Privacy Policy

1. Who is responsible for your data

Cavelights LTD is the data controller for Posttyy. For any question or request about your data, or to exercise the rights in section 10, write to posttyy.app@gmail.com.

2. The short version

We collect what the service needs to schedule your posts, and nothing else. We do not sell your data, we do not use it for advertising, we do not build profiles from it, and we run no third-party analytics or tracking of any kind. Your social media credentials are encrypted before they are stored, and your uploaded media sits in a private bucket that is not publicly readable.

3. What we collect

Your account. Your email address and a securely hashed password, handled by our authentication provider. We never see your password in readable form.

Connected social accounts. When you connect an account we store: the platform, your username or page name on it, the platform’s own identifier for the account, the permissions you granted, the access credential and its expiry, and — where the platform issues one — a refresh credential. Access and refresh credentials are encrypted at rest using AES-256-GCM and are only decrypted on our server at the moment a post is published or a credential renewed.

Your content. The text of your posts and drafts, the times you schedule them for, any photos or videos you attach and their descriptions, and the outcome of each publish — whether it succeeded, the link to the published post, and the error if it failed.

Your subscription. Which plan you are on, whether it is being paid for, and the dates it renews or ends. We also store the identifiers Stripe gives us for your customer record and your subscription, so we can open your billing portal and match Stripe’s messages to your account. We never receive or store your card details. You enter those on Stripe’s own checkout page, and Stripe tells us only whether a payment succeeded.

Operational records. Our hosting and database providers keep standard server logs, which include IP addresses and request details, for security and troubleshooting.

Your accounts’ numbers. When you open Analytics, or ask an AI assistant you have connected how an account is doing (see section 7), we ask the platform for the account’s public totals, such as its follower count, and for its recent posts with their likes, comments, shares and views. For Instagram, Facebook Pages and YouTube we keep that answer for up to 15 minutes, so that asking again does not ask the platform again, and we do not save it in our database.

For X we do save it, so that the page can show how the numbers change over time. Once you have opened Analytics for an X account, or asked an assistant about it, we record once a day the account’s totals (followers, following, posts and lists). Each time you look at its numbers, we also save, for each of its posts in the period you chose, up to 90 days, the post’s text, when it was posted, and its impressions, likes, replies, reposts, quotes, bookmarks, profile clicks and link clicks. These are totals only: they do not say who liked, replied or clicked.

For Pinterest we ask for more: the account’s impressions, engagements, pin clicks, outbound clicks and saves for each of the last 90 days; how those divide by device, by kind of pin, and between your pins and other people’s; and your pins, each with its title, its picture, when it was pinned, and its impressions, clicks, saves, comments and reactions. These are totals only: they do not say who saw, saved or clicked. Once you have opened Analytics for a Pinterest account, or asked an assistant about it, we save the daily numbers and record once a day the account’s totals (followers, following, pins and monthly views), so that the page can show periods longer than the 90 days Pinterest keeps. For each of your pins we also save its title, the address of its picture, when it was pinned, and its impressions, pin clicks, outbound clicks and saves for each day.

For a post you sent through Posttyy to X, YouTube or Instagram, we also ask the platform how the post is doing for a few days after it goes out: two days on X, seven on YouTube and Instagram. We do this so that the calendar can tell you when a post does far better than your usual, and offer to post it again on your other accounts. For each such post we save one number: its impressions on X, its views on YouTube, or its likes and comments together on Instagram.

We do not collect your contacts, the list of who follows you, your direct messages, your location, or anything about who is in your audience.

4. Cookies

Posttyy sets no advertising or analytics cookies. The only cookies are the ones required to make it work:

• Session cookies that keep you signed in.
• Short-lived security cookies created while you are connecting a social account, which exist to verify that the response coming back from the platform is genuinely the one you started. They expire within ten minutes.

5. Why we use it, and our legal basis

• To provide the service — storing your posts, publishing them at the scheduled time, showing you what happened, and showing you how your connected accounts are doing. Legal basis: performance of our contract with you.
• To keep your connections working — renewing access credentials before they expire, and flagging a connection the platform has stopped accepting. Legal basis: performance of our contract.
• To take payment — running your subscription, charging the card when a trial ends or a period renews, and keeping the invoices. Legal basis: performance of our contract with you, and our legal obligation to keep accounting records.
• To keep the service secure and working — logs, troubleshooting, preventing abuse. Legal basis: our legitimate interest in a secure and functioning service.
• To answer you when you contact us. Legal basis: our legitimate interest in supporting our users.

We do not use your data for marketing, and we do not make automated decisions that produce legal effects for you.

6. Data from connected platforms

The permissions you grant are the minimum each platform offers for publishing. We use platform data solely to operate features you have asked for, and we do not use it to build advertising profiles, sell it, or share it with data brokers.

• TikTok. We request access to your basic profile (to show which account is connected and to link to a published post) and permission to publish posts — photos and video — or to send them to your TikTok inbox for you to finish. We use TikTok data only to publish the posts you schedule and to display the connection in your account.
• Instagram, Threads and Facebook Pages. We request your basic profile or page list and permission to publish content, and use them for the same two purposes. For Instagram and Facebook Pages we also use them to show, on the Analytics page, the account’s follower count and the likes, comments and shares on its recent posts. Where Meta notifies us that you have removed Posttyy from your account, we mark the connection as needing reconnection; where Meta passes on a data deletion request, we delete the stored connection and its credentials.
• LinkedIn. We request your name, profile picture and member id (to show which account is connected and to publish as you) and permission to post on your behalf. We do not read your feed, your connections or your messages. LinkedIn sign-ins expire after 60 days, after which the stored credential no longer works and you reconnect.
• Pinterest. We request your username, profile picture and account id (to show which account is connected), your account’s follower, following, pin and monthly view totals (to show on the Analytics page), the list of your public boards (so you can choose which to pin to) and permission to create pins. Pinterest’s pin endpoint additionally requires permission to read pins and to write boards before it will accept a pin at all. We use the first to read your pins and their numbers for the Analytics page, and the second only to make a board when you ask for one while writing a post. Posttyy changes and deletes no pins and no boards. We do not request access to your secret boards or to who you follow.
• YouTube. We request your channel’s name, handle, picture and id (to show which channel is connected and to link to a published video) and permission to upload videos. We use YouTube data only to publish the videos you schedule, to display the connection in your account, and to show on the Analytics page your channel’s subscriber, view and video totals and the view, like and comment counts on your recent videos. We do not read your watch history, your subscriptions, your comments or anyone else’s videos.
• X (Twitter). We request your basic profile and permission to post and upload media, used for the same two purposes and for the Analytics page, which shows your account’s totals and, for each of your posts, its impressions, likes, replies, reposts, quotes, bookmarks, profile clicks and link clicks. We save these each day to show how they change; see section 3.

Posttyy uses YouTube API Services. By connecting a YouTube channel you also accept the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy. You can withdraw Posttyy’s access to your Google account at any time at myaccount.google.com/permissions, which is separate from disconnecting the channel in Posttyy.

Once a post is published it lives on that platform and is governed by that platform’s own privacy policy, not this one.

7. Using Posttyy from Claude or ChatGPT

On some plans you can connect Posttyy to an AI assistant such as Claude or ChatGPT, so that it can write and schedule posts for you. This section says what that connection does with your data.

How you connect. You sign in to Posttyy and press Allow on our approval page. Posttyy then gives the assistant a sign-in token for your account. The token lets the assistant do what you could do yourself in Posttyy, and nothing more. It never gives the assistant your password, or the credentials we hold for your social accounts. Those stay on our server. Our authentication provider, Supabase, records that you approved the assistant: which assistant it is and when you approved it.

What the assistant can see. When it asks, we send it:

• the list of your connected social accounts: the network, your name on it, and, for Pinterest and YouTube, your boards or video categories;
• your posts and drafts: their text, their times, which accounts they go to, whether each one went out, and any error;
• your connected accounts’ numbers, the same ones the Analytics page shows: each account’s totals, such as its follower count, and its recent posts with their text, their links, and their likes, comments, shares and views; for Pinterest, the account’s impressions, engagements, clicks and saves and its top pins;
• the photos and videos you added on the upload page that are not on a post yet, as a short list and a temporary preview link that stops working after 15 minutes.

What the assistant can do. It can create, change, move and delete your posts and drafts, and post straight away, to the accounts you have connected. Each post goes through the same checks as one you write yourself. It cannot connect or disconnect a social account, change your plan, read your billing details, or see your password.

Photos and videos. If the assistant sends a photo or video by link, or you attach one in ChatGPT, our server downloads it and stores it in your private storage, like a file you upload yourself. If it is not put on a post, we delete it within about a day.

What we do not collect. We do not see your conversation with the assistant. We receive only what the assistant sends us to carry out a request, such as the words of a post and the accounts it is for. We do not use that data for anything other than carrying out the request. We keep the same records of a post that we keep for any other post (see section 3).

The assistant’s own provider. Whatever the assistant receives from us, it receives under the privacy policy and terms of the company that runs it, such as Anthropic or OpenAI. Those companies are not our processors. You choose to connect them, in the same way you choose to publish to a social platform.

Ending the connection.Remove the Posttyy connector in the assistant. It then stops asking for your data. To end the assistant’s access straight away, press Disconnect next to it under Connected assistants on your Account page. The assistant is then refused, and cannot connect again unless you approve it again. It is also refused if your plan changes to one that does not include the connection. Deleting your account ends all connections.

8. Who else sees your data

We do not sell or rent personal data. We share it only with the providers that run the service on our behalf, each bound to protect it and to use it only for that purpose:

• Supabase — database and authentication, storing your account, posts and encrypted credentials.
• Cloudflare R2 — storage for the photos and videos you upload, in a private bucket.
• Stripe — payments, subscriptions and invoices. Stripe takes your card details directly; we never see or store them. We hold only the identifiers Stripe gives us for your customer and subscription, and which plan you are on.
• Vercel — hosting and delivery of the application.
• OpenAI — writes the captions, bios, username ideas and hashtags in our free Instagram caption, bio, username and hashtag generators. It receives only the text typed there. We don’t save the description or what is written from it. To limit how often the free tools are used, we keep a one-way hash of the visitor’s IP address, never the address itself, for two days.
• The platforms you choose to publish to — which receive the post you asked us to send them.
• An AI assistant you connect — which receives what section 7 lists, and nothing else.

We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold or transferred, data may pass to the buyer under the protections of this policy.

9. Where your data is held, and for how long

Our providers operate internationally, so your data may be processed outside the UK and EEA. Where it is, the transfer is covered by appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

We keep data for as long as you keep using the service:

• Posts, drafts and media — until you delete them, or until your account is deleted.
• Media uploaded but never attached to a post — deleted automatically within about a day.
• Social account credentials — until you disconnect the account, or your account is deleted. A subscription ending does not disconnect anything: the account stops publishing, and its credentials are kept so it works again if you subscribe again.
• Billing records — invoices and payment records are kept by Stripe and by us for as long as tax and accounting law requires, which is longer than your account lasts and is not something deleting your account changes.
• Analytics numbers saved for an X or Pinterest account — until you disconnect the account, or your account is deleted.
• Account records — until you delete your account.
• Server logs — for a short period set by each provider, typically weeks rather than months.

10. Your rights

Under UK and EU data protection law you have the right to access a copy of your data, to have inaccurate data corrected, to have your data deleted, to restrict or object to how we use it, and to receive it in a portable form. You can also withdraw consent where we rely on it.

Write to posttyy.app@gmail.com and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO), or to your local supervisory authority.

11. Deleting your data

You can remove your data yourself at any time:

• Disconnect a social account on the Connected Socials page. This deletes the stored credentials for it, and any analytics numbers saved for it, immediately.
• Delete individual posts, drafts or media from within the app.
• Revoke our access from the platform’s own settings — this stops us publishing on your behalf even before the connection is removed here.
• Delete your whole account by emailing posttyy.app@gmail.com. We will delete your account, its credentials, and all of your content.

Posts already published to a platform are not deleted by any of this. They are on your account, on that platform, and you remove them there.

12. Security

Social media credentials are encrypted with AES-256-GCM before being stored, and the encryption key is held separately from the database. Uploaded media is stored in a private bucket and is only reachable through short-lived links generated for someone already entitled to see it. Database access is restricted per account, so one account cannot read another’s data. Traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you and the regulator as the law requires.

13. Children

Posttyy is not intended for children. You must be at least 13, and old enough to hold accounts on the platforms you connect. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The effective date at the top of the page shows when the current version took effect, and for material changes we will make a reasonable effort to notify you.

15. Contact

Cavelights LTD, operator of Posttyy — posttyy.app@gmail.com.