Information We Collect
When you register, configure workspaces, and connect channels on Plan Poster, we collect information across three categories:
A. Account Registration Information
When creating an account via email or Google OAuth 2.0, we collect your name, email address, password hash (salted and encrypted via bcrypt), and avatar image.
B. Post Content & Media Assets
Any captions, titles, scheduled publication timestamps, hashtags, images, and videos uploaded to our composer or media library to be delivered to your channels.
C. Technical & Operational Logs
Device browser type, IP address, request timestamps, and delivery receipt logs from social APIs to monitor worker execution and diagnose scheduling issues.
How We Use Your Personal Data
Plan Poster processes collected information for the following legitimate business purposes:
- Automated Execution: Running background queue workers to dispatch posts to authorized social channels at your chosen scheduled time.
- Workspace Security: Enforcing PostgreSQL Row-Level Security (RLS) to ensure complete data isolation between separate customer accounts.
- Analytics & Performance: Gathering post delivery confirmation, engagement summaries, and network status reports.
- Customer Support: Assisting you with token refreshing, API troubleshooting, and queue inquiries.
- No Ad Targeting: We never use your social post content or tokens to build advertising profiles, nor do we sell information to data brokers.
Security, Encryption & Data Retention
We implement industry-standard administrative, physical, and electronic safeguards:
- Encryption at Rest: Database records and OAuth tokens are stored in PostgreSQL managed with AES-256 encryption.
- Encryption in Transit: All web traffic and API calls strictly enforce HTTPS/TLS 1.3.
- Token Segregation: Access tokens are isolated by workspace ID and never exposed in client-side bundles.
- Data Retention: We store your drafts and scheduled posts only as long as your workspace account is active.
Your Privacy Rights & Data Deletion (GDPR / CCPA)
Under GDPR, CCPA, and global privacy standards, you have the right to:
- Access and receive a copy of your personal data;
- Rectify inaccurate or outdated workspace details;
- Request permanent deletion of your account and all associated tokens;
- Revoke connected social channels at any moment from your Connected Accounts dashboard.
For step-by-step instructions on removing permissions directly via Facebook, Google, or our database purge mechanism, visit our dedicated User Data Deletion Instructions.
Children's Privacy
Plan Poster is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered an account, contact us immediately and we will promptly purge the data.
7. Privacy Officer Contact
If you have questions, concerns, or requests regarding this Privacy Policy or our third-party social integrations, please contact our privacy officer:
Have questions about Plan Poster's policies or compliance?
Our legal, security, and developer teams respond promptly to data rights requests, API usage questions, and platform verification audits.
Connected Social Media Accounts & Platform APIs
YouTube API Services (Google)
Plan Poster uses official YouTube API Services. By connecting your YouTube channel, you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy.
We access channel title, thumbnail, upload playlists, and video publication endpoints strictly to schedule and upload your videos. You can revoke Plan Poster's access at any time via the Google Security Settings Page.
Meta (Facebook Pages & Instagram)
Through Meta Graph API v20, we access Facebook Page names, page IDs, Instagram Business account IDs, and user access tokens. Direct publishing to personal Facebook profiles is prohibited by Meta policies; we interact strictly with Pages and connected Instagram Business accounts you manage.
X (formerly Twitter)
Through X API v2 (OAuth 2.0 PKCE), we access your Twitter user handle, profile photo, and write permissions strictly to publish scheduled tweets and media attachments.
LinkedIn Marketing API
We collect organization URNs and author IDs to enable scheduled text, link, and photo shares to company pages and personal profiles.