Privacy Policy
Last updated 20 October 2026
This policy explains what personal data Postybuddy collects (on the website postybuddy.com and in the Postybuddy apps), why, and what you can do about it.
Who we are
Postybuddy is run by Anthony Somian, a private individual based in Belgium ("we", "us"), as a free beta. Under the EU General Data Protection Regulation (GDPR), we are the "controller" of the personal data described here: we decide why and how it is used.
| Run by | Anthony Somian, a private individual based in Belgium. Postybuddy is a free beta and is not yet run by a registered business |
| Contact | support@postybuddy.com |
| Data protection contact | privacy@postybuddy.com |
We answer data requests within one month at the latest, as the GDPR requires. Given our size and activity, we are not required to appoint a Data Protection Officer; privacy@postybuddy.com handles all questions.
When you use Postybuddy for a business: for personal data contained in the content you upload (for example people shown in your photos and videos), your business is the controller and we act as its processor, under our Data Processing Agreement.
What data Postybuddy uses
Postybuddy only uses what it needs to plan and publish your posts and to keep your account safe. It does not sell data, show ads or build marketing profiles.
| Kind of data | What exactly | Where it comes from |
|---|---|---|
| Your account | Email address, password (stored only as a one-way fingerprint, never readable), whether your email is confirmed, who invited you (if you were invited) | You, when you sign up |
| Two-step login (if you turn it on) | The secret shared with your authenticator app (stored encrypted), recovery codes (stored only as fingerprints) | You |
| Connected accounts | The names you give your accounts in Postybuddy, and the access keys Instagram, Facebook and TikTok give Postybuddy when you connect them (stored encrypted) | Instagram, Facebook and TikTok, when you connect them |
| Your content | Photos and videos you upload, captions, formats, publishing dates, and the history of what was posted, removed or failed (including the post IDs the platforms send back) | You |
| Security activity | Logins, wrong passwords, two-step login changes, password resets, invites and connections, each with the date, a short device description (for example "Safari on iPhone") and the internet (IP) address | Your use of Postybuddy |
| Support messages | What you write to us and our answers | You |
| Emails | Confirmation, password reset, invite and security alert emails. When you invite someone by email, their address is used once to send the invite and is not stored | You |
Payments: none. Postybuddy is free during the beta and asks for no payment or billing details.
Comments and messages: Postybuddy does not read, reply to or store comments or private messages on your Instagram or TikTok accounts.
People in your content: your photos, videos and captions may show or mention other people. You decide what you upload and publish (see the Terms of Service).
Why it is used
Each use has a legal basis under article 6 of the GDPR. No data is used for advertising, and no decision about you is made automatically.
| Purpose | Data used | Legal basis |
|---|---|---|
| Running your account and the service: planning, storing and publishing your posts to Instagram, Facebook and TikTok | Account, connected accounts, content | Contract: needed to give you the service you signed up for |
| Keeping accounts safe: login limits, two-step login, "log out other devices", security alerts, the activity log | Account, two-step login, security activity | Legitimate interest: protecting you and the service against misuse and break-ins |
| Backups, so your data can be restored after a failure | All of the above | Legitimate interest: not losing your data |
| Service emails (confirmation, password reset, invites you send, security alerts) | Email address | Contract, and legitimate interest for security alerts |
| Answering your questions and requests | Support messages | Contract, or legitimate interest |
| Complying with the law (for example a request from an authority) | Only what is required | Legal obligation |
You can object to uses based on legitimate interest (see "Your rights").
Who receives your data
We use the service providers below. They only process data on our instructions, under a data processing agreement, and may not use it for anything else.
| Provider | What it does for us | Data it handles |
|---|---|---|
| Railway | Hosts the Postybuddy server and its database files | All data listed above |
| Cloudflare (R2 storage) | Stores your photos and videos, and the nightly encrypted backups | Your content; backups of all data (encrypted, unreadable to Cloudflare) |
| Resend | Delivers our emails | Email addresses and the content of those emails |
Instagram, Facebook and TikTok receive what you choose to publish (media, captions, publishing time) when Postybuddy posts for you. They use it under their own terms and privacy policies, as independent controllers: Instagram, Meta, TikTok.
Postybuddy shares data with authorities only when the law requires it. Nothing is sold or shared for marketing.
Where your data is stored
| Data | Location |
|---|---|
| Server and its data files (Railway) | EU West (Amsterdam, Netherlands) |
| Photos and videos (Cloudflare R2) | Western Europe |
| Encrypted backups (Cloudflare R2) | Western Europe |
| Emails (Resend) | United States |
Some of these providers are US companies, so some data may be handled in the United States. Those transfers are protected by the EU Commission's Standard Contractual Clauses in each provider's data processing agreement, and, where the provider is certified, by the EU–US Data Privacy Framework. You can ask for a copy of these safeguards at privacy@postybuddy.com.
How long it is kept
| Data | Kept for |
|---|---|
| Account, connected accounts, content and its history, uploaded photos and videos | As long as your account exists. Deleted when you delete your account |
| Support messages | 3 years after our last exchange |
| Security activity log | 90 days, then deleted automatically |
| Encrypted backups | 30 days, then deleted automatically. So after you delete your account, your data disappears from backups within 30 days |
| Password reset links, email confirmation links, invites | 1 hour, 48 hours and 7 days, then they stop working |
| Delivery records of emails (Resend) and technical server logs (Railway) | The short period set by those providers |
Posts already published on Instagram, Facebook or TikTok stay there: deleting your Postybuddy account does not delete them. You manage them in those apps.
How your data is protected
- Everything travels encrypted (HTTPS) between your device and Postybuddy.
- Passwords and recovery codes are stored only as one-way fingerprints; nobody at Postybuddy can read them.
- The access keys to your Instagram, Facebook and TikTok accounts, and two-step login secrets, are stored encrypted.
- Your photos and videos are private: they open only through temporary links that expire within 12 hours.
- Logins are limited after repeated wrong passwords, two-step login is available, and you can log out all other devices in one tap.
- Backups are encrypted and kept outside the main server.
If a data breach is likely to put your rights at risk, you will be told without undue delay, and the Belgian Data Protection Authority within 72 hours, as the GDPR requires.
Your rights
Under the GDPR you can, at any time and free of charge:
| Right | What it means | How |
|---|---|---|
| Access | Get a copy of the data about you | Download my data (in your account), or email us |
| Correction | Have wrong data corrected | Change it in your account, or email us |
| Deletion | Have your data deleted | Delete my account (in your account), or email us |
| Portability | Receive your data in a reusable format | Download my data gives a standard JSON file |
| Objection and restriction | Object to a use based on legitimate interest, or ask to pause it | Email us |
Write to privacy@postybuddy.com; you will get an answer within one month. To protect your account, you may be asked to confirm the request from your account's email address.
If you think your data is not handled correctly, you can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be, or to the authority of the EU country where you live.
How to delete your data
- Delete your Postybuddy account: in the app, More → Delete my account; on the website, Account → Delete my account. Confirm with your password (and your two-step code if it's on). Your account, connected accounts, content, uploaded files and activity log are deleted straight away, and disappear from backups within 30 days.
- No longer able to log in? Email privacy@postybuddy.com from your account's email address and ask for deletion. It will be done within one month.
- To also remove Postybuddy's access on the platforms' side: - Instagram: Settings → Website permissions → Apps and websites → remove Postybuddy - Facebook: Settings & privacy → Settings → Business integrations (or Apps and websites) → remove Postybuddy - TikTok: Settings and privacy → Security and permissions → Manage app permissions → remove Postybuddy
Disconnecting an account in Postybuddy only stops Postybuddy from posting to it; your posts already published stay on the platform.
Cookies and data on your device
Postybuddy uses only what is strictly needed for you to log in and use it: no analytics, advertising or third-party cookies, so no cookie banner is needed.
| Name | Where | What for | Kept for |
|---|---|---|---|
| social_agent_session | Website cookie | Keeps you logged in | Until you log out, or 24 hours without activity |
| pb_2fa_pending | Website cookie | Remembers that your password was right while you type your two-step code | 5 minutes |
| planTheme | Browser storage | Your light or dark display choice | Until you clear it |
| Login key | The app's secure storage on your phone | Keeps you logged in to the app | Until you log out, or 30 days without use |
| Display choice | The app's storage on your phone | Light, dark or automatic display | Until you uninstall the app |
Age
Postybuddy is for people aged 18 or older. If you learn that someone younger has an account, write to privacy@postybuddy.com and it will be deleted.
Changes to this policy
If this policy changes in a way that matters to you, you will be told by email or in Postybuddy before the change applies. The date at the top shows the current version.