PostPilot Privacy Policy

Data we access from connected accounts

When you connect a platform, you grant PostPilot access through that platform’s official API. We access only what is needed to publish and manage the content you schedule:

• Google user data (YouTube Data API v3), via the youtube.upload and youtube.readonly scopes: your YouTube channel identity (channel ID, title, handle, and description), the titles, descriptions, and publish dates of your recent uploads, and the OAuth access and refresh tokens that authorize these calls. We also upload the videos you schedule to your channel.
• TikTok: your basic account and creator information (such as display name and the posting options your account supports) and OAuth tokens, plus the videos you schedule for publishing.
• Meta / Instagram: your Instagram professional account identity (account ID and username) and OAuth tokens, plus the videos (Reels) you schedule for publishing.

How we use this data

We use data from connected accounts solely to provide the features you request: to identify and display your connected channel or profile, to publish the videos you schedule to your own accounts, and — for YouTube channels — to read your channel description and recent upload titles so we can generate on-brand captions for the posts you create. We do not use this data for advertising, profiling, resale, or to train machine-learning models.

How we share this data

We do not sell your data or share it for marketing. We transmit it only as needed to deliver the service:

• To the platform’s own API (Google/YouTube, TikTok, Meta) to carry out the action you asked for, such as publishing a video.
• To a small set of service providers that operate our infrastructure strictly on our behalf: Cloudflare R2 for temporary media storage and OpenAI to generate captions. Where YouTube channel data is used to generate a caption, it is sent to OpenAI only to produce that caption at your request; it is never used to train models.

How we protect this data

All data is transmitted over encrypted connections (TLS). OAuth access and refresh tokens — the most sensitive data we hold — are encrypted at rest using authenticated AES-256-GCM encryption and are never stored in plaintext or exposed to the client. Access to production systems is restricted to authorized personnel.

Data retention and deletion

We retain your OAuth tokens and connected-account details only while your account is connected, so we can publish on your behalf. Video files are stored temporarily to enable publishing and are removed once they are no longer needed. Channel and recent post metadata used to generate captions is processed transiently and is not retained for any other purpose. When you disconnect a platform or delete your account, we revoke the platform access and delete the associated tokens and account data. You can disconnect a platform at any time in Settings, request deletion at post-pilot.app/data-deletion, or email us and we will delete your data.

Google API Services — Limited Use

PostPilot’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We apply these same limited-use principles to data received from TikTok and Meta.

Cookies and analytics

We use only the strictly necessary cookies required to keep you signed in and to operate the app. We do not use tracking cookies to follow you across other sites.

Your choices

You can disconnect any linked platform or delete your account at any time, which revokes our access and removes your associated data. If you have any question about your data, reach out and we’ll help.

Changes to this policy

If we ever change how we handle data, we’ll update this page and revise the date above. Continued use of PostPilot after a change means you accept the updated policy.

Contact

Questions about this policy? Email us at privacy@postpilot.app.