Privacy Policy

Onepostly is operated by Nobaly, LLC, a New Mexico limited liability company, which is the controller of the personal data in this policy. If you are in the EEA, the UK, or another region with data-protection laws, those protections apply to you.

When you use Onepostly with other people's data, such as your customers' social accounts or the comments and messages people send you, you are the controller of that data and we process it on your behalf.

2.1 Information You Give Us

• Account. Your email address, and your name and profile picture if you sign in with Google or GitHub. We have no passwords.
• Workspace. Its name, members, roles, invitations, and settings.
• Content. The posts, media, captions, schedules, and automation rules you create.
• Support. Messages you send us.

2.2 Information We Collect Automatically

• Sessions. Your IP address, approximate country, and browser, to keep you signed in and protect your account.
• Bot protection. Google reCAPTCHA checks sign-in and sign-up and collects device signals in your browser.
• API logs. For requests made with an API key: the endpoint, status, timing, and key used, shown in your dashboard logs. We also keep a detailed copy with the IP address, browser, headers, and request and response bodies to debug errors and stop abuse. Credentials are removed before it is stored.
• Audit records. Security and account actions, such as sign-ups, API key changes, and membership changes.
• Product analytics. Our analytics records the pages you visit (including query parameters), clicks, browser errors, your browser and device, referrer, and approximate location. Your IP address is used for location and not stored. When you are signed in, this is linked to your user id, email, and name. It sets no cookies and does not record your session.

2.3 Connected Social Accounts

When you connect an account, we store the profile details the platform returns (id, handle, name, avatar) and its access tokens, encrypted. We use them only for the actions you request.

2.4 People Who Interact With Your Accounts

If you use comments, inbox, or automations, we receive the comments and messages people send to your accounts, including their platform id, name, and text. We use them only to show them to you, send them to your webhooks, and run your automations.

2.5 Billing

Stripe processes payments. We keep your plan, card brand, last four digits, and expiry date, your connected-account count, and your wallet transactions. We never see the full card number.

2.6 Webhooks

We store your endpoint URLs, events, signing secret (encrypted), any custom headers you add, and each delivery with its payload and response code.

We do not sell personal data or share it with advertisers.

To publish, we store your content, call the platform's API with your tokens, and record the result. Once published, your content is also subject to that platform's terms and privacy practices. Disconnecting an account does not remove posts already published.

Media is public by link so platforms can fetch it. Anyone with the URL can open it.

We share only what each provider needs to run the Service.

Some providers operate outside your country. Where required, we rely on safeguards such as standard contractual clauses.

You can connect AI assistants such as Claude, ChatGPT, or Cursor to your workspace through our MCP server. An assistant gets access only after you approve it on a consent screen, and only to that workspace, read only or read and write.

• Data an assistant reads is sent to the company that runs it and falls under that company's privacy policy.
• We record when a connection is approved, used, and revoked, and any errors. We do not record what the assistant asks for or your conversations with it.
• We do not use your content to train machine-learning models.
• You can revoke an assistant's access at any time in your settings, and it stops working immediately.

Onepostly uses YouTube API Services to upload videos to, and read data from, the channels you connect. By using these features you agree to the YouTube Terms of Service and the Google Privacy Policy. Our use of YouTube data follows the YouTube API Services Terms of Service and Developer Policies.

6.1 What We Store

• Google access and refresh tokens, encrypted, with their scopes.
• Your channel id, name, handle, and thumbnail.
• The videos and details you publish, and their public metrics.

We use this only to publish and report for you, and never share it or use it to train models.

6.2 Deleting and Revoking

• Disconnect the channel in Onepostly. We delete its tokens and profile and ask Google to revoke our access.
• Revoke access in your Google Account at myaccount.google.com/connections. Our tokens stop working immediately.
• Email us at privacy@onepostly.com. We complete verified requests within 30 days.

• Run the Service. Sign you in, publish, run automations, deliver webhooks, and show analytics.
• Billing. Bill usage and manage your wallet.
• Security. Prevent abuse and investigate incidents.
• Support. When you ask for help, or to investigate abuse, our staff may view your workspace or sign in as you.
• Email. Sign-in codes, invitations, and notices about your account and payments.
• Improve Onepostly. Through logs and product analytics.

Legal bases (EEA/UK). Our contract with you, our legitimate interests in securing and improving the Service, and legal obligations.

Deleting your account. Deletion removes your personal data and every workspace you own, with its connections, posts, media, API keys, webhooks, assistant connections, and wallet balance. We cancel your subscription and remove your saved cards.

Detailed logs and audit records, including the record of the deletion itself, expire after about 90 days. Records of data-deletion requests from platforms are kept to show we honored them.

• Session cookie. Keeps you signed in.
• Preference cookie. Remembers your appearance setting.
• Local storage. Your preferences, onboarding progress, and an anonymous analytics id.
• Third parties. Google reCAPTCHA and Stripe may set their own cookies when they run.

We do not use advertising or cross-site tracking cookies.

Depending on where you live, you can access, correct, delete, or export your data, object to or restrict its processing (including product analytics), and withdraw consent. Email privacy@onepostly.com to make a request. You can also complain to your local data-protection authority.

Tokens and secrets are encrypted, access is authenticated, and each workspace's data is kept separate. No system is perfectly secure, but we work to protect your data and keep only what we need.

You must be 18 or older to use Onepostly. If you believe someone younger has given us data, email privacy@onepostly.com and we will delete it.

We will update the date above when this policy changes and notify you of material changes. Continuing to use the Service means you accept the updated policy.

Email privacy@onepostly.com with any privacy question or request.