Privacy Policy
Last Updated: October 9, 2026 • Compliant with Meta App Review, TikTok Developers, and Google API Services
Our Privacy Commitment in Brief:
At PostPlanner, we respect your privacy and protect your data with bank-grade security standards. We do not sell, rent, or monetize your personal data. Social platform permissions are used exclusively to schedule and publish the videos you explicitly configure. All tokens are encrypted at rest with AES-256-GCM.
01.1. Information We Collect
a. Account Information: Name, email address, salted password hash (via bcrypt), and workspace name.
b. Social Media Authorization Data: Platform account IDs, channel or page names (@username / Page Name), avatar URLs, and OAuth access & refresh tokens.
c. Video Media & Metadata: Video files, extracted thumbnails, captions, and scheduling times. Videos are uploaded directly from your browser to Cloudflare R2 storage without proxying through application servers.
02.2. How We Use Data & Requested Scopes
We request only the minimum necessary permissions required to fulfill scheduled publishing:
Meta (Facebook & Instagram)
• pages_show_list, pages_read_engagement: To list managed Pages and linked Instagram accounts.
• instagram_basic, instagram_content_publish: To upload and publish scheduled Instagram Reels.
• pages_manage_posts: To publish videos and Reels to Facebook Pages.
TikTok
• user.info.basic: To display connected profile name and avatar.
• video.publish, video.upload: To publish video posts via the Content Posting API v2.
YouTube (Google)
• youtube.upload: To upload and publish videos and Shorts to your channel.
• youtube.readonly: To verify channel details and verify upload status.
LinkedIn & X (Twitter)
• w_member_social: To share native video UGC posts on LinkedIn.
• tweet.write, media.write: To perform chunked media upload and publish Tweets via X API v2.
03.3. Data Security & Token Encryption
All access and refresh tokens are strictly encrypted at rest using AES-256-GCM authenticated encryption with 32-byte secret keys. Plain-text tokens are never stored in the database or logged in application traces.
The OAuth state parameter is digitally signed using HMAC-SHA256 to protect against CSRF and replay attacks during social authentication.
4. User Data Deletion Instructions
In accordance with Meta (Facebook/Instagram) platform terms, TikTok developer policies, and GDPR requirements:
- Instant Account Disconnect: You can disconnect any social account at any time from the Connections page. This deletes stored tokens and revokes access.
- Revoking From The Provider: You can also revoke PostPlanner permissions directly in Facebook Business Settings, TikTok Security Settings, or Google Connected Apps.
- Request Full Data Erasure: To completely wipe your account, video assets, scheduled targets, and audit logs, visit our Data Deletion Request Page or email support@yourdomain.com. Your data will be purged within 24 hours.
05.5. Third-Party Sharing
We do not sell, rent, trade, or monetize your personal information with third-party advertisers. Data is transmitted strictly to official social platform APIs (YouTube, Meta, TikTok, LinkedIn, X) to fulfill the actions you command.
06.6. Contact Information
For any questions or privacy inquiries regarding this policy, please reach out to our team: