Privacy

Account Information

When you create a Postify account, we collect your name, email address, and profile information that you provide to personalize your experience.

Content & Usage Data

We collect information about content you create in Postify (such as drafts, captions, titles, uploaded media, and scheduling settings) and how you use Postify (such as features you access and actions you take within the app). We may also store delivery logs (for example, whether a publish succeeded or failed) to provide support, auditing, and troubleshooting.

Social Media Connections

When you connect your social media accounts, we access only the permissions necessary to publish and manage your content on your behalf. We never ask for your social platform passwords. Account connections are performed through the platform’s authorized sign-in and permission flow.

Attribution Cookie (pfy_ft)

When you first reach usepostify.com or app.usepostify.com from another website, or through a link that carries campaign information, our server sets one first-party cookie named pfy_ft. It records where that first visit came from: the campaign (UTM) tags in the link, any advertising or referral click ID the link carried (such as a Google, Meta, Microsoft or TikTok ad click ID, or a Postify partner or referral code), the domain of the site that sent you (never the full address), the page you landed on, and the time of the visit. It does not contain your name, email address, or any other identifier of you.

How the Attribution Cookie Works

The pfy_ft cookie is HttpOnly, so scripts on our pages cannot read it. It is shared across usepostify.com and its subdomains so that it survives the move from our website to the app. It is written once, is never refreshed or overwritten by a later visit, and expires 180 days after that first visit. A direct visit with no campaign information or referring site sets no cookie.

Why We Set It

We use it for one purpose: attributing signups and payments to the channel that brought them. If you create an account, we copy the cookie’s contents to your account record and to our product analytics, so we can see which campaigns and referring sites lead to signups, trials and paid subscriptions. You can delete the cookie at any time in your browser settings.

Service Delivery

We use your information to provide Postify's core features: drafting, publishing, and scheduling content, maintaining your connections to third-party platforms, and providing reporting features where available.

Personalization

Your data helps us customize your dashboard, suggest optimal posting times, and provide relevant insights to improve your social media performance.

Communication

We may use your email to send important updates about our service, new features, and respond to your support requests.

Encryption Standards

All data transmission is secured using industry-standard SSL/TLS encryption. Your content and personal information are protected both in transit and at rest.

Access Controls

We implement strict access controls, multi-factor authentication, and regular security audits to ensure only authorized personnel can access systems.

Data Minimization

We only collect and retain the minimum amount of data necessary to provide our services and delete data that is no longer needed.

Access & Export

You can access all your personal data and export your content at any time through your account settings or by contacting our support team.

Correction & Deletion

You have the right to update your personal information or request complete deletion of your account and all associated data.

Data Portability

You can export your data in standard formats to migrate to other services, ensuring you always maintain control over your content.

Social Media Platforms

We integrate with social media platforms using their official APIs. We only request the minimum permissions needed to publish and manage your content.

Connected Platform Data

When you connect a third-party platform, we access only the permissions necessary to provide the features you use. We handle platform-provided data according to the applicable platform rules, including any restrictions on storing or combining that data. We do not sell data retrieved from connected platforms, and we do not use it for third-party advertising or profiling.

Analytics Providers

We use PostHog, run on our own servers, to understand how Postify is used and to find problems. It records the pages you visit and what you click, and sets its own first-party cookie so it can recognize your browser between visits. Once you sign in to the app, that activity is linked to your account by your Postify user ID, and your email address and name are stored on that record. Some visits are also recorded as replays of clicks, scrolling and page layout to help us diagnose bugs. In the app, every input field and all text on screen are masked in those replays, and images and videos are left out, so a replay never shows your posts, messages or media; on this website, anything you type into a form is masked. This website also uses Google Analytics to count visits and see which sites and campaigns send them. We do not sell this data.

Conversion Reports to Google Analytics

Besides the Google Analytics tag on this website, our server also reports a few events to Google Analytics. When you create an account, start a trial or make a first payment, our server sends that event: a sign-up, a trial start, or a purchase with its amount and currency. The report carries the random browser ID from your Google Analytics cookie (named _ga) and your Postify account ID, not your name or email address. We keep that cookie ID on your account record so that a payment made later can be matched to the visit that led to it. We use these reports only to measure which of our marketing channels lead to accounts and subscriptions. If your browser never set the Google Analytics cookie, nothing is sent to Google. Google’s handling of this data is described in its own privacy policy.

Data Processing

Any third-party services we use are carefully vetted for security and privacy compliance, and we never sell your data to third parties.

Disconnecting a Platform

You can disconnect a connected platform at any time from the Channels page in Postify. Disconnecting deletes the access and refresh tokens we hold for that account, so Postify can no longer act on it, and where the platform provides a revocation endpoint we also revoke the authorization with the platform itself. We keep the disconnected connection record — without its credentials — so your past posts and delivery history remain readable.

How We Use YouTube API Services

Postify uses YouTube API Services to let you upload and publish videos to YouTube channels you own, and, if you allow it, to show you the comments on those videos and post your replies. When you connect a channel we read its name, handle, avatar, and public statistics so you can tell your channels apart in Postify. When you publish, we upload the video together with the title, description, tags, category, privacy setting, made-for-kids declaration, and any custom thumbnail you provide. We do not build derived metrics or rankings from YouTube data, and we never use it for advertising or profiling.

Comments on Your Videos

Reading comments and replying to them need a separate permission that is not part of connecting a channel. You give it only by choosing Allow comments and replies in the Inbox, which sends you to Google to approve it. With that permission, we read the comments people leave on videos you published through Postify, so they appear in your Postify Inbox. For each comment we store its text, the commenter's display name and avatar, the comment's ID, a link to it, and when it was written. We do not read comments on any other videos or channels.

Replying to Comments

With the same permission, Postify posts the reply you write, only when you press Send — never automatically. If you ask Postify for reply suggestions, the comment's text is sent to the AI model provider that writes them; the suggestions are drafts you edit and send yourself.

How Long We Keep YouTube Comments

We keep other people's comment text, names and avatars no longer than 30 days after we last read them from YouTube. Comments on your most recent videos are read again regularly, which refreshes them; anything not refreshed within 30 days is cleared from Postify. We keep the comment's ID, so your Inbox history stays in place, and any reply you sent, which is your own. Disconnecting the channel clears the comments we stored from it straight away. If you revoke Postify's access from your Google account instead, we can no longer read your comments and the stored comments are cleared within 30 days.

YouTube Terms and Google's Privacy Policy

By using Postify to publish to YouTube you agree to be bound by the YouTube Terms of Service. Information that Google collects and handles in connection with YouTube API Services is governed by the Google Privacy Policy.

• YouTube Terms of Service — youtube.com/t/terms
• Google Privacy Policy — policies.google.com/privacy

Google API Services User Data Policy

Postify's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy — developers.google.com/terms/api-services-user-data-policy

Revoking Our Access to Your YouTube Account

You can revoke Postify's access to your YouTube account at any time. Disconnecting the channel from the Channels page in Postify deletes the tokens we hold, revokes the grant with Google, and clears the comments we stored from it. You can also revoke it directly from your Google account's security settings, independently of Postify; the stored comments are then cleared within 30 days.

• Revoke Postify's access in your Google security settings — security.google.com/settings/security/permissions
• Revoke Postify's access in your Google account — myaccount.google.com/permissions

What the Extension Reads

The Postify extension for Chrome has one job: starting a post from the page you are on. It reads something only when you click its toolbar icon or choose “Share to Postify” from the right-click menu, and then only from that tab: the page’s address and title, and the text you highlighted or the link you right-clicked. It cannot read pages at any other time, and it has no access to page contents, your browsing history, bookmarks, cookies or passwords.

What It Does With It

It opens a new tab on app.usepostify.com with that text and address in the link, and Postify’s composer fills a new post with them. The extension itself stores nothing, sets no cookies, has no analytics and makes no network requests of its own. All it ever does is open a Postify tab: when you share, and, as described below, when it is installed or removed.

Once Postify Opens

From there, this policy applies as it does to any page you open in Postify. The shared text and address reach our servers as part of that page request and may appear in our server logs, and like any page you visit they may appear in your browser history. The composer removes them from the address bar once it has loaded. Our product analytics record that a share happened and whether it included text or a link, but not the text or the link itself. Nothing is scheduled or published unless you choose to do it. If you are not signed in, Postify asks you to sign in or continue as a guest first.

Install and Removal Counts

When you install the extension, it opens a Postify welcome page in a new tab, once. That page tells our server that an install happened, which version it was, and where the visit that led to it came from: if you have our pfy_ft cookie (described above), the campaign tags, click IDs and referring domain stored in it; if you do not, the install is recorded as coming from the Chrome Web Store. When you remove the extension, Chrome opens a Postify goodbye page, which records the removal the same way. Neither page needs you to sign in, and neither records anything you shared. To count each install or removal once instead of every time the page is reloaded, the page sets one first-party cookie named pfy_ext in your browser. It holds a random identifier and a counter, nothing about you, is HttpOnly, and expires after 30 days. The extension itself still makes no network requests: it only opens these pages.

Selling, Sharing and Removal

We do not sell or transfer what you share through the extension, and we do not use it for advertising, for creditworthiness or lending decisions, or for anything other than the post you are writing. You can remove the extension at any time from your browser’s extensions page.