Privacy policy

Who we are

Postbito (“Postbito”, “we”, “us”) runs postbito.com, a service that schedules and publishes posts to Facebook, Instagram, YouTube, TikTok, X and LinkedIn for the people and teams who connect their accounts. This policy explains what we do with information about you and your accounts. If anything here is unclear, write to [email protected].

What we collect

Your account

Your name, email address and a hashed password; two-factor and passkey details if you turn them on.
Your team’s name, its members and their roles, and invitations you send.
Billing details handled by our payment processor, Stripe. We see the plan, the number of channels, the last four digits and expiry of your card, and invoices — never the full card number.

Accounts you connect

The account’s id, name, username, profile picture and link, as the network shares them.
The access tokens (and refresh tokens) the network gives us, and the permissions you granted. Tokens are encrypted before they are stored.

What you create

Posts and their captions, per-network options and schedules; ideas; approval notes and comments.
Photos and videos you upload, or that you ask Postbito to fetch from a link.
API keys you create (we store only a hash of each key) and what they were used for.

From the networks, about your posts

Each published post’s id and link, and its numbers — views, impressions, reach, likes, comments, shares, saves and clicks, where the network reports them.

When you use Postbito

Technical information such as your IP address, browser and device, pages visited and errors, kept in logs to run and secure the service.
A session cookie to keep you signed in, and your light or dark mode preference. We don’t use advertising or cross-site tracking cookies.
Messages you send to support.

How we use it

To do what you ask: publish the posts you schedule to the accounts you choose, at the times you choose, and show you how they did.
To run your team: invitations, approvals, notifications and the weekly results email (which you can turn off).
To bill you, prevent abuse, keep the service secure, fix problems and answer support requests.
To improve Postbito using aggregated, de-identified usage information.

We don’t sell your information, we don’t use it for advertising, and we don’t use your content or data from your connected accounts to train AI models.

When you connect an account, you sign in on the network’s own page and choose what Postbito may do. We ask only for what publishing and reporting need:

Facebook — the Pages you manage, to publish posts, photos and videos to the Pages you pick, and to read those posts’ engagement.
Instagram — your professional account’s basic profile, to publish posts, carousels, reels and stories, and to read their insights.
YouTube — your channel’s basic details, to upload the videos you schedule and read their statistics.
TikTok — your basic profile and creator settings, to post the videos and photos you schedule and read their counts.
X — your profile, to post and upload media for you and read your posts’ metrics.
LinkedIn — your basic profile (and the Pages you administer, if you connect one), to share posts and media for you and read their statistics.

We use this data only to provide Postbito to you. We don’t share it with other users outside your team, and we don’t combine it with data from other sources to profile you.

YouTube and Google

Postbito uses YouTube API Services to upload videos and read channel and video statistics for the YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your information is described in the Google Privacy Policy.

Postbito’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Postbito’s access to your Google account at any time from your Google security settings. When you disconnect a YouTube channel or revoke access, we stop using the tokens; stored YouTube data is deleted as described under How long we keep it.

Photos and videos

Media you upload is stored privately. Networks that fetch files themselves (Instagram, Facebook and TikTok) are given a link that expires after a short time. By default, once every post that uses a file has been published, Postbito deletes the file and keeps only a small thumbnail so your history still shows what went out. You can turn that off for your team in Publishing settings, and you can delete any file yourself from the media library.

The networks you publish to — the posts, captions and media you choose to publish there, under their own terms and privacy policies.
People on your team — posts, ideas, media, channels and analytics belong to the team and are visible to its members.
Service providers — companies that host and run Postbito for us under contract: cloud hosting and file storage, Stripe for payments, and Postmark for email. They may use the data only to provide their service to us.
When the law requires it — to comply with a valid legal request, or to protect the rights and safety of our users or others.
If Postbito changes hands — in a merger or acquisition, this policy continues to apply to your information.

How long we keep it

Your account, team and content: for as long as your account exists.
A connected account’s tokens: until you disconnect it, revoke access at the network, or delete your account.
Media files: until every post using them is published (unless you turn clean-up off), or until you delete them.
When you delete your account, we delete its data within 30 days; copies in backups are overwritten within a further 30 days. Billing records are kept as long as tax law requires.

See Deleting your data for step-by-step instructions.

Security

Postbito is served only over HTTPS. Access tokens are encrypted at rest, API keys are stored as hashes, and access to production systems is limited to the people who run Postbito. You can protect your own account with two-factor authentication and passkeys. No system is perfectly secure; if we learn of a breach that affects you, we’ll tell you promptly.

Your choices and rights

You can see and edit most of your information in Postbito, disconnect any account, delete posts, ideas and media, export your data on request, and delete your account. Depending on where you live (for example in the EU, UK or California) you may also have rights to access, correct, delete or port your information, and to object to or restrict how we use it. Email [email protected] from your account’s address and we’ll respond within 30 days. You can also complain to your local data protection authority.

Children

Postbito is for businesses and people aged 16 and over. We don’t knowingly collect information from children; if you think a child has given us information, contact us and we’ll delete it.

Changes

If we change this policy we’ll update the date at the top, and for significant changes we’ll email account owners before they take effect.

Contact

Questions or requests about privacy: [email protected].