Privacy Policy

1. What we collect

Account information. Your name, email, and avatar — provided to us by Clerk, our identity provider, when you sign up.

Workspace data. Organisations you create, brand profile fields, and any media or post copy you upload.

Connected platform tokens. When you connect a Meta, TikTok, or YouTube account, we store the OAuth access and refresh tokens issued by that platform. Tokens are encrypted at rest with AES-256-GCM. We never see or store your platform passwords.

Usage analytics. Page views and key product events (sign-up, post creation, account connection) via PostHog. This helps us understand which features get used. We don't sell or share these analytics.

Technical metadata. Standard server logs (IP address, user agent, timestamps) for security and debugging.

2. How we use it

• To run the service — authenticate you, store your media, publish on your behalf.
• To generate thumbnails and AI-assisted caption suggestions.
• To send service-related email (security alerts, account changes, important updates).
• To improve postme.live based on aggregate usage patterns.
• To meet legal obligations (tax, fraud prevention, lawful requests).

We do not use your media or copy to train AI models. Caption suggestions are generated per-request via OpenRouter; the prompt you send isn't retained for training.

3. Sub-processors

We use a small number of third-party providers to operate the service. By using postme.live you consent to your data being processed by them for that purpose:

• Clerk — authentication, session management, your name and email.
• Cloudflare R2 — media storage (your uploaded images and videos).
• OpenRouter — AI caption generation. Prompts are sent on demand and are not retained for training.
• PostHog (EU region) — product analytics.
• Connected platforms (Meta, TikTok, YouTube, your custom webhook) — destinations you choose. Their privacy policies apply once content reaches them.

4. Sharing

We do not sell your personal information. We share data only with the sub-processors listed above, with our team and contractors who need it to run the service, with professional advisors under confidentiality, and where legally required.

5. Security

OAuth tokens for connected accounts are encrypted at rest with AES-256-GCM. Sessions are HttpOnly cookies. Production traffic is HTTPS only. Webhook payloads we receive are HMAC-verified. No system is perfectly secure — we work to minimise risk and respond quickly to incidents.

6. Data location

postme.live runs primarily on infrastructure in Australia and the European Union (PostHog EU region). Some sub-processors may transfer data to the United States and other jurisdictions; we choose providers that maintain protections aligned with Australian privacy standards.

7. Retention

We keep your data while your account is active. Deleted media is removed from R2 within 30 days. If you delete your account, we delete your workspace data within 30 days, except where we're legally required to retain something (e.g. financial records).

8. Your rights

You can:

• Access your data (most of it is visible in the app).
• Correct your name and other profile fields from Settings → Account.
• Disconnect platforms and delete media at any time.
• Request a full export or deletion by emailing the address below.
• Withdraw consent for analytics in your browser settings.
• Lodge a complaint with the Office of the Australian Information Commissioner.

9. Cookies

We set two first-party cookies: a Clerk session cookie (HttpOnly, identity) and pts_active_org (HttpOnly, your active workspace). PostHog sets a first-party analytics cookie. We don't use cookies for advertising.

10. Changes

We'll post material updates here and notify you in-app or by email. Continued use after the effective date means you accept the updated policy.

11. Contact

Privacy questions or requests: [email protected]
Outback Yak · Melbourne, Australia · ABN 11 672 730 773