Privacy Policy

1. What PostPilot is

PostPilot is an AI-assisted content distribution manager. You describe your brand, and PostPilot helps you generate content ideas, prepare posts (captions, hashtags, media), schedule them, and — when you connect an Instagram Professional account — publish them through Meta's official APIs, either manually, on a schedule, or via an optional Autopilot mode.

The developer contact for privacy matters is provided in section 12 below.

2. Information we store

PostPilot stores only what is needed to operate the service, in its application database:

• Workspace and account records: an internal user identifier and workspace name. PostPilot has no password-based login; there are no passwords to store.
• Login identity (when you use Google login): your name and email address as provided by Google through Supabase Auth, plus a record linking that Google identity to your PostPilot user. Google authentication itself is handled by Google and Supabase under their own policies; PostPilot never sees or stores your Google password.
• Sessions and devices: one session record per login (hashed token, expiry, last activity) and the device name/platform you provide, so multi-device sync and per-device sign-out work.
• Brand information you provide: brand name, niche, audience, description, tone, goals, content pillars, calls to action, posting frequency, and platform preferences (“Brand Brain”).
• Content you create or generate: ideas, hooks, drafts, captions, hashtags, covers, publishing configuration, quality scores, schedules, timezones, and publishing status/history.
• Media you upload or generate: images, videos, rendered carousel assets and their metadata (file type, size, dimensions, duration where detectable). In production, files live in Supabase Storage; local development may use the application server's disk, and legacy setups may use S3-compatible object storage.
• Design References you upload: reference screenshots and the visual style profile learned from them (a structured description of aesthetic, typography, palette, and layout — never a copy of your images).
• Social account connections: provider name, handle, Instagram user ID, linked Facebook Page ID/name, account type, follower counts returned by Meta, connection status, and validation timestamps.
• OAuth tokens: Instagram access/refresh tokens and expiry times, stored server-side only (see section 4).
• Scheduling and Autopilot settings: schedules, approval requirements, publishing frequency, preferred days/time windows, quiet hours, blackout dates, and quality thresholds you configure.
• Publishing records: provider media/container IDs, permalinks, publish timestamps, attempt counts, and error messages.
• Performance data (if you enable it): aggregate metrics retrieved from Meta (impressions, reach, likes, comments, saves, shares, views) associated with your posts. PostPilot never invents or estimates metrics.
• Operational audit events: timestamps of actions such as generation, scheduling, approval, publishing, retries, and disconnects — used for reliability and troubleshooting. These contain IDs and outcomes, not message content or credentials.

3. Cookies and local storage

• Session cookie: a first-party, HttpOnly pp_session cookie keeps you signed in (Secure in production, SameSite=Lax, 30-day expiry). It is never used for advertising or cross-site tracking.
• Supabase Auth cookies: when you use Google login, Supabase sets its own first-party authentication cookies to complete the OAuth flow, under Supabase's policy.
• On-device draft: browser local storage holds only an in-progress onboarding draft on your own device.
• No advertising cookies, no cross-site trackers, no third-party analytics beacons.

4. Instagram tokens and how they are protected

When you connect Instagram via Meta OAuth, your access tokens are stored server-side onlyand are never sent to the browser or to client applications. API responses containing account data explicitly exclude token fields.

When the TOKEN_ENCRYPTION_KEY environment variable is configured (required for any production deployment), tokens are encrypted at rest with AES-256-GCM before storage and can only be decrypted by the server holding the key. Without that key, stored tokens cannot be used and you will simply be asked to reconnect. Plaintext token storage without this key is a local-development convenience only and is not acceptable for production.

Tokens are refreshed automatically before expiry, and disconnecting an account wipes its tokens immediately (see Data Deletion).

5. How information is used

• To generate ideas, copy, captions, and hashtags tailored to your brand.
• To prepare, schedule, and publish posts you approve or automate.
• To validate connections, retry transient publishing failures safely, and record what happened.
• To operate Autopilot within the limits you configure (frequency, windows, approvals, quality).
• To diagnose errors and keep the service reliable (operational logs and audit events).
• To respond to privacy, access, and deletion requests you send us.

6. Third-party services

• Meta / Instagram: when you connect Instagram, account metadata, media URLs, captions, and publishing requests are exchanged with Meta's Graph API under Meta's own terms and privacy policy. Publishing requires a Professional (Business/Creator) Instagram account linked to a Facebook Page — a Meta requirement, not ours. Meta platform data is used only to operate the connection and publishing features you request; PostPilot does not sell Meta data and does not use it for advertising.
• Google (login only): when you use Google login, Google verifies your identity and shares your name and email with PostPilot through Supabase Auth, under Google's and Supabase's own terms and privacy policies.
• Supabase: authentication sessions and (in production) the application database and media storage run on Supabase infrastructure under Supabase's terms and privacy policy.
• OpenAI: when AI features are used, brand context, content drafts, and (for design analysis only) reference screenshots are sent to the OpenAI API to generate results. API keys are kept server-side and are never exposed to clients.
• Vercel (hosting): the application is served over HTTPS from Vercel infrastructure, which processes requests (including IP addresses in server logs) to deliver the service.
• Storage providers: in production your media files live in Supabase Storage (private bucket; Meta fetches publishable copies over HTTPS at publish time). Legacy setups may use S3-compatible storage instead. Files are never made public to browse.

We do not sell your information. We share data with third parties only as needed to provide the features above, or if required by law.

7. Data retention and deletion

Your content, media, brand data, and settings are kept while your workspace exists so the service functions. OAuth authorization states are short-lived (minutes) and single-use. Operational server logs rotate with the hosting environment.

You can delete individual posts and media inside the app, disconnect Instagram at any time (tokens are wiped immediately), and delete your workspace as described on our Data Deletion page. Workspace deletion removes your content, media files, schedules, connection records and tokens, settings, and sessions, and signs every device out. A small identity record (user/workspace identifiers without content) and one audit tombstone are retained so the service keeps working and deletions stay auditable; revoked Meta grants additionally expire on Meta's side. If you used Google login and want the residual login identity removed as well, ask through the contact form below and we complete it manually after verifying ownership.

8. Your rights and choices

• Review and edit your brand, content, schedules, and Autopilot settings at any time in the app.
• Disconnect Instagram at any time to immediately revoke PostPilot's stored access.
• Request access to, export of, or deletion of your data via the contact form below — including without signing in if you lost access.

9. Security

We apply practical safeguards appropriate to a self-hosted application: server-side-only secrets, authenticated cron endpoints in production, input validation, magic-byte file checks, encrypted token storage when configured, and audit trails. No method of transmission or storage is completely secure, and we do not claim certifications (such as SOC 2) or guarantees beyond what is described here.

10. Children's privacy

PostPilot is a business productivity tool and is not directed at children under 13 (or the higher minimum age where you live). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us below and we will delete it.

11. International processing and changes

PostPilot is hosted in the regions of its infrastructure providers (application hosting, database, and storage), and Meta, Google, and OpenAI process data under their own global terms when you use the connected features. By using PostPilot you understand your information may be processed outside your country. We may update this policy as the application changes; the “Last updated” date above will reflect the current version.

12. Contact

For privacy questions, access/export requests, or deletion requests — including if you cannot sign in — send the form below. We reply to verified requests at the address you provide.

You can also reach us directly at postpilot.site@gmail.com.