Privacy Policy
Last updated 26 August 2026.
Postbase is operated by Whoamie. This policy explains what we collect, why we collect it, and how long we keep it. We do not sell your data, we do not use it for advertising, and we do not train machine learning models on it or on the content you publish.
What we collect
Account details. Your email address, an optional name, and a password stored only as a scrypt hash — we never hold your password itself. We also store your approval status and plan.
Brands. The names and identifiers you give the brands you create.
Platform connections. When you connect a social account, we store the access token and refresh token that platform issues, plus the account name or ID so we can show you which account is connected. Tokens are encrypted at rest with AES-256-GCM.
Publishing records. For each post you publish we store the target platform, the time, the outcome, and the post ID the platform returns, so we can show you your activity and count usage against your plan.
API keys. Stored as hashes, with the name you gave the key and when it was last used. The key itself is shown once, at creation, and cannot be recovered afterwards.
Brand descriptions, if you write one. What your business is, who it is for, its goal, its voice, and anything you tell the AI writer never to say. Stored so you only answer it once, and used only to draft posts for that brand.
Scheduled posts. The text, target platforms, chosen time and audience timezone of anything you queue, held until it publishes or you cancel it, and kept afterwards as a record of what went out.
Messages you send us. Anything you write on the Help & contact page, our reply, and the page you were on when you wrote it.
Technical data. A session cookie once you sign in, and server logs containing IP addresses and request metadata, used for security and debugging.
What we do not collect
We do not read your timelines, feeds, followers, direct messages, or other people’s posts. We do not scrape platforms or build profiles of you or your audience. We request only the scopes needed to identify the connected account and publish on your instruction, and nothing broader.
Why we use it
- To operate the Service — authenticate you and publish what you submit.
- To keep connections working — refresh tokens before they expire.
- To enforce plan limits and show you your own usage and activity.
- To secure the Service — rate limiting, abuse prevention, debugging.
- To email you about verification, account status, and material changes.
Where GDPR applies, our legal bases are performance of a contract (operating the Service), legitimate interests (security and abuse prevention), and consent (where you authorise a platform connection).
Who we share it with
We do not sell or rent your data, and we share it only with the processors needed to run the Service:
- The platforms you connect — we send them the content you chose to publish, over their own APIs. What happens to it there is governed by their policies.
- An AI model provider — only if you use “Generate with AI”. When you do, your brand description, the goal you typed, any keywords, and the text of your recent posts for that brand are sent to the provider configured on this instance (currently one of Anthropic, OpenAI, Google or Moonshot) so it can draft the post. Nothing is sent unless you press the button, and what that provider does with it is governed by their terms, not ours. If you would rather nothing left, do not use the feature: everything else in Postbase works without it.
- Resend — delivers our transactional email; receives your email address.
- Our hosting provider — runs the servers and database that store the data described above.
We may also disclose data where legally required, or to protect our rights or the safety of others.
Where it is stored
On servers we control, in a PostgreSQL database. Traffic to Postbase is encrypted in transit with TLS. OAuth tokens are encrypted at rest with a key held outside the database, so a database copy alone does not yield usable credentials.
How long we keep it
- Platform tokens — until you disconnect that platform, which deletes them immediately, or until you delete your account.
- Account and brand data — until you delete your account, then removed within 30 days.
- Publishing records — retained while your account is open for your activity view and usage counting, then deleted with the account.
- Server logs — kept for a limited period for security and debugging.
Your rights
You can access and correct your details in the console, disconnect any platform at any time, revoke any API key, and delete your account. Depending on where you live you may also have the right to a copy of your data, to have it erased, to restrict or object to processing, and to complain to your data protection authority. Email us and we will action it within 30 days.
You can also revoke Postbase’s access from the platform’s own settings, which works whether or not you contact us.
Children
Postbase is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
Changes
We will update the date above when this policy changes, and notify you by email or in the console before a material change takes effect.
Contact
Privacy questions or requests: hello@whoamie.com.