Privacy Policy

1. The short version

• We collect what we need to run the Service: your account details, the content you schedule, and access to the social accounts you choose to connect.
• We use social account access only to publish what you tell us to and to show basic account details in the app.
• Social account tokens are encrypted, and card details are handled by Stripe, never stored by us.
• We don’t sell your personal information or show ads.
• You can disconnect accounts, delete content or delete your account at any time.

2. Information we collect

Account information

Your name, email address and password when you sign up (passwords are stored hashed by our authentication provider; we never see them in plain text). If you sign in with Google, we receive your name, email address and profile picture from Google.

Billing information

When you subscribe, payment is handled by Stripe. Stripe collects your card details and billing address. We receive and store your email address, Stripe customer and subscription IDs, plan, subscription status and renewal dates, but not your full card number.

Connected social accounts

When you connect TikTok, Instagram, Facebook or LinkedIn, the platform gives us, with your permission:

• your account or Page ID, display name, username/handle and profile picture;
• access tokens (and refresh tokens where provided) that let us publish on your behalf;
• the permissions you granted and when the tokens expire.

We request only the permissions needed to publish your content and identify the connected account. We don’t read your private messages, followers or analytics.

Content you create

Videos, images, captions, per-platform settings (such as privacy level or comment settings), scheduled times and time zones, and the results of publishing (such as post IDs, links and error messages).

Technical and usage information

Like most web services, our hosting and infrastructure providers automatically log technical data such as IP address, browser type, device information, pages requested and timestamps, which we use for security, debugging and reliability.

3. How we use information

• to create and manage your account and authenticate you;
• to upload, store and publish your content to the platforms and at the times you choose;
• to keep connections working, including refreshing access tokens before they expire;
• to process subscriptions, manage billing and grant access to paid features;
• to send service emails, such as email verification, password resets, billing receipts and important notices;
• to provide support, prevent abuse and fraud, and keep the Service secure;
• to comply with legal obligations.

Where laws such as the GDPR apply, we rely on performance of our contract with you, our legitimate interests in running and securing the Service, compliance with legal obligations, and your consent where required (for example, when you connect a social account).

4. Data from connected platforms

Information we receive from TikTok, Meta (Instagram and Facebook), LinkedIn and Google is used only to provide the features you request in PostMonger, in line with each platform’s developer terms and policies. In particular:

• we don’t sell platform data or use it for advertising;
• we don’t use it to build profiles unrelated to the Service;
• we don’t share it with third parties except the service providers listed below that help us operate the Service;
• our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

5. How we share information

We share information only as needed to run the Service:

• Social platforms you choose: when you publish, we send your content and settings to TikTok, Instagram, Facebook or LinkedIn. Once published, content is subject to that platform’s privacy policy.
• Service providers that process data on our behalf under contract, including Supabase (database, authentication and file storage), Stripe (payments), Inngest (background scheduling), our hosting provider, and our email delivery provider.
• Legal reasons: if required by law, or to protect the rights, safety and property of PostMonger, our users or others.
• Business transfers: as part of a merger, acquisition or sale of assets, with this policy continuing to apply to your information.

We do not sell or rent your personal information.

6. Cookies

We use only essential cookies needed for the Service to work: to keep you signed in (authentication session cookies), to remember your active workspace, and to protect social account connections against forgery during sign-in with a platform. We don’t use advertising or third-party tracking cookies. Stripe may set its own cookies on its checkout and billing pages to prevent fraud.

7. How long we keep information

• Account information: while your account is active, and deleted when you delete your account.
• Social account tokens: until you disconnect the account or delete your account, at which point they are deleted.
• Uploaded media: kept while needed to publish your posts. We may delete media files after they have been published or after a period of inactivity; post details (captions, schedule, status, links) remain in your history until you delete them.
• Billing records: kept as long as required for tax, accounting and legal purposes, even after you close your account.
• Logs and backups: kept for a limited time for security and recovery, then deleted or overwritten.

8. Security

We use industry-standard safeguards, including HTTPS for data in transit, AES-256-GCM encryption for stored social account tokens, private storage for uploaded media with short-lived access links, and database access controls that limit each user to their own data. No system is completely secure, so we can’t guarantee absolute security, but we’ll notify you and the relevant authorities of a breach where required by law.

9. Your choices and rights

• Disconnect a social account at any time from the Connections page; we delete its stored tokens. You can also revoke access from the platform’s own settings.
• Delete content by deleting posts in the app.
• Cancel your subscription from the Billing page.
• Delete your account and data by emailing barecalcom@gmail.com from your account email. We’ll delete your account, connected account tokens, content and media within 30 days, except information we must keep for legal reasons.

Depending on where you live (for example in the EU, UK or California), you may have rights to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact us at barecalcom@gmail.com. We won’t discriminate against you for exercising them. You also have the right to complain to your local data protection authority.

10. International transfers

We and our service providers may process information in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect information transferred internationally.

11. Children

The Service is not intended for anyone under 18, and we don’t knowingly collect information from children. If you believe a child has given us personal information, contact us and we’ll delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we’ll notify you by email or in the app before they take effect. The effective date at the top shows when it was last updated.

13. Contact

PostMonger
2844 N Cramer St, Milwaukee, WI 53211
barecalcom@gmail.com