Privacy
PostFlow publishes posts to social accounts you connect. This page says exactly what it stores to do that, what it never stores, and how to get rid of it.
Last updated 2026-08-31
This document is not yet in force. The operating entity and contact address have not been filled in (src/lib/legal/operator.ts), so it names nobody and binds nobody. It is published here for review only.
What PostFlow stores
| Data | Why it exists |
|---|---|
| Your identity | Email address and display name, received from Google when you sign in. Used to know whose projects are whose. |
| Project settings | A project's name, timezone and schedule. The timezone is what decides which day a post lands on. |
| Connection tokens | The permission Facebook and Instagram give PostFlow to publish for you. Encrypted where it is stored, and never sent to your browser. |
| Connected account details | The Page or account id, its name, username and avatar — so the interface can show you which account a post is going to. |
| Media you upload | The images and video attached to a post. |
| Publication records | What was published, when, to which account, and whether it worked. This is the history the calendar shows you. |
| An audit log | A record of actions taken on your data, including deletions, so there is evidence of what happened. |
What PostFlow does not store
Your ChatGPT conversations. Content reaches PostFlow because a custom GPT sends it. There is no path in the other direction: PostFlow cannot read your chat history, and the API states this in its own capability record rather than only in prose.
Your password. Sign-in happens through Google. PostFlow never receives one.
Analytics or advertising data. This site loads no tracking scripts and no advertising network. Nothing about your visit is sent to a third party for measurement.
Where it is held
| What | Where |
|---|---|
| The API and database | A Linode server in Singapore. |
| Uploaded media | Google Cloud Storage. Nothing reads the bucket directly; access is only ever through a short-lived signed link the API creates. |
| This website | Netlify. |
| Sign-in | Google Firebase Authentication. |
Who it is shared with
Only the services needed to do the job: Meta (Facebook and Instagram), to publish what you schedule, and Google, for sign-in and media storage.
Your data is not sold, and it is not shared for advertising. It is disclosed otherwise only where the law requires it.
If you remove PostFlow from Facebook
Facebook tells PostFlow, and the permission to publish is destroyed first, before anything else happens — so if any later step fails, the access is already gone.
Your connections are then marked as needing reconnection, and anything still waiting to publish is held rather than sent. Posts that already published stay on your Page: they exist in the world, and deleting PostFlow’s record of them would not remove them — it would only remove your ability to see what went out.
Deleting your data
You can request deletion through Facebook’s app settings. PostFlow answers with a confirmation code and a status page at https://api.postflowit.autos/privacy/data-deletion/<code>, which you can check without signing in — by then you may no longer have an account to sign in to. The code is unguessable, and an unknown code and someone else’s code give the same answer, so the page cannot be used to fish for others.
The work happens in the background rather than inside that request.
Deletion removes your connection tokens and the identifiers of your connected accounts — ids, names, usernames, avatars — including the identifier attached to the deletion request itself, so the record of the deletion is not itself a record of you.
Deletion keeps the audit entry showing a deletion happened, with nothing identifying attached, and the publication history, which no longer points at any account. A deletion that erased its own evidence would leave nothing to show it was carried out.
How long things are kept
| Data | Kept for |
|---|---|
| Webhook events | 30 days — long enough to investigate a delivery problem |
| Idempotency records | 24 hours — a retry window, not a history |
| Sign-in and authorization codes | Until they expire; they are single-use |
| Expired or revoked tokens | Until expiry; nothing can use them afterwards |
| Media that was rejected | 7 days, so we can answer why it was refused |
| Files belonging to a deleted project | 30 days, as a grace period to restore it |
| The audit log | Not deleted, deliberately — it is the evidence of everything above |
Children
PostFlow is a tool for managing business and creator accounts and is not directed at children. It should not be used by anyone under the age required by the social platforms it connects to.
Changes
If this page changes in a way that affects what happens to your data, the date at the top changes with it.
Contact
No contact has been published yet. Until one is, requests cannot be made through this page.