Privacy Policy
Last updated: August 9, 2026
This policy explains what Postpilot ("we", "the Service") collects when you use it to plan, approve, and publish social content, how that information is used, and the choices you have.
1. Information we collect
Account information. When you sign up we collect your email address and authentication details needed to sign you in. If you sign in with a third-party provider, we receive your email address and basic profile identifiers from that provider.
Brand and content data. Brand profiles, voice and guideline notes, content topics, style reference screenshots, drafts, captions, hashtags, schedules, approval decisions, and any video or image files you upload.
Social account connection data. When you connect a social account we store the access and refresh tokens the platform issues, your platform open ID, display name, and avatar, plus the publish identifiers and status responses returned when we post on your behalf.
Technical data. Basic logs such as request timestamps, error details, and publishing attempt records used to operate and debug the Service.
We do not collect payment card details, and we do not sell personal information.
2. How we use your information
- Authenticate you and keep your account secure.
- Store and display your drafts, media, and brand settings.
- Generate AI-assisted captions, hashtags, topics, and imagery you request.
- Publish approved posts to the social account you connected, on your instruction.
- Check publish status with the platform and surface success or failure back to you.
- Diagnose errors, prevent abuse, and improve reliability.
We do not use your content to train our own AI models.
5. Data retention
We keep your account, brand data, drafts, and uploaded media for as long as your account is active. Publishing attempt logs are retained for a limited period for troubleshooting. When you delete content in the app, it is removed from our storage. When you delete your account, we delete your data, except where we must keep records to meet legal obligations.
6. Security
Data is transmitted over encrypted connections and stored with access controls that restrict each account to its own records. Media served to the platform uses short-lived signed links. No system is perfectly secure, so please use a strong, unique password and tell us promptly if you suspect unauthorized access.
7. Your rights and choices
- Access, correct, or delete your brand data and media from within the app.
- Disconnect your social account at any time in Settings.
- Request deletion of your account and associated data.
- Depending on where you live, request a copy of your data or object to certain processing.
8. Children
The Service is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
9. Changes to this policy
We may update this policy as the Service changes. Material updates will be reflected in the "last updated" date above. Continuing to use the Service after an update means you accept the revised policy.
10. Contact
For privacy questions or data deletion requests, reach us through the contact channel listed on our social profile, @gem.gains.
3. Social account data and permissions
Connecting a social account is optional and always initiated by you through the platform's official authorization screen, where you see the exact permissions requested. We use those permissions only to read your basic profile information and to publish content you have approved.
We never post without an explicit approval and publish action from you or a schedule you set. Tokens are stored server-side and are not exposed to the browser.
You can disconnect your social account at any time in Settings. Disconnecting deletes the stored tokens and stops all further publishing to that account. Content already published to the platform is governed by that platform's own policies and must be removed in its app.