Skip to content

Privacy policy

Effective 2 November 2026.

PostLoop is a tool for planning, writing and publishing social media posts, for people, their teams and the AI agents they use. This policy explains what PostLoop Cloud and this website collect, why, who else handles it, and how you control it. It's written to be read, not skimmed past.

PostLoop is operated by Hamed Rahimi. Questions about your data go to hello@postloop.dev.

If you run PostLoop on your own server (the open-source edition), your server's operator decides what happens to your data, not us. Nothing in a self-hosted PostLoop sends your content to us.

What we collect

  • Your account: your name, email address and password (stored only as a secure hash, never readable). If you sign in with another provider, the account details it shares with us.
  • What you make in PostLoop: your workspaces, posts, drafts, comments, ideas, schedules, the media you upload, and the settings you choose.
  • Connected social accounts: when you connect a network such as Instagram, LinkedIn or YouTube, we receive an access token from that network and basic profile details (name, username, profile picture, account ID). Tokens are encrypted before they're stored, are never shown again, and are used only to do what you ask: publish your posts and read their results.
  • Data from those networks: the information needed to publish and report on your posts, such as each post's link and its public engagement numbers (likes, comments, shares, views, impressions).
  • Conversations with Posty: what you ask PostLoop's built-in agent and what it replies, kept as threads you can rename or delete, along with a record of every change it made and who approved it.
  • Technical information: the IP address and browser of each signed-in session (so you can see and end them in Settings), and logs that help us keep the service running and secure.
  • This website: it doesn't use advertising or tracking cookies, and doesn't record which pages you visit beyond the basic logs every web server keeps.

How we use it

  • To run PostLoop: publish your posts when you ask, show how they performed, and keep your workspaces in sync for your team.
  • To keep it secure: prevent abuse, investigate problems, and protect your accounts.
  • To talk to you about your account: sign-in links, failure alerts, and important changes. We don't send marketing email without your permission.
  • To improve PostLoop, using information about how the service is used, never the content of your posts.

We don't sell your data, and we don't use your content or your connected accounts' data for advertising.

AI features

PostLoop's writing assistant and Posty, its built-in agent, work only when you use them. Then the text you're working on, and what Posty needs to answer you, is sent to our AI provider, Anthropic, to produce a reply. Anthropic doesn't use data sent through its API to train its models. Posty never changes anything in your workspace without the approval you've chosen (asking first, or Always Approve, which you can switch off at any time).

Data from Google and YouTube

PostLoop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect YouTube, you also agree to the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data. You can remove PostLoop's access at any time from your Google security settings.

Data from other networks

Information from Meta (Facebook, Instagram, Threads), TikTok, LinkedIn, X, Pinterest, Bluesky and Mastodon is used only to provide the features you use, following each network's developer policies. You can disconnect an account in PostLoop at any time, and remove PostLoop's access from that network's own settings.

Who else handles your data

We use a small number of providers to run PostLoop. Each handles your data only on our instructions:

  • Cloudflare: hosting, file storage, email and protection from attacks.
  • Neon: the database that holds your account and workspace data.
  • Anthropic: AI replies, only when you use the writing assistant or Posty.
  • Stripe: payments, once paid plans launch. We never see or store your card number.

And, of course, the social networks you connect receive the posts you choose to publish to them.

We'll share information if the law requires it, and we'll tell you first when we're allowed to.

How long we keep it

We keep your data while your account is open. Disconnecting a social account deletes its access token straight away. Deleting a post, a Posty thread or a workspace removes it. When you delete your account or your organization, its data is removed from our systems, and copies in backups are overwritten within 30 days.

Deleting your data

You can delete your data yourself at any time:

  • One connected account: in PostLoop, open Channels and disconnect it. Its access token is deleted at once.
  • Your organization and everything in it: if you're an owner, open Settings, then Workspace, then Delete organization.
  • Your account: open Settings, then Account, then Delete account, and confirm with your password.
  • Download a copy first: Settings, then Account, then Download my data (and, for owners and admins, Download all data in Settings, then Workspace).

If you can't sign in, email hello@postloop.dev from your account's address and we'll delete your data within 30 days.

Keeping it safe

Sign-in tokens for your social accounts are encrypted with keys kept apart from the database. Each workspace's data is kept apart from every other's by the database itself. All traffic is encrypted in transit. PostLoop's code is open source, so anyone can check how it works. See the Security page for more.

Your rights

Depending on where you live, you may have the right to see, correct, download or delete your data, to object to some uses, and to complain to a data protection authority. Most of this you can do yourself in Settings. For anything else, email hello@postloop.dev and we'll answer within 30 days.

Children

PostLoop is not meant for anyone under 16, and we don't knowingly collect their data.

Where your data is stored

Our providers store data in the United States and other countries where they operate. When data leaves your country, we rely on the protections the law requires, such as standard contractual clauses.

Changes

If we change this policy in a way that matters, we'll tell you by email or in PostLoop before it takes effect. The date at the top always shows the current version.