Privacy Policy

Last updated: October 6, 2026

Postly ("we", "us") is a social media scheduling and publishing service operated by Greentree at www.greentree-postly.space. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information: your email address and a password (stored only as a secure hash by our authentication provider), or your basic Google profile (name, email, profile picture) if you sign in with Google.
• Content you create: post text, captions, hashtags, tags, ideas, posting schedules, and the images and videos you upload.
• Connected social accounts: when you connect Facebook, Instagram, YouTube or TikTok, we receive the account or Page ID, name, username, profile picture, the permissions you granted, and access tokens that let us publish on your behalf.
• Publishing results: whether each post was published, the platform's post ID and link, and any error message returned by the platform.
• Technical data: session cookies needed to keep you signed in, and server logs (such as IP address and request times) kept by our hosting providers for security and troubleshooting. We do not use advertising or third-party tracking cookies.

How we use information

• To provide the service: store your drafts, schedule posts and publish them to the accounts you choose, at the times you choose.
• To show you the results of publishing and help you fix failed posts.
• To send account emails such as sign-up confirmation. We do not send marketing email without your consent.
• To keep the service secure, prevent abuse and comply with legal obligations.

We do not sell your personal information, and we do not use your content or connected account data for advertising or to train AI models.

Data from Meta, Google and TikTok

We access platform data only to perform the actions you request, such as listing the Pages and accounts you can publish to and publishing your posts. We request the minimum permissions needed for publishing.

• Facebook and Instagram: data is used in accordance with the Meta Platform Terms. You can remove Postly's access at any time in your Facebook settings under Apps and Websites, or in Instagram under Apps and Websites.
• Google and YouTube: Postly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If you connect YouTube, we use YouTube API Services, and by doing so you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke access at any time from your Google security settings.
• TikTok: data is used in accordance with TikTok's developer terms. You can revoke access in the TikTok app under Settings and privacy → Security → Manage app permissions.

How we store and protect data

Your data is stored with our infrastructure providers: Supabase (database, authentication and file storage, hosted in Singapore), Vercel (website hosting) and Resend (account email). Access tokens for connected social accounts are encrypted with AES-256-GCM and can only be read by our servers, never by your browser. Each user can only access their own data. Images and videos you upload are stored at hard-to-guess public URLs so that social platforms can fetch them when publishing.

Sharing

We share data only with the infrastructure providers above, with the social platforms you choose to publish to (the content of those posts), or when required by law. We do not share your data with advertisers or data brokers.

Retention and deletion

• When you disconnect a channel, its access tokens are deleted immediately.
• When you delete a post, its media files are deleted from our storage, unless another of your posts uses the same file.
• We keep your account data while your account is active. You can ask us to delete your account and all associated data at any time; see Data deletion. We complete deletion within 30 days, except where we must keep records by law.
• Posts already published to social platforms stay on those platforms. Remove them there if you want them gone.

Your rights

Depending on where you live (including under Thailand's Personal Data Protection Act and the EU GDPR), you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Contact us at support@greentree-postly.space and we will respond within 30 days.

Children

Postly is not intended for children under 13, and we do not knowingly collect their data.

Changes

We may update this policy. If the changes are significant, we will notify you by email or in the app before they take effect.

Contact

Greentree · support@greentree-postly.space