Privacy Policy

Posty is a service for automating publications to social networks. By using the service, you agree to this personal data processing policy. Effective date: May 18, 2026.

1. What data we collect

When you register and use Posty, we collect:

• Contact data: email, name, avatar (optional)
• Waitlist: email, first-touch source, selected plan and billing period, and the date and time of consent to personal data processing. Submitting the waitlist form does not create a Posty account.
• Platform connection data. Depending on the integration, this includes OAuth tokens, bot tokens, and channel identifiers required for scheduled publishing. VK, Telegram, MAX, Odnoklassniki, Dzen via a linked Telegram channel, Rutube, YouTube, and Instagram⁠^{*Meta Platforms Inc. (including Instagram, Facebook, and Threads) is an organization whose activities are recognized as extremist and banned in the territory of the Russian Federation.} are currently available. The current list is always shown on the /connections page; data is transferred to a platform only after the user explicitly connects it.
• User content: text, images, and video — temporarily or for as long as needed for a draft, schedule, retry, and publication history, including automatic adaptation to each platform's format. Publication metadata (titles, descriptions, tags, links to published posts) is retained to display history and analytics.
• Data for AI features: text, images, or video selected by the user and the generated result. Transfer to an external provider occurs only after the user starts the specific AI action.
• Public links: tokens for post-approval links and public reports. Anyone who has such an unpredictable link can view the content shared through it until the team revokes the link.
• Technical data: IP address, user-agent, session identifiers, and an action log (audit log) — for security and incident investigation.
• Support requests: subject, category, message text, attached files, page address, and interface language. Guest requests are linked by an unpredictable browser identifier and are automatically attached to the user's account after login.

Posty does not receive or store passwords for third-party accounts.OAuth connections are completed on the platform's own page, and Posty stores only the access tokens issued by that platform.

2. Processing purposes

• User authorization and identification
• Publishing content to the social networks chosen by the user
• Collecting and displaying publication analytics
• Notifications about publication statuses
• Generating and transforming content at the user's explicit request
• Team work, public post approval, and client reports
• Handling support requests and preserving their history
• Notifying a waitlist member when access to Posty reopens
• Service security (anti-fraud, rate-limiting, account-takeover prevention)

3. Legal basis

Processing is carried out on the basis of the user's consent (Federal Law No. 152-FZ, Art. 6(1)(1)) and performance of the offer agreement (Federal Law No. 152-FZ, Art. 6(1)(5)).

4. Storage and protection

All personal data of users who are citizens of the Russian Federation is stored on servers in the Russian Federation, in accordance with the requirements of Federal Law No. 152-FZ (Art. 18(5)).

• Hosting: TimeWeb Cloud (Russia), without CDN proxying
• Backups — also in Russia
• Communication-channel protection: TLS (HTTPS), Let's Encrypt certificates with automatic renewal

Encryption of sensitive data. Authorization tokens of third-party platforms are stored encrypted using the AES-128-CBC + HMAC-SHA256 algorithm (the Fernet standard of the cryptography library). Encryption keys are stored separately from the database in a protected server environment variable and are not accessible via the API.

5. Cross-border transfer of personal data

When using integrations with foreign platforms, part of your data is transferred to the servers of the respective services located outside Russia. Below is the full list and the purposes of transfer:

• Google LLC (USA) — email and basic profile when signing in with Google; YouTube channel data, videos, descriptions, and statistics when YouTube is connected; selected text, images, or video when voluntarily using Google Gemini AI features. Purposes: authorization, YouTube publishing and analytics, and content generation or analysis.
• Meta Platforms Inc. / Instagram⁠^{*Meta Platforms Inc. (including Instagram, Facebook, and Threads) is an organization whose activities are recognized as extremist and banned in the territory of the Russian Federation.} (USA) — an OAuth token, professional-account identifier and type, publication content (text, photos, video), and available metadata. Purpose: publishing through the official API and displaying available Instagram analytics⁠^{*Meta Platforms Inc. (including Instagram, Facebook, and Threads) is an organization whose activities are recognized as extremist and banned in the territory of the Russian Federation.}. Transfer occurs only if you have explicitly connected an Instagram⁠^{*Meta Platforms Inc. (including Instagram, Facebook, and Threads) is an organization whose activities are recognized as extremist and banned in the territory of the Russian Federation.} account on the /connections page.
• Telegram FZ-LLC (UAE) — bot token, publication content, channel identifiers. Purpose: publishing to Telegram channels and groups. Transfer occurs only if you have explicitly connected a Telegram bot.
• Technical egress (Germany) — TLS-encrypted traffic to the official Meta API and Google Gemini. Purpose: access to foreign providers' APIs; the egress operator can see connection metadata but not the HTTPS request content.

By using the Posty service and connecting integrations with the platforms listed above, you consent to the cross-border transfer of personal data necessary for the service to function. Transfer is limited to the jurisdictions listed above and solely to perform the agreement with you and the selected feature (Federal Law No. 152-FZ, Art. 12(4)(1)). The corresponding foreign integration or AI action cannot operate without it.

6. Transfer to third parties

The following platforms currently have working integrations in Posty and may receive your data:

Transfer occurs only at the user's initiative — upon explicitly connecting an integration and clicking “Publish”.

We do not transfer data to any third parties other than those listed. To analyze site traffic we use Yandex.Metrica (Yandex LLC, Russia) — it collects anonymized behavioral data: pages viewed, referral sources, device type, and on-site actions (e.g. button clicks). This data does not allow identifying you personally.

If a team owner creates a public approval or report link, Posty discloses the selected content to anyone who receives that link. The link contains a long, unpredictable token, does not expose email addresses or internal identifiers, and can be revoked by the team.

Payments. When you purchase a paid plan, payment data is processed by YooKassa(YooMoney LLC, Russia) — card details are entered on YooKassa's side; we never receive or store them. If you enable plan auto-renewal, the card is stored by YooKassa, and we keep only the identifier (token) of the saved payment method and the last 4 digits of the card number — to display in settings and to charge renewals; when you unlink the card in settings, the token is deleted. To issue a receipt under the professional-income tax (NPD, Federal Law No. 422-FZ), payment details (amount, service name, and the e-mail for receipt delivery) are sent to the Russian Federal Tax Service's «Мой налог» (My Tax) service (lknpd.nalog.ru).

7. Use of the Google and YouTube APIs

Posty uses the official Google and YouTube APIs for signing in with Google, publishing videos to YouTube on your behalf, and obtaining available statistics. Within these integrations:

• We request access only to the Google / YouTube account data necessary for the specific feature: your email address and basic profile at sign-in; your channel data, video upload, and statistics of the videos you have published — when YouTube publishing is connected.
• The data received is used solely to provide Posty's features (authorization, publishing, statuses, and analytics) and is not shared with third parties beyond what is described in this policy.
• Posty's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
• By using YouTube-related features, you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy.
• You can revoke Posty's access to your Google account at any time on the Google security settings page, as well as by disconnecting the integration on the /connections page in your account.

8. Use of data for AI-based features

Posty uses Google Gemini for composer text actions, category and cover selection, and the “video to post” feature. The following rules apply:

• Only the content and metadata you select for a specific AI action is sent to Google. Ordinary publishing without an AI action does not trigger this transfer.
• Posty does not sell this data or use private content to train its own models. Google's processing is governed by the current Gemini API terms; do not submit information that is unnecessary for the requested result.
• To improve the quality of the service, we may use depersonalized and aggregated data that cannot identify you.
• For video analysis, the file is uploaded temporarily to the Gemini Files API; Posty requests its deletion after processing. Technical logs and residual retention on Google's side are governed by the provider's terms.
• Using AI features is voluntary — you may choose not to use them.
• Generated results may contain errors; the user checks the text, facts, and content rights before publication.

9. Retention period

• Active data (profile, tokens, publication metadata) — while the account is active.
• User content (uploaded files) — for as long as needed for a draft, schedule, retry, and publication history, or until data is deleted at the user's request.
• Temporary Google Gemini files — Posty requests deletion after analysis is complete; Google determines technical-log retention periods.
• Support requests and attachments — while needed to answer, preserve support history, or until deletion is requested by the user.
• The action log (audit log) is stored indefinitely — for information-security purposes, incident investigation, and compliance with Federal Law No. 152-FZ. Upon a justified user request, their personal data in the log may be depersonalized.
• After account deletion, the main data is deleted within 30 days (a grace period for accidental deletion). After that, the log is depersonalized.

10. User rights

Pursuant to Federal Law No. 152-FZ, Art. 14, you have the right to:

• Obtain information about the processing of your data
• Demand clarification, blocking, or deletion of your data
• Withdraw your consent to processing
• Appeal actions to Roskomnadzor and in court

Requests — to support@postyapp.io with the subject “Privacy:”. Response — within 10 business days.

11. Cookies

We use only functional cookies necessary for the service to operate:

• posty_session — session identifier (httpOnly, Secure, 30 days)
• posty_csrf — CSRF-protection token (Secure)
• posty_support_guest — guest support session (httpOnly, Secure, 30 days) used to reopen request history in the same browser

The landing site also uses functional browser localStorage (posty_support_v2) to save the guest identifier, request cards, message text, read markers, and attachment metadata. File contents are not stored in the browser. Clearing site data removes the local history and access to guest requests that have not yet been attached to an account.

Yandex.Metrica also sets analytics cookies (_ym_uid, _ym_d, _ym_isad, etc.) to measure traffic. There are no advertising cookies set by Posty.

12. Policy changes

In case of material changes to the policy, we notify you by email and through the interface at least 14 days before they take effect. The current version is 1.10 (August 15, 2026); previous versions are 1.9 (August 13, 2026), 1.8 (July 15, 2026), 1.7 (July 11, 2026), 1.6 (July 11, 2026), 1.5 (June 13, 2026), 1.4 (June 11, 2026), 1.3 (June 7, 2026), 1.2 (June 7, 2026), 1.1 (May 18, 2026), 1.0 (May 9, 2026).

13. Contacts

• Email: support@postyapp.io
• Owner: Vladimir Pavlovich Petrov, INN 504410954883, self-employed (NPD taxpayer)
• Website: https://postyapp.io