Privacy Policy

1. What PostPilot is

PostPilot is an AI-assisted content distribution manager. You describe your brand, and PostPilot helps you generate content ideas, prepare posts (captions, hashtags, media), schedule them, and — when you connect an Instagram Professional account — publish them through Meta's official APIs, either manually, on a schedule, or via an optional Autopilot mode.

2. Information we store

PostPilot stores only what is needed to operate the service, in its application database:

• Workspace and account records: an internal user identifier and workspace name. PostPilot has no password-based login; there are no passwords to store.
• Login identity (when you use Google login): your name and email address as provided by Google through Supabase Auth, plus a record linking that Google identity to your PostPilot user. Google authentication itself is handled by Google and Supabase under their own policies; PostPilot never sees or stores your Google password.
• Brand information you provide: brand name, niche, audience, description, tone, goals, content pillars, calls to action, posting frequency, and platform preferences (“Brand Brain”).
• Content you create or generate: ideas, hooks, drafts, captions, hashtags, covers, publishing configuration, quality scores, schedules, timezones, and publishing status/history.
• Media you upload or generate: images, videos, rendered carousel assets and their metadata (file type, size, dimensions, duration where detectable). Files are stored on the application server or, when configured, in S3-compatible object storage.
• Design References you upload: reference screenshots and the visual style profile learned from them (a structured description of aesthetic, typography, palette, and layout — never a copy of your images).
• Social account connections: provider name, handle, Instagram user ID, linked Facebook Page ID/name, account type, follower counts returned by Meta, connection status, and validation timestamps.
• OAuth tokens: Instagram access/refresh tokens and expiry times, stored server-side only (see section 4).
• Scheduling and Autopilot settings: schedules, approval requirements, publishing frequency, preferred days/time windows, quiet hours, blackout dates, and quality thresholds you configure.
• Publishing records: provider media/container IDs, permalinks, publish timestamps, attempt counts, and error messages.
• Performance data (if you enable it): aggregate metrics retrieved from Meta (impressions, reach, likes, comments, saves, shares, views) associated with your posts. PostPilot never invents or estimates metrics.
• Operational audit events: timestamps of actions such as generation, scheduling, approval, publishing, retries, and disconnects — used for reliability and troubleshooting. These contain IDs and outcomes, not message content or credentials.

3. Information we do NOT collect

• No passwords (the app has no password login).
• No cookies or cross-site trackers set by the application.
• No payment information: subscription status is stored without card details (a payment provider processes any future purchase; card data never touches PostPilot).
• Browser local storage is used only to hold an in-progress onboarding draft on your own device.

4. Instagram tokens and how they are protected

When you connect Instagram via Meta OAuth, your access tokens are stored server-side onlyand are never sent to the browser or to client applications. API responses containing account data explicitly exclude token fields.

When the TOKEN_ENCRYPTION_KEY environment variable is configured (required for any production deployment), tokens are encrypted at rest with AES-256-GCM before storage and can only be decrypted by the server holding the key. Without that key, stored tokens cannot be used and you will simply be asked to reconnect. Plaintext token storage without this key is a local-development convenience only and is not acceptable for production.

Tokens are refreshed automatically before expiry, and disconnecting an account wipes its tokens immediately (see Data Deletion).

5. How information is used

• To generate ideas, copy, captions, and hashtags tailored to your brand.
• To prepare, schedule, and publish posts you approve or automate.
• To validate connections, retry transient publishing failures safely, and record what happened.
• To operate Autopilot within the limits you configure (frequency, windows, approvals, quality).
• To diagnose errors and keep the service reliable (operational logs and audit events).

6. Third-party services

• Meta / Instagram: when you connect Instagram, account metadata, media URLs, captions, and publishing requests are exchanged with Meta's Graph API under Meta's own terms and privacy policy. Publishing requires a Professional (Business/Creator) Instagram account linked to a Facebook Page — a Meta requirement, not ours. Meta platform data is used only to operate the connection and publishing features you request; PostPilot does not sell Meta data and does not use it for advertising.
• Google (login only): when you use Google login, Google verifies your identity and shares your name and email with PostPilot through Supabase Auth, under Google's and Supabase's own terms and privacy policies.
• Supabase: authentication sessions and (in production) the application database and media storage run on Supabase infrastructure under Supabase's terms and privacy policy.
• OpenAI: when AI features are used, brand context, content drafts, and (for design analysis only) reference screenshots are sent to the OpenAI API to generate results. API keys are kept server-side and are never exposed to clients.
• Storage providers: when S3-compatible storage is configured, your media files are stored there so Meta can fetch them over public HTTPS at publish time. Otherwise files stay on the application server.

We do not sell your information. We share data with third parties only as needed to provide the features above, or if required by law.

7. Data retention and deletion

Your content, media, brand data, and settings are kept while your workspace exists so the service functions. OAuth authorization states are short-lived (minutes) and single-use. Operational server logs rotate with the hosting environment.

You can delete individual posts and media inside the app, disconnect Instagram at any time (tokens are wiped immediately), and request complete workspace deletion as described on our Data Deletion page.

8. Your rights and choices

• Review and edit your brand, content, schedules, and Autopilot settings at any time in the app.
• Disconnect Instagram at any time to immediately revoke PostPilot's stored access.
• Request export or deletion of your data via the contact below.

9. Security

We apply practical safeguards appropriate to a self-hosted application: server-side-only secrets, authenticated cron endpoints in production, input validation, magic-byte file checks, encrypted token storage when configured, and audit trails. No method of transmission or storage is completely secure, and we do not claim certifications (such as SOC 2) or guarantees beyond what is described here.

10. Changes to this policy

We may update this policy as the application changes; the “Last updated” date above will reflect the current version.

11. Contact

For privacy questions, export requests, or deletion requests, contact: postpilot.site@gmail.com