PostlineLegal

Privacy Policy

Last updated 12 October 2026

Postline is a personal, single-user tool. Its owner and operator uses it to schedule and publish their own short videos to YouTube, Facebook Pages, Instagram and TikTok. It is not offered to the public: nobody else can sign in, and it does not collect data about viewers, followers or other people. This policy explains what data Postline accesses, why, where it is kept, who it is shared with and how to delete it.

Contact: muzammel007ali@gmail.com

Data Postline accesses

  • Sign-in identity. The owner signs in with Google. Postline receives the Google account's email address and name only to check that the person signing in is the owner.
  • OAuth access and refresh tokens for each social account the owner connects.
  • Account identifiers. Channel, Page and account IDs, display names, usernames and profile pictures, so the owner can pick where a video goes.
  • Content the owner creates in Postline. Uploaded video files, captions, titles, descriptions, tags, schedule times and per-platform settings.
  • Publishing results. The IDs, links and status of posts Postline published, and a short log of each publishing step (errors and timings, never tokens).
  • Post statistics. For videos Postline published, aggregate counts the platform reports for the owner's own post (views, likes, comments, shares, saves, reach) and each account's follower count, read for up to 90 days after publishing.
  • First comments. When the owner adds one, Postline posts that single comment on the owner's own published video and stores its ID and link. If a run is interrupted, it checks the video's newest comments once for that comment only; no other comment is stored.

Postline does not read the owner's inbox, messages or the content of comments (beyond that one check), and collects no data about individual viewers, followers or other users of these platforms. Statistics are totals only.

Why the data is used

The data is used only to publish the owner's own videos to the owner's own accounts at the time the owner chose, to show the result in the owner's dashboard, and to tell the owner when a post fails or an account needs to be reconnected. Postline does not use the data for advertising, profiling, selling, training AI models or any purpose other than publishing.

How the data is stored

  • Tokens are encrypted with AES-256-GCM before they are written to a Postgres database (hosted by Supabase). The encryption key is kept separately from the database. Tokens are never written to logs.
  • Videos are uploaded to a private Cloudflare R2 storage bucket. A video is deleted automatically once every scheduled post that uses it has been published, normally within a few days. Files that are never used are removed by an automatic expiry rule.
  • Post records (captions, schedule, links, status) stay in the database until the owner deletes them. The publishing step log is pruned after 30 days.
  • Post statistics are deleted with their post or account. For YouTube, statistics are also deleted within 7 days after the owner revokes Postline's access.
  • The database is backed up weekly to the same private storage. Tokens inside backups stay encrypted.

Sharing

Data is shared only with the platform the owner chose to post to, and only what that post needs: the video file, caption and post settings go to YouTube, Facebook, Instagram or TikTok through their official APIs. A short-lived signed link to the video may be given to Meta so it can fetch the file.

Postline runs on infrastructure providers that process data on the owner's behalf: Vercel (hosting), Supabase (database), Cloudflare (storage and media links) and Telegram (notifications to the owner, which may include a caption and an account name). The owner's own AI coding agents can read and schedule posts through Postline's private API using a secret token. No data is sold or shared with anyone else.

Cookies

Postline sets strictly necessary cookies only: a session cookie that keeps the owner signed in, and a short-lived cookie that protects the account-connection flow. There are no analytics, tracking or advertising cookies.

YouTube and Google

Postline uses YouTube API Services to upload videos to, and manage videos on, the owner's own YouTube channel. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Postline's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the publishing features described here, is not transferred to others except as needed to provide those features or as required by law, is not used for advertising, and is not read by humans except with the owner's consent, for security, or as required by law.

You can revoke Postline's access to your Google account at any time on the Google security settings page. Postline deletes stored YouTube data within 7 days of access being revoked or the channel being disconnected, except post records the owner chooses to keep.

Facebook and Instagram (Meta)

Postline uses Facebook Login and Instagram Login to publish Reels to Facebook Pages and Instagram professional accounts the owner manages. It stores the Page or account ID, name, username and the access token Meta issues, and uses them only to create and publish the owner's Reels and read back their status and link. Meta's own handling of data is covered by the Meta Privacy Policy. You can remove Postline at any time under Settings → Apps and Websites (Facebook) or Settings → Website permissions (Instagram).

TikTok

Postline uses TikTok Login Kit (basic profile: open ID, display name, avatar) and the Content Posting API to send the owner's videos to the owner's TikTok inbox as drafts. The owner finishes and publishes each draft in the TikTok app. If the owner turns on Direct Post for an account, Postline instead publishes the video with the owner's caption and chosen privacy and interaction settings, after reading the account's posting options (creator info). If stats are turned on, Postline reads the view, like, comment and share counts of the owner's own published videos and the account's follower count. Postline stores the account ID, display name, tokens and these counts, and nothing else from TikTok. TikTok's own handling of data is covered by the TikTok Privacy Policy. You can remove Postline at any time in the TikTok app under Settings and privacy → Security → Apps and services permissions.

Retention and deletion

Disconnecting an account in Postline's Channels page immediately deletes its stored tokens. Videos are deleted after publishing as described above. To have all data deleted, follow the steps on the Data Deletion page; requests are completed within 30 days.

Security

Access to Postline is limited to the owner's Google account. All traffic uses HTTPS, the storage bucket is private, tokens are encrypted at rest, and the agent API requires a secret bearer token.

Children

Postline is not directed to, and does not knowingly collect data from, anyone under 18.

Changes

If this policy changes, the new version will be posted on this page with a new “Last updated” date.

Contact

Questions or requests about this policy: muzammel007ali@gmail.com