PostFlow

Privacy Policy

Last updated: October 30, 2026

PostFlow is operated by Ron Kantor. This policy explains what data PostFlow collects, why, and what you can do about it. Contact: ronkamail@gmail.com.

What we collect

  • Account details: your name, email address and a hashed password. For signed-in sessions we also store the session’s IP address and browser user agent.
  • Waitlist: if you join the early-access waitlist, your email address, the name you give (if any) and when you signed up. It’s used only to invite you, and you can ask us to remove it at any time.
  • Your content: the videos you upload, the captions and caption templates you write, the platforms and times you schedule, and the results of each publish (for example a post ID or error message).
  • Connected accounts: when you connect a platform we receive your account ID, username, and access/refresh tokens for the permissions you approve. Tokens are encrypted at rest.
    • TikTok: your open_id and username (basic profile info and video publishing).
    • Instagram: your Instagram professional account ID, username, name and profile picture URL (basic profile info and content publishing).
    • YouTube: your channel ID, name, handle and avatar URL (read access to your channel info and video uploads).

We don’t use advertising trackers and we don’t sell your data.

How we use it

Only to run PostFlow: to sign you in, show your calendar, and publish your videos to the platforms you choose at the time you choose. When a post is published, its video and caption are sent to that platform under its own privacy policy.

YouTube API Services

PostFlow uses YouTube API Services to read your channel’s basic info and upload the videos you schedule. Google’s handling of that data is covered by the Google Privacy Policy. You can revoke PostFlow’s access at any time from your Google account security settings or by disconnecting YouTube on the Accounts page. PostFlow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is stored

PostFlow runs on Vercel. Account and scheduling data is stored in a Postgres database hosted by Neon, and uploaded videos are stored in private Vercel Blob storage. These providers process the data on our behalf.

How long we keep it

We keep your data while your account exists. Disconnecting a platform deletes its tokens from PostFlow; for TikTok and YouTube, PostFlow also asks the platform to revoke them. Instagram has no revoke API, so the token is deleted from PostFlow and you can remove PostFlow’s access in your Instagram settings.

Deleting your account (Accounts → Delete account) immediately deletes your account, sessions, posts, connected accounts and uploaded videos, and revokes PostFlow’s TikTok and YouTube tokens. See Data Deletion for details and other ways to delete your data.

Your choices

  • Disconnect any platform at any time from the Accounts page or from the platform’s settings (for Instagram: Settings → Apps and websites).
  • Delete your account and data from the Accounts page, as described on the Data Deletion page.
  • Email ronkamail@gmail.com to get a copy of your data, correct it, or have your account and data deleted.

Changes

If we change this policy we will update the date above.