social platform access tokens. Data your agent retrieves is then processed by that agent’s provider under their terms; please review them.

Platform-specific disclosures

YouTube. Postwith uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy. You can revoke Postwith’s access at any time from your Google security settings.

Google user data. Postwith’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Instagram and Facebook). We access Instagram professional accounts and Facebook Pages only with the permissions you grant in Meta’s login dialog. You can remove Postwith from your Facebook settings under Business Integrations at any time; see our data deletion instructions.

TikTok and Pinterest. We access these accounts through TikTok’s and Pinterest’s official developer platforms, only with the scopes you approve, and you can revoke access from each platform’s app settings.

Sharing

We share data only with: the social platforms you instruct us to publish to; service providers that host and operate the Service under contract (such as cloud hosting, database and email providers); and authorities where the law requires it. If Postwith is involved in a merger or acquisition, your data may transfer subject to this policy.

Retention and deletion

• Disconnecting a social account immediately revokes and deletes its stored access credentials.
• You can delete your Postwith account at any time; we delete your content, connected-account data and analytics within 30 days, except where we must keep records to meet legal obligations.
• Security logs are kept for up to 90 days.

Security

Platform credentials are encrypted at rest with application-level encryption and are accessible only to the server-side components that publish on your behalf. Access to production systems is restricted and logged.

Your rights

Depending on where you live, you may have rights to access, correct, export or delete your data, and to object to or restrict certain processing. Email privacy@postwith.app and we will respond within 30 days.

Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We will post changes here and update the date above. For material changes we will notify you by email before they take effect.

Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] · privacy@postwith.app