Skip to main content
PostyGet started

Privacy Policy

Last updated: 12 October 2026

Posty is a social media planning and scheduling service operated by MTN Partners Pty Ltd ("we", "us", or "our"), a company registered in Australia. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have when you use posty.social, the Posty mobile app, the Posty API and MCP server, and our connected platform integrations. It is supplemented by our Cookie Policy and our GDPR and data processing page.

1. Information We Collect

Account and sign-in data

We collect the information needed to operate your account and workspace: your name, email address, an optional profile image, organisation and workspace names, team memberships, and role-based permissions. If you sign in with Google, Google sends us your Google account identifier, name, email address and profile image. If you sign in with an emailed link, we store the email address the link was sent to.

Content you create in Posty

We store the drafts, captions, media, schedules, comments, approvals, campaigns, link-in-bio pages, and publishing settings you create in Posty so we can provide the product features you use.

Connected platform data

Posty connects to third-party platforms you authorise so we can publish, schedule, and report on your content. Supported platforms currently include Bluesky, Discord, Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, WordPress, and YouTube. When you connect any of these accounts, we store the credentials and basic account details needed to act on your behalf. This may include access tokens, refresh tokens, platform account IDs, display names, usernames, page, board or channel labels, profile images, post or media identifiers we create through the platform's API, and the analytics that platform returns for your connected content.

Messages and comments from other people

When you connect a platform that supports the Posty inbox, we fetch the direct messages and comments that other people send to your connected accounts so you can read and reply to them inside Posty. For each message or comment we store the sender's platform user ID, username, display name and profile image, the text, any attachment or media links, and reactions. We process this information on your behalf, as your service provider, only so you can manage those conversations.

YouTube API Services data

Posty uses YouTube API Services. When you connect YouTube, we may store your YouTube channel ID, channel title, channel handle, thumbnail URL, OAuth tokens, YouTube video IDs created through Posty, and analytics or reporting data returned by YouTube API Services for connected content and channels.

Product usage analytics

We use Amplitude to understand which parts of Posty people use. We record page views and specific product actions (for example creating a post or connecting a channel) together with a random device identifier and session identifier stored in a first-party cookie, your browser and device type, and an approximate location derived from your IP address. Events are sent through our own domain to Amplitude. We do not record what you type into Posty, and we do not use Amplitude's automatic capture of page content.

Logs, error reports and support

We collect standard operational logs such as IP address, browser details and request metadata, and we send application errors to Sentry, which we configure not to include default personal identifiers. We also keep the support, billing and deletion requests you send us. We use this information for security, debugging, compliance, and customer support.

Billing

Paid plans are billed through Stripe. Stripe collects your payment details directly; we store only your Stripe customer and subscription identifiers, plan, and billing status. We never see or store full card numbers.

API keys and connected tools

If you create a workspace API key or authorise a tool to reach Posty through our MCP server, we store the key or authorisation, its permissions, and a record of the requests made with it.

2. How We Use Your Information

  • To operate your account, workspace, billing, and team access
  • To store, schedule, review, and publish your content
  • To connect to third-party platform APIs you authorise, includingBluesky, Discord, Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, WordPress, and YouTube API Services
  • To fetch analytics, channel reporting, post performance data, and inbox conversations you have asked us to display
  • To send service emails such as sign-in links, invitations, approval requests, and delivery or billing notifications
  • To understand how Posty is used and improve the product
  • To secure the service, investigate abuse, and troubleshoot bugs
  • To respond to legal, compliance, and data-rights requests

3. Platform-Specific Disclosures

When you connect a third-party platform to Posty, your use of that platform through Posty is also subject to the applicable platform terms and policies. By connecting an account, you acknowledge those terms and authorise Posty to act on your behalf within their scope.

4. How Information Is Shared

We share information only with the providers we need to run the service, with the platforms and tools you connect, and where the law requires it. We do not sell personal information.

  • istrash.email checks for disposable email providers when you create an account. We send only the domain after the @ symbol, without the rest of your email address, your name or password.
  • Cloudflare hosts our application, serves and stores uploaded media, and delivers our transactional email (privacy policy).
  • PlanetScale hosts the PostgreSQL database that stores your account, content, connected platform and inbox data (privacy policy).
  • Stripe processes subscriptions and payment information (privacy policy).
  • Amplitude receives the product usage events described in section 1, including the device identifier and your IP address (privacy policy).
  • Sentry receives application error reports, which can include request metadata and the identifier of the signed-in user (privacy policy).
  • Connected social platforms receive the OAuth and API requests needed to connect your account, publish content, and fetch reporting and inbox data. The platforms you may connect are Bluesky, Discord, Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, WordPress, and YouTube. Each platform has its own terms and privacy policy, linked in section 3, that govern how it handles the data you have authorised.
  • Tools you authorise through a workspace API key or our MCP server receive the workspace data their permissions allow. Those tools are chosen and controlled by you, and their own privacy policies apply to what they do with the data.
  • Legal requests: we disclose information when required by law, a court order, or to protect the rights and safety of Posty, our users, or others.

5. What We Never Do With Your Data

We want to be explicit about the things Posty does not do with any information collected through the service, including data obtained through any connected platform API such as Bluesky, Discord, Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, WordPress, and YouTube API Services:

  • We do not sell your personal information to anyone.
  • We do not use your information for targeted, personalised, or retargeted advertising, and we do not allow third parties to do so through the service.
  • We do not use your content, account data, inbox data, or data obtained from any connected platform API to train artificial intelligence or machine learning models.
  • We do not share your information with data brokers or information resellers.
  • We do not use your information to determine creditworthiness or for any lending purposes.
  • Data obtained from a connected platform API is only sent back to that platform, or shown to you and the tools you authorise, and only for the purposes you authorised when connecting your account.

6. Retention, Disconnection, and Deletion

Removing media from your library. Removing a file or folder from the media library hides its files from the library but retains the stored media and references from posts and revision history. Library removal does not immediately erase the files or reduce your storage usage. You can contact us to request permanent deletion.

We retain account and workspace data for as long as your account is active, unless a shorter retention period is required for a connected platform integration or by law. Analytics history is kept for the window included in your plan.

Disconnecting inside Posty. When you disconnect any connected platform from inside Posty, the channel is marked disconnected and we stop using its stored credentials at once. For YouTube we also send a revocation request to Google immediately. Thirty days after the disconnect we permanently delete the stored credentials, the channel record, the posts published through it, and its inbox conversations. Reconnecting the same account within those thirty days restores the channel. If you need the data removed sooner, use the deletion contacts below.

Revoking access on the platform instead. If you remove Posty from a platform's own settings (for example Google's permissions page, Facebook's Business Integrations, LinkedIn's permitted services, or TikTok's app permissions), what we can detect depends on the platform. TikTok notifies us and we mark the channel disconnected at once. For YouTube, we detect the revocation the next time Posty uses the authorisation and mark the channel disconnected. In both cases the thirty-day deletion above then applies. For the other platforms, Posty marks the channel as needing reconnection when requests start failing, but the stored credentials, which no longer work, remain until you also disconnect the channel inside Posty or ask us to delete it. We recommend doing both.

Deleting your account. You can ask us to delete your account and personal information at any time. We delete or anonymise it within 30 days of verifying the request, except where we must keep records for tax, fraud prevention or other legal obligations. Content in a workspace shared with other members may be kept for those members unless the workspace owner also asks for it to be removed.

Providers. Amplitude and Sentry keep the events we send them for a limited period under their own retention settings, and Stripe keeps billing records as required by financial regulation.

To request deletion, use our contact form (the subject will be prefilled with "Delete my data"), email privacy@posty.social, or follow our data deletion instructions.

7. Your Choices and Rights

  • Access, correct, export, or delete your personal information by contacting us
  • Disconnect connected platforms you no longer want Posty to use, and revoke API keys or connected tools from your workspace settings
  • Review and revoke Posty's access directly with each connected platform: Bluesky, Discord (User Settings, Authorized Apps), Facebook, Instagram, Threads (in the Threads app under Settings, Account, Apps and websites), LinkedIn, Pinterest, TikTok (in the TikTok app under Settings and privacy, Security and permissions, Manage app permissions), Google / YouTube, and WordPress (in your site's admin under Users, Profile, Application Passwords, or for WordPress.com sites under Connected Applications).
  • Block or delete the analytics cookie in your browser; see our Cookie Policy
  • If you are in the EEA or UK, exercise the rights described on our GDPR page
  • Complain to us first, and if you are not satisfied, to the Office of the Australian Information Commissioner or your local data protection authority

8. Security

We use TLS encryption for all data in transit and apply role-based access controls inside the application. Credentials for every connected platform, including OAuth access tokens, refresh tokens, and any other secrets we store on your behalf for Bluesky, Discord, Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, WordPress, and YouTube, are encrypted at rest with AES-256-GCM before being written to our database, using keys that are held only by our application services and rotated over time. No system is perfectly secure, but we work to reduce the amount of platform data stored and to remove it when access is revoked or no longer needed.

9. Children

Posty is a business tool and is not directed at children. You must be at least 16 years old to create an account. If you believe a child under 16 has given us personal information, contact us and we will delete it.

10. International Transfers

Posty is operated from Australia. Cloudflare processes data on its global network, and PlanetScale, Stripe, Amplitude and Sentry process data in the United States and other countries. Where we transfer personal information out of the EEA, UK or Australia, we rely on our providers' standard contractual clauses or equivalent safeguards. Our GDPR page has more detail.

11. Changes and Contact

We may update this Privacy Policy from time to time. Material changes will be reflected on this page by updating the last updated date, and we will make reasonable efforts to notify account holders of changes that materially affect how we use their information.

Questions about this Privacy Policy can be sent to privacy@posty.social. Our Terms of Service describe the agreement that governs your use of Posty.