Legal

Privacy policy

Last updated: October 2, 2026

This policy explains how Postwme, operated by Nguyễn Minh Phúc (“Postwme”), collects, uses, shares, protects, retains, and deletes personal data when you use postwme.com, our applications, and related services.

The short version

  • We use your information to create, manage, schedule, and publish the content you request.
  • We do not sell personal data or use third party advertising cookies.
  • You can schedule account deletion from privacy settings, and request a copy of your data by email.
  • Account deletion has a 30 day grace period that you can cancel before it expires.

1. Who is responsible

Postwme is operated by Nguyễn Minh Phúc, based in Vietnam, who is responsible for the processing described in this policy, including data received from Meta. Privacy requests can be sent to support@postwme.com.

2. Information we collect

  • Account information: email address, display name, locale, authentication identity, and account status.
  • Business information: business name, links, category, language, brand settings, team membership, and permissions.
  • Customer content: uploaded photos and videos, logos, prompts, captions, generated media, drafts, schedules, and approvals.
  • Connected account information: platform identity, encrypted access credentials, granted scopes, connection status, publishing targets, and post performance data.
  • Billing information: subscription state, transaction references, entitlement status, and video credit activity. Stripe handles full payment credentials.
  • Technical and security information: session data, device and browser information, IP address, request logs, and error data.
  • Communications: support requests and other messages you send to us.

3. How we use information

  • Provide authentication, businesses, team access, media storage, content generation, review, scheduling, publishing, and performance features.
  • Process subscriptions and video credits, maintain entitlements, and prevent duplicate transactions.
  • Secure the service, prevent abuse, investigate failures, and maintain audit records.
  • Respond to support, export, deletion, and legal requests.
  • Maintain and improve service reliability and product performance.

Where applicable, we process data to perform our contract with you, comply with legal obligations, protect our legitimate interests in operating a secure service, and act on consent when consent is the required basis.

4. How information is shared

We disclose information only as needed to operate the service or meet legal obligations:

  • Infrastructure and authentication: Cloudflare and PlanetScale provide application hosting, database, authentication, and private media storage functions. Infisical stores application secrets.
  • Content processing: AI and media processing providers receive the prompts, source media, and instructions required for the generation you request.
  • Payments: Stripe processes purchases and returns transaction and entitlement information.
  • Connected social platforms: approved content, schedules, and necessary account credentials are sent to the platforms you connect (Meta, Pinterest, TikTok and YouTube).
  • Legal and safety: information may be disclosed when required by law or reasonably necessary to protect users, Postwme, or the public.
  • Business transfers: information may be transferred as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

Postwme does not sell personal data.

5. Data from Facebook and Instagram (Meta)

When you connect Facebook through Facebook Login, Postwme receives the following from Meta, limited to the permissions you approve:

  • Your public profile: your Facebook name and user ID, to label the connection.
  • Pages you manage: Page ID, name, your tasks on the Page, and a Page access token, so you can choose where to publish.
  • Business portfolios: the ID and name of each Business portfolio you administer and the Pages owned by or shared with it. This access is read only. Postwme never creates, changes, or removes business assets, people, or settings.
  • Page posts and engagement: posts Postwme published to your Page and their basic performance, to show you the publishing result.

Postwme uses this data only to list your Pages, publish or schedule the posts you explicitly submit, and report the result. We do not sell it, use it for advertising, or share it with anyone other than the service providers listed above. Access tokens are encrypted with AES-256-GCM before they are stored, using a key kept separately from the database. Disconnecting a Page or revoking Postwme in Facebook Settings → Business integrations stops all access immediately and deletes the stored token; see the data deletion page.

6. Data from Pinterest

When you connect Pinterest, Postwme receives the following through the Pinterest API, limited to the scopes you approve (user_accounts:read, boards:read, pins:read, pins:write):

  • Your account: your Pinterest user ID and username, to label the connection.
  • Your boards: the ID and name of each board, so you can choose where to publish.
  • Pins Postwme created: the Pin ID and link, to show you the publishing result.

Postwme uses this data only to list your boards and create the Pins you explicitly submit or schedule. We do not read other Pins, sell the data, use it for advertising, or share it beyond the service providers listed above. Access and refresh tokens are encrypted with AES-256-GCM before they are stored. Disconnecting Pinterest in Postwme, or revoking Postwme under Pinterest Settings → Security → Connected apps, stops all access and deletes the stored tokens; see the data deletion page.

7. Data from TikTok

When you connect TikTok through TikTok Login Kit, Postwme receives the following, limited to the scopes you approve (user.info.basic, video.publish):

  • Your account: your TikTok open ID, display name, username and avatar, to label the connection.
  • Posting settings: the privacy levels your account may post with and whether comments, Duet and Stitch are enabled, shown to you each time you post.
  • Posts Postwme created: the publish ID, status and video ID of each post you submit, to show you the result.

Postwme uses this data only to publish or schedule the videos you explicitly submit, with the visibility, interaction and content-disclosure choices you make for each post. We do not read your other videos, sell the data, or use it for advertising. Access and refresh tokens are encrypted with AES-256-GCM before they are stored. Disconnecting TikTok in Postwme, or removing Postwme under TikTok Settings → Security → Manage app permissions, stops all access and deletes the stored tokens; see the data deletion page.

8. Data from YouTube and Google (Postwme Agents)

Postwme Agents (agents.postwme.com) is part of the Postwme service and uses YouTube API Services. By using its YouTube features you also agree to be bound by the YouTube Terms of Service, and the data is also subject to the Google Privacy Policy.

When you connect a YouTube channel through Google sign-in, Postwme Agents accesses the following through YouTube API Services, limited to the scopes you approve (youtube.upload, youtube.force-ssl, yt-analytics.readonly):

  • Your channel: the channel name, ID, avatar and subscriber count, to label the connection.
  • Your videos: the metadata and statistics of the channel's videos (views, likes and comments).
  • YouTube Analytics: YouTube Analytics reports for the channel.
  • Publishing, where you choose to post: uploading videos, thumbnails, captions and metadata to your own channel.

Postwme Agents uses this data only to show you your own channel and video performance inside Postwme Agents and to publish the content you chose. We do not sell it, use it for advertising, or share it with third parties, except the infrastructure provider that hosts the service (Cloudflare). OAuth tokens are stored encrypted. Data received through the API, such as statistics, is refreshed or deleted within 30 days, as the YouTube API Services policies require, and nothing is kept after you disconnect the channel. This applies to YouTube data in place of the longer retention periods in section 11.

You can revoke access at any time by disconnecting the channel inside Postwme Agents, or on the Google security settings page at myaccount.google.com/permissions. To ask for your data to be deleted, email support@postwme.com.

Postwme's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. AI and media processing

When you request generation, Postwme may provide selected media, prompts, business context, and generation instructions to the relevant AI or media provider. Customer media remains in private storage. Provider access uses time limited signed links where supported. Review generated content before approving or publishing it.

10. Cookies and similar technology

Postwme uses session cookies for authentication and a locale cookie for language preference. We do not use third party advertising cookies.

11. Retention, export, and deletion

  • Account, business, media, and generated content are retained while the account is active or as needed to provide the service.
  • Account deletion is scheduled with a 30 day grace period. You can cancel the request during that period.
  • When deletion executes, Postwme removes the account, businesses, private media, connected account credentials, drafts, and scheduled posts, subject to records we must retain for security, disputes, tax, accounting, or legal compliance.
  • Detailed post performance records may be retained for up to 90 days. Aggregated performance totals may be retained longer.
  • To receive a copy of your data, email support@postwme.com from the address on the account. We answer within the period your local law requires.
  • Step by step instructions are on the data deletion page.

12. Security

Postwme uses HTTPS in transit, private storage for customer media, time limited signed media links, role based access controls, and encryption for connected platform credentials. No security system is completely risk free.

13. International processing

Postwme and its providers may process data in countries other than the country where you live. The primary database region is the United States (us-east-1). Where required, we use contractual or other lawful safeguards for international transfers.

14. Your choices and rights

You can update account and business information, disconnect social accounts, or schedule deletion from settings, and request a copy of your data by email. Depending on applicable law, you may also have rights to access, correct, delete, restrict, object to processing, or obtain a portable copy of personal data. You may have the right to complain to your local data protection authority.

Submit a request through privacy settings or email support@postwme.com. We may need to verify your identity before completing a request.

15. Children

Postwme is not intended for children under 16. We do not knowingly collect personal data from children under 16.

16. Policy changes

We may update this policy when the service or legal requirements change. If a change materially affects your rights, we will provide reasonable notice before it takes effect.

17. Contact

Privacy questions and requests can be sent to support@postwme.com.