PostAdmin Privacy Policy
Last updated: 7 September 2026
PostAdmin is a social media publishing service at postadmin.io. You create an account, connect the social accounts you want to publish to through each platform's own login and consent screen, and write a post once to send it everywhere. This policy explains what the service stores, who else sees it, and how to get rid of it.
PostAdmin is operated from the United Kingdom by its owner, who is the data controller for the purposes of UK GDPR. Contact details are at the bottom of this page.
What we collect
- Your account — username, email address, and a cryptographic hash of your password. We never store your password itself and cannot recover it.
- Content you create — post text, images, video, hashtags and schedules you compose in PostAdmin.
- Authorization tokens for the social accounts you connect (OAuth access and refresh tokens), stored so we can publish on your behalf when you ask us to.
- Platform data about your own accounts — your username and profile picture, follower and post counts, the posts you publish through us, and the engagement they receive.
- Billing identifiers if you subscribe — a Stripe customer and subscription reference. Card details are handled entirely by Stripe and never reach our server.
- Usage analytics — pages visited and features used, to understand what people actually do with the product.
Data from connected platforms
When you connect an account, we ask that platform only for what the features you use require. On Instagram we request three permissions:
- instagram_business_basic — to show you your own account inside PostAdmin: username, profile picture, follower and post counts, and the posts you have published.
- instagram_business_content_publish — to publish the posts you have written and scheduled, at the time you chose.
- instagram_business_manage_comments — to show you comments left on your own posts, and to send replies you have written, inside PostAdmin's Engage screen.
We use that access solely to show you your own accounts and to send content you have written yourself. We do not read your private messages, we do not post or reply to anything you have not composed, and we do not collect data about other people beyond the public comments and engagement attached to your own posts.
Platform data is stored on our own server for as long as the account stays connected. Disconnect the account and its tokens and cached profile data are deleted immediately.
Who else processes your data
We do not sell your data and we do not share it for advertising. We do rely on a small number of service providers to run the product, and they process data strictly on our instructions:
| Provider | What it receives |
|---|---|
| Stripe | Payment and subscription details, if you subscribe |
| Resend | Your email address, to deliver email we send you |
| PostHog | Anonymised usage analytics |
| OpenRouter | The text you submit when you use an AI writing feature |
| fal.ai | The prompt you submit when you generate an AI image or video |
The AI providers only ever receive what you type into an AI feature at the moment you use it. If you never use those features, nothing is sent to them.
What we do not do
- We do not sell, rent or trade your data.
- We do not use your data for advertising or profiling.
- We do not read private messages on any connected platform.
- We do not post anything you have not written and scheduled yourself.
- We do not use your content to train AI models.
Storage & security
Data is held in a private database on a server we control, not shared with other tenants. Passwords are hashed. All traffic to the site and every call to a platform's API travels over HTTPS. Access to the account is protected by your own password.
Keeping and deleting your data
We keep your account and its content for as long as your account exists.
- Disconnect one account — its tokens and cached profile data are deleted from our database immediately.
- Revoke access from the platform — you can withdraw PostAdmin's permission at any time in the platform's own settings (for example Instagram → Settings → Website permissions, or TikTok → Settings → Security → Apps and services). Any token we hold stops working at once.
- Delete everything — ask us using the contact form and we will delete your account, your content and every stored token, and confirm when it is done. We aim to complete this within 30 days.
Your rights
Under UK GDPR you may ask us for a copy of your data, correct it, have it deleted, or object to how we use it. Use the contact form and we will respond. If you are not satisfied with our response you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If this policy changes materially we will update the date at the top of this page and, where the change affects how your data is used, tell account holders by email.
Contact
For privacy questions, data-deletion requests or any other support, use the contact form and we will reply by email.