Privacy Policy

PostWing ("PostWing", "we", "us") is a social media scheduling service. You write a post once, choose the social accounts and the time, and PostWing publishes it to Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, X (Twitter), and YouTube for you.

This Privacy Policy explains how we handle personal data when you use the website at postwing.io, the PostWing dashboard, the PostWing API, and the PostWing MCP server for AI assistants (together, the "Service"). It applies alongside our Terms of Use.

• Account data. Your name, email address, and profile picture, received from Google when you sign in with Google. We never receive or store your Google password.
• Connected social accounts. For each social account you connect: the platform, account name, handle, profile picture, account ID, and the access tokens the platform issues so PostWing can publish on your behalf. For YouTube, see section 4.
• Content you create. Captions, images, videos, titles, video covers, per-platform settings, scheduled times, the accounts you post to, and each post's publish status, link, and any error.
• Billing data. Your plan, subscription status, and billing identifiers. Card details are handled by our payment provider and never reach our servers.
• Integration credentials. API keys and OAuth tokens you create to connect AI assistants or your own software, stored hashed or encrypted.
• Usage and technical data. A log of actions taken in your account (including through the API or an AI assistant), basic request logs, and website analytics described in section 7.

We do not ask for sensitive personal data such as government identifiers, health information, payment card numbers, or biometric data. Please do not send it to us.

• To schedule and publish the posts you create, to the accounts you choose, at the times you choose.
• To show you your calendar, your connected accounts, and whether each post published.
• To sign you in and keep your account and connected integrations secure.
• To process subscriptions, enforce plan limits, and handle refunds.
• To keep an audit log of account activity for security and support.
• To answer support requests and send essential service emails.
• To detect, prevent, and investigate abuse, fraud, and technical problems.

We do not sell your personal data. We do not use your content or any data from your connected accounts to train machine learning or AI models, and we do not use it for advertising.

PostWing requests Google user data only when you sign in with Google, and, if you choose to connect a channel, when you authorize YouTube. We do not request Gmail, Google Calendar, Google Drive, or Google Photos. Google's consent screen lists the permissions before you approve them.

• What we collect. Your Google email, name, and profile picture; YouTube OAuth tokens; your channel name, channel ID, handle, and channel picture; and the video metadata you enter for an upload (title, description, cover, visibility, and made-for-kids setting), plus whether the upload succeeded and the link to the video.
• Why we collect it. To sign you in, and to upload videos you schedule to your YouTube channel with the youtube.upload permission, on your behalf.
• How we store and protect it. OAuth tokens are encrypted at rest, kept only on servers, and deleted when you disconnect the channel. We do not sell them, we do not use them to train AI models, and we do not transfer them except to postforme.dev, which uploads the video you scheduled, and to YouTube as the place that video is published.

Access

The Google user data PostWing requests is:

• Sign in with Google. Scopes openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/userinfo.profile. The data returned is your email address, your name, and your profile picture. We never receive or store your Google password.
• YouTube channel identity. Scope https://www.googleapis.com/auth/youtube.readonly. The data returned is the channel name, channel ID, handle, and channel profile picture of a channel you choose to connect.
• YouTube upload. Scope https://www.googleapis.com/auth/youtube.upload. This lets PostWing send a video you scheduled to that channel, including the video file you provided and the title, description, cover image, visibility, and "made for kids" setting you entered. Google then returns whether the upload succeeded and the link to the video.
• YouTube account access used by the connection. Scope https://www.googleapis.com/auth/youtube.force-ssl, and https://www.googleapis.com/auth/userinfo.profile for the Google account that owns the channel. This scope can permit viewing and managing videos, ratings, comments, and captions. PostWing does not use it that way. See Usage below.

PostWing does not request your watch history, subscriptions, private messages, or data from channels you did not connect. We do not download videos already on your channel.

Usage

We use Google user data only to provide PostWing:

• Your email, name, and profile picture create your PostWing account, sign you in, and let us email you about that account.
• The YouTube channel name, channel ID, handle, and picture are shown in your dashboard so you can choose that channel when you schedule a post.
• The upload permission publishes the video you scheduled, at the time you chose, with the title and settings you entered. We then show you whether it published and link to it.

We do not use the YouTube permissions to read your comments, ratings, captions, or watch history, and we do not edit, delete, or download videos already on your channel. We never upload a video you did not schedule yourself.

We do not use Google user data for advertising, to sell data, to build profiles for other products, or to train AI or machine learning models. PostWing does not use Google APIs or Google user data to create, edit, or generate images or videos of any kind, including AI-generated or non-consensual intimate imagery.

Storage

Google user data is stored only on servers, encrypted in transit and at rest. It is not stored in your browser.

• Sign-in data. Your name, email address, and profile picture are stored in PostWing's database, hosted by Supabase. Supabase also stores the sign-in session that keeps you logged in. We keep this data while your PostWing account is open. After you delete the account, or email us to delete your data, we delete or anonymize it within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons.
• YouTube channel profile. We store the channel name, handle, profile picture, and connection ID in that same database, and only while the channel stays connected. We delete them when you disconnect the channel.
• YouTube OAuth tokens. The access tokens Google issues for your channel are stored encrypted by our publishing provider, postforme.dev. PostWing does not put those tokens in its own database, does not show them in the dashboard, and does not send them to AI assistants or through the PostWing API. postforme.dev uses them only to publish the videos you scheduled. We delete them when you disconnect the channel.
• Upload result. The publish status and the link to the video are stored with that scheduled post while your account is open, and are deleted on the same 30-day schedule as the rest of your account data.

Sharing

We do not sell Google user data. We do not transfer it to advertising networks, data brokers, or anyone else for their own marketing. We share it only with service providers who need it to perform the feature you asked for, and only for that purpose:

• Supabase stores your name, email, profile picture, and sign-in session.
• postforme.dev stores the YouTube connection tokens and uploads the video you scheduled.
• Vercel hosts PostWing and processes the request that publishes your post.
• Google / YouTube receives the video and the title, description, and settings you asked us to publish.

We may also disclose Google user data if a law, court, or regulator requires it. We do not share your Google email, Google profile, or YouTube tokens with AI assistants such as ChatGPT, Claude, Cursor, or Muse. An assistant you connect yourself can see the channel name and platform, because that is part of the connected-accounts list you authorized that assistant to read.

PostWing's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use. PostWing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services. PostWing uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Removing access. You can disconnect your YouTube channel at any time from the Accounts page in your PostWing dashboard. When you do, we stop accessing it and delete its stored access tokens and channel profile. You can also revoke PostWing's access from your Google Account at myaccount.google.com/permissions. See section 8 for how long other data is kept and how to have it deleted.

You are strictly prohibited from generating, scheduling, or uploading deepfakes, non-consensual intimate imagery, or other harmful AI-generated content through PostWing, including to YouTube.

PostWing does not use Google APIs or YouTube data to create, edit, or generate images or videos of any kind. PostWing only publishes content you provide. We may remove content and suspend or close an account that violates this rule.

You can connect an AI assistant such as ChatGPT, Claude, Cursor, or Muse, or your own software, to your PostWing account through the PostWing MCP server or API. You authorize this yourself, either on a PostWing consent screen that lists the permissions requested or by creating an API key in your dashboard, and you can revoke it at any time from your dashboard, which stops further access immediately.

What a connected assistant can access. Only what you granted: your connected account names and platforms, your timezone, and your posts' captions, media, times, accounts, and status. It never receives your Google credentials, your social platforms' access tokens, your billing details, or any other user's data.

Approval before changes. PostWing instructs connected assistants to show you each post (caption, accounts, media, and time) and wait for your approval before scheduling, changing, or cancelling it.

Media links. Media is imported only from HTTPS links you provide, and links pointing to private or internal network addresses are refused.

Logging. We record which actions were taken and when, so you have an audit trail of anything an assistant or API key did in your account.

When you use an AI assistant with PostWing, your prompts and the data returned to it are also handled by that assistant's provider under its own privacy policy. We do not control how OpenAI, Anthropic, or any other provider processes that data.

We share data only with service providers that help us run the Service, under contracts that limit their use of it:

• postforme.dev: connects your social accounts, stores your media, and publishes your scheduled content on your behalf.
• Supabase: database, sign-in, and storage infrastructure.
• Vercel: hosting for the website and application.
• Polar: subscription billing and payments.
• Resend: sending account and service emails.
• Google: sign-in, and publishing to YouTube when you connect a channel.
• The social networks you connect: to publish the content you schedule. Each platform then handles that content under its own policies.
• Analytics and advertising measurement providers: see section 7.

We may also disclose data if required by law, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

We use cookies and similar technologies to keep you signed in and to understand and improve our website. On our marketing website we use DataFast for privacy-friendly visit analytics, and Google Ads, Meta Pixel, and OpenAI's pixel to measure whether our ads lead to sign-ups and trials. When you start a trial or subscribe, we may send Meta a hashed (irreversibly scrambled) copy of your email address and the plan you chose, to measure ad performance.

These tools never receive your posts, your connected accounts' data, or any Google or YouTube user data. You can block or delete cookies in your browser settings; the Service still works, but you may need to sign in again.

We keep your account data, posts, and audit logs while your account is active. Access tokens for a connected social account are kept only while that account is connected and are deleted when you disconnect it. Expired integration tokens and authorization codes are removed automatically.

When you delete your PostWing account, or email us asking us to delete your data, we disconnect your social accounts, delete their access tokens, and delete or anonymize your personal data within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons.

Data is encrypted in transit and at rest. Access tokens and integration credentials are stored encrypted or hashed, never in plain text in your browser. Access to your data is limited to your own account and workspaces, and to the staff and providers who need it to run the Service. No system is perfectly secure, so we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. From your dashboard you can disconnect social accounts, revoke AI assistant and API access, and delete your account. You can also revoke Google access at myaccount.google.com/permissions, or email us and we will help.

We and our service providers may process your data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for those transfers.

PostWing is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page, update the "Last updated" date, and notify you by email where appropriate.

Questions about this policy or your data? Email us at mejed@postwing.io.