Privacy Policy

Onepostly is operated by Nobaly, LLC, a limited liability company formed in the State of New Mexico, USA, which is the controller of the personal data described in this policy. You can reach us at privacy@onepostly.com for any privacy matter, including to exercise the rights described in Section 8.

If you are in the European Economic Area (EEA), the United Kingdom, or another region with data-protection laws, the rights and protections described below apply to you regardless of where Onepostly operates.

If you use Onepostly to process personal data of your own end users (for example, when you connect your customers' social accounts through programmatic OAuth), you are typically the controller of that end-user data and Onepostly acts as a processor for the processing we perform on your instructions to operate the Service.

2.1 Information you provide

Account information. You create an account with your email address, using a one-time code we send you, or by signing in with Google. Onepostly is passwordless; we never ask you for, or store, a password. If you sign in with Google, we receive your email address, name, and profile picture, and never your Google password.

Workspace and profile information. We store workspace (organization) details such as name, member emails and roles, invitations, and settings you configure in the dashboard.

Content you submit for publishing. Text, media files, captions, scheduling metadata, destination selections, and related instructions you send through the dashboard or API.

Communications. If you email us or contact support, we keep that correspondence.

2.2 Information we collect automatically

Session and security information. When you sign in, we store a session record that includes your IP address and browser user-agent string, together with the session token and its expiry. We use this to keep you signed in and to protect your account.

Bot-protection signals. We use Google reCAPTCHA on sign-in and sign-up to protect against automated abuse. reCAPTCHA collects device and behavioral information directly through your browser and shares it with Google; see Section 4.

API and product usage. We log API requests and operational events needed to provide the Service, enforce plan limits, meter wallet usage, deliver webhooks, debug failures, and secure accounts (for example request timestamps, endpoints called, status codes, and workspace identifiers).

2.3 Connected social accounts

When you connect a social account (via the dashboard or programmatic OAuth), we receive and store identifiers and profile fields returned by the platform (such as account id, handle, display name, and avatar where provided), OAuth access and refresh tokens, token expiry, granted scopes, and connection status. Tokens are stored encrypted. We use them only to perform the actions you request on that account (publish, read insights, manage comments or engagement, refresh tokens, and similar).

2.4 Billing and wallet information

Payments are handled by our payment processor, Stripe. Card numbers and payment details are entered into and processed by Stripe. We store your subscription tier, connected-account allowances, wallet balance and ledger entries for metered usage, and related billing metadata. See Section 4 and Section 5.

2.5 Webhooks and delivery metadata

If you configure webhooks, we store endpoint URLs, subscribed event types, signing secrets (hashed or otherwise protected), and delivery attempt history (status, timestamps, and response codes) so you can debug integrations.

2.6 Information we do not store

• We do not store full card or payment-instrument numbers on Onepostly servers.
• We do not store your Google password or Onepostly account password (we are passwordless).
• We do not sell personal data or share it with advertisers.

When you publish or schedule content, we store Your Content as needed to queue and deliver it, upload media to our object storage where required, call the destination platform's APIs using your connected-account tokens, and record destination status (queued, published, failed) and platform post identifiers. Scheduled posts are retained until they run or you cancel them.

When you request insights, comments, or engagement actions, we call the relevant platform APIs with your tokens and return normalized results to you. Platforms may impose their own retention, moderation, and visibility rules independently of Onepostly.

Important:Content you publish through Onepostly is sent to third-party social platforms under their terms. Once delivered, that content is also subject to those platforms' privacy and data practices. Disconnecting an account stops future API calls with that token; it does not remove content already published on the platform.

We share the minimum data necessary with the following service providers to operate the Service. Each processes data on our behalf or as an independent controller for their own stated purposes.

We do not sell your personal data, and we do not share it with advertisers.

International transfers.Some of these providers operate outside your country. Where required, transfers are made under appropriate safeguards (such as the provider's standard contractual clauses). By using the Service you understand that your data may be processed in other countries.

The specific infrastructure and platform providers we use may change over time as we improve the Service and add social platforms.

We use the information we collect to:

• Provide the Service: authenticate you, manage workspaces, connect accounts, publish and schedule content, deliver webhooks, show history and insights, and operate API access.
• Operate billing: manage subscriptions, wallet top-ups, metered deductions, and plan limits through Stripe and our own ledgers.
• Secure the Service: keep you signed in, detect and prevent abuse (including via reCAPTCHA), protect API keys, and investigate incidents.
• Communicate with you: respond to your messages and send service-related notices (for example security, billing, or product changes).
• Improve the Service: understand reliability, errors, and feature usage so we can make Onepostly better.

Legal bases (for EEA/UK users). We process your data to perform our contract with you (providing the Service and billing), to pursue our legitimate interests (securing and improving the Service) in a way that does not override your rights, and to comply with legal obligations. Where we rely on consent (for example, certain optional cookies or processing), you may withdraw it at any time.

• Account, workspace, and session data. Retained for the life of your account or workspace membership. Sessions expire automatically.
• Connected accounts and tokens. Retained until you disconnect the account, the token is revoked or expires without refresh, or the workspace is deleted.
• Posts, media, and delivery records. Retained so you can view history, retry or debug failures, and support webhooks, until you delete them where the product allows or you delete the workspace/account, subject to short-lived backups and legal holds.
• Webhook configurations and delivery logs. Retained while the endpoint exists and for a limited period afterward for debugging and security.
• Billing and wallet records. Retained as long as necessary for accounting, tax, and legal purposes, which may be after account closure.

When you delete your account from your account settings, we delete your personal data, together with the workspaces you solely own and their connections, posts, API keys, webhooks, and billing data held by us, except where we must keep certain records to meet a legal, accounting, or security obligation. We also cancel any active subscription and remove saved payment methods from our payment processor where the processor allows; the processor may retain billing records as required by law.

Some operational records are kept independently of your account and are not removed by account deletion, including short-lived email verification codes (which expire on their own), billing-event records we retain for accounting, and security and audit records. These are deleted or expire under their own schedules.

We use a small number of strictly necessary cookies, primarily a session cookie that keeps you signed in. In production this cookie may be set on the .onepostly.com parent domain so your session is shared between the website, the app, and the API. We also set a preference cookie that remembers your appearance settings. Google reCAPTCHA may set its own cookies as part of bot protection.

We may also use local storage in your browser for appearance preferences and similar client-side settings. We do not use advertising or cross-site tracking cookies for marketing.

Depending on where you live, you have some or all of the following rights:

• Access: get a copy of the personal data we hold about you.
• Correction: fix inaccurate or incomplete data. You can update most profile information in the app.
• Deletion: delete your account and its personal data from your settings, or ask us to do it for you.
• Portability: receive certain data in a portable format.
• Objection and restriction: object to or restrict certain processing.
• Withdraw consent: where we rely on consent.

To exercise any of these, email privacy@onepostly.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

We take reasonable technical and organizational measures to protect your data. OAuth tokens and similar secrets are encrypted at rest. API access is gated by authentication. Media and workspace data are stored with access controls appropriate to a multi-tenant service. Our own secrets are kept out of logs where practical. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data and to limit what is stored.

Onepostly is intended for adults. You must be at least 18 to use it, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact privacy@onepostly.com and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after a change takes effect means you accept the updated policy.

For any privacy question or request, contact us at privacy@onepostly.com.