Last updated: November 14, 2026. This document is a draft pending review by the operator and legal counsel.
POSTED is a self-hosted social media scheduling and publishing service operated by [OWNER INPUT REQUIRED: legal entity name] ("we", "us"). This service is built on the open-source Postiz software, which is licensed under the GNU Affero General Public License v3.0.
When you create an account, we collect the information you provide: your name, email address, and a hashed version of your password. When you connect a social media account (such as TikTok, X, Facebook, Instagram, YouTube, or Threads), the service stores the connection details needed to publish on your behalf, which may include your account identifier, display name, and access tokens issued by that platform. When you prepare or schedule content, we store that content and any media you upload, along with metadata such as scheduled dates and publishing status.
When you connect a TikTok account, POSTED accesses only the TikTok information necessary to operate the features you use: authenticating your TikTok account, displaying the connected account, and publishing content you choose to post through POSTED. POSTED does not sell TikTok data. Access tokens can be revoked at any time by removing the channel inside POSTED or by revoking the application's access from your TikTok account settings (Settings > Security & permissions > Manage app permissions on TikTok).
Data is used solely to operate the service: authenticating you, storing your scheduled content, publishing to the social accounts you connect, and providing account support. The service is hosted on servers controlled by the operator. [OWNER INPUT REQUIRED: hosting location / data residency] Account data is stored in the service's application database and its supporting infrastructure (database, cache, and task processing systems).
We do not sell your personal data. Content you choose to publish is transmitted to the social platform it is scheduled for. The service also relies on the social platforms' own APIs, which are governed by those platforms' terms and privacy policies.[OWNER INPUT REQUIRED: list of subprocessors / service providers, if any]
You can disconnect any social channel at any time from the settings area of POSTED. Disconnecting removes the ability of POSTED to access that account going forward.
You can request deletion of your account, including your organizations, connected channels, and scheduled posts, by[OWNER INPUT REQUIRED: deletion method — in-app control and/or contact email]
[OWNER INPUT REQUIRED: retention periods for account data, connected tokens, content, and backups]
For privacy questions or requests, contact[OWNER INPUT REQUIRED: contact email address].