Privacy Policy

Account data. When you sign up we store your name, email address, and authentication identifiers from your sign-in method (magic link via email, or Google). We also store security metadata such as session timestamps and IP addresses for abuse prevention.

Workspace and team data. Workspace name, address (slug), member list, roles, and invitations.

Content you submit. Campaigns and their runs: the text, media metadata and destination-specific payloads you (or your agents) submit for review and publication. Media bytes are stored in your own object storage when you bring your own bucket, or in Postward-managed storage on paid plans.

Operational records. Approval decisions, comments, schedules, publication attempts, remote platform results, and an audit trail of consequential actions. These exist so history is never lost and incidents can be diagnosed.

Social network credentials. When you connect a destination (for example Instagram or LinkedIn), we store the API credentials required to publish on your behalf. These are encrypted at rest (AES-256-GCM), never displayed again after submission, never exposed to browser JavaScript, and never shared between workspaces.

Hosted creative credentials. When you connect a generation provider (for example fal.ai) for hosted creative, we store your API key encrypted at rest (AES-256-GCM with a dedicated purpose key). It is decrypted only inside the server for the duration of a generation call, never displayed again after submission, never exposed to browser JavaScript, MCP tool responses, logs or analytics. You can disconnect it at any time from Creative tools.

Billing data. If you subscribe to a paid plan, Stripe processes the payment. We store your Stripe customer id, subscription status, and usage counters (for example, monthly publication counts). We never see or store full card numbers.

AI: your model choice, your data. For publishing, content creation happens with your own AI providers (BYOK — bring your own keys). For hosted creative generation (paid plans), you provide your own provider API key (for example fal.ai); Postward stores that key encrypted and uses it only to execute the generation you request. Your prompts and input assets are sent to the provider to fulfill your request — never used for training, never shared between workspaces. Generated outputs become your workspace assets.

No AI training on your content. We do not train AI on your data, and we do not use your content for advertising.

No selling or advertising use of data. We do not sell personal data, and we do not use your content or contacts for advertising.

No unnecessary credential access. Secrets (social tokens, storage keys, app secrets used in the Token Lab) are used server-side for the operation you request. They are excluded from logs, analytics, error reporting, and from any MCP/agent-visible response.

• To provide the service: store campaigns and runs, render previews, publish to the destinations you configure.
• To keep credentials healthy: validate tokens, refresh them where the provider allows, and surface expiry or permission problems.
• To operate safely: rate limiting, abuse prevention, security auditing, incident response.
• To bill accurately: counting intentional publications against your plan quota.
• To communicate service facts: magic links, workspace invitations, approval requests, publication failures, credential expiry and billing notices. These are product emails, not marketing.

Application data is stored on our self-hosted infrastructure (PostgreSQL, with daily encrypted off-site backups). Media bytes live either in the S3-compatible bucket you own (BYO storage — we hold only encrypted access keys) or in Postward-managed object storage on paid plans. Managed storage is covered by the same backups and is never expired by age while your subscription is active.

Email is delivered through our own mail infrastructure. We do not route your content through third-party communication platforms.

Postward is designed to be operated by AI agents through our MCP endpoint and API. Agents authenticate with OAuth 2.1 and receive only sanitized metadata — never raw credentials. When an agent approves or publishes on your behalf, the action is recorded under your authenticated identity and appears in the audit trail. We do not send your data to any model provider; the agent you use is yours.

• Stripe — payments and subscription management (paid plans).
• fal.ai — hosted AI generation (image, video, audio, music) on paid plans with hosted creative. Your prompts and input assets are sent to fal.ai to execute the generation you request; your API key is stored encrypted and used only for that purpose. fal.ai’s own privacy policy applies to their processing.
• Google — sign-in with Google, if you choose it, and the OAuth provider for YouTube connections.
• Social platforms you connect (Instagram, LinkedIn, YouTube, Discourse) — we send exactly the publish operations you approve, using your credentials.
• Your own object storage provider (Wasabi, AWS, Cloudflare R2, MinIO) when you bring your own storage.

We do not add analytics trackers to the product, and we do not share data with advertising networks.

• Workspaces: deleting a workspace cancels future schedules, removes members and credentials, and starts managed-storage deletion after a 30-day grace window. Billing and legally required accounting records are retained as required.
• Media: with BYO storage, deletion of media is under your control at all times. Managed media is deleted with the workspace grace policy.
• History: publication and approval history is immutable by design; deleting a workspace deletes its history with it.
• Account deletion: you can delete your account from settings; connected provider authorizations are revoked and permanent credentials removed.

Depending on your jurisdiction (including GDPR and LGPD), you have rights to access, correct, export and delete your personal data, and to object to or restrict certain processing. In-app export covers campaign metadata, run manifests, approval and publication history, and managed artifacts. For anything else, or to exercise rights, contact us at privacy@postward.cc — we respond within 30 days. Human Software Brasil acts as data controller for account and billing data, and as processor for the content you publish through the service.

We encrypt credentials at rest (AES-256-GCM), use TLS in transit, isolate workspaces server-side, verify webhook signatures, and keep permanent secrets out of browser JavaScript, logs and agent responses. We apply dependency and container patching as part of deployment. If a security incident affects your data, we will notify you and the relevant authorities as required by applicable law.

We will announce material changes on this page (with an updated date) and, for signed-in users, by email when the change affects how we use personal data.

Questions, requests or complaints: privacy@postward.cc. For billing questions, use the billing portal or billing@postward.cc.