Privacy Policy

Onepostly is operated by Nobaly, LLC, a limited liability company formed in the State of New Mexico, USA, which is the controller of the personal data described in this policy. You can reach us at privacy@onepostly.com for any privacy matter, including to exercise the rights described in Section 10.

If you are in the European Economic Area (EEA), the United Kingdom, or another region with data-protection laws, the rights and protections described below apply to you regardless of where Onepostly operates.

If you use Onepostly to process personal data of your own end users (for example, when you connect your customers' social accounts through programmatic OAuth), you are typically the controller of that end-user data and Onepostly acts as a processor for the processing we perform on your instructions to operate the Service.

2.1 Information you provide

Account information. You create an account with your email address, using a one-time code we send you, or by signing in with a supported sign-in provider such as Google or GitHub. Onepostly is passwordless. We never ask you for, or store, a password. If you sign in with a provider, we receive the profile fields it shares with us (such as email address, name, and profile picture), and never the password for that provider account.

Workspace and profile information. A workspace is also referred to as an organization. We store workspace details such as name, member emails and roles, invitations, and settings you configure in the dashboard.

Content you submit for publishing. Text, media files, captions, scheduling metadata, destination selections, and related instructions you send through the dashboard or API.

Communications. If you email us or contact support, we keep that correspondence.

2.2 Information we collect automatically

Session and security information. When you sign in, we store a session record that includes your IP address and browser user-agent string, together with the session token and its expiry. We use this to keep you signed in and to protect your account.

Bot-protection signals. We use Google reCAPTCHA on sign-in and sign-up to protect against automated abuse. reCAPTCHA collects device and behavioral information directly through your browser and shares it with Google. See Section 4.

API and product usage. We log API requests and operational events needed to provide the Service, enforce plan limits, meter wallet usage, deliver webhooks, debug failures, and secure accounts (for example request timestamps, endpoints called, status codes, and workspace identifiers).

2.3 Connected social accounts

When you connect a social account (via the dashboard or programmatic OAuth), we receive and store identifiers and profile fields returned by the platform (such as account id, handle, display name, and avatar where provided), OAuth access and refresh tokens, token expiry, granted scopes, and connection status. Tokens are stored encrypted. We use them only to perform the actions you request on that account (publish, read analytics, manage comments or engagement, refresh tokens, and similar).

2.4 Billing and wallet information

Payments are handled by our payment processor, Stripe. Card numbers and payment details are entered into and processed by Stripe. We store your plan status, connected-account allowances, wallet balance and ledger entries for metered usage, and related billing metadata. See Section 4 and Section 7.

2.5 Webhooks and delivery metadata

If you configure webhooks, we store endpoint URLs, subscribed event types, signing secrets (hashed or otherwise protected), and delivery attempt history (status, timestamps, and response codes) so you can debug integrations.

2.6 Information we do not store

• We do not store full card or payment-instrument numbers on Onepostly servers.
• We do not store your Google password or Onepostly account password (we are passwordless).
• We do not sell personal data or share it with advertisers.

When you publish or schedule content, we store Your Content as needed to queue and deliver it, upload media to our object storage where required, call the destination platform's APIs using your connected-account tokens, and record destination status (queued, published, failed) and platform post identifiers. Scheduled posts are retained until they run or you cancel them.

When you request analytics, comments, or engagement actions, we call the relevant platform APIs with your tokens and return normalized results to you. Platforms may impose their own retention, moderation, and visibility rules independently of Onepostly.

Important. Content you publish through Onepostly is sent to third-party social platforms under their terms. Once delivered, that content is also subject to those platforms' privacy and data practices. Disconnecting an account stops future API calls with that token. It does not remove content already published on the platform.

We share the minimum data necessary with the following service providers to operate the Service. Each processes data on our behalf or as an independent controller for their own stated purposes.

We do not sell your personal data, and we do not share it with advertisers.

International transfers.Some of these providers operate outside your country. Where required, transfers are made under appropriate safeguards (such as the provider's standard contractual clauses). By using the Service you understand that your data may be processed in other countries.

The specific infrastructure and platform providers we use may change over time as we improve the Service and add social platforms.

You can connect third-party AI assistants and agents (for example, Claude, ChatGPT, or Cursor) to your workspace through our Model Context Protocol (MCP) server at mcp.onepostly.com, or by giving them an API key. This section explains what that access involves.

5.1 How access is authorized

Assistants authenticate with OAuth 2.1 using PKCE. Before any access is granted, we show you a consent screen describing the access being requested, and access begins only if you approve it. We then store an access token that expires one hour after issue and a refresh token that expires 30 days after issue. Expired tokens are rejected and cleaned up automatically. If you give an assistant an API key instead, that key stays valid until you delete it in your dashboard.

5.2 What a connected assistant can do

A connection is approved for one assistant and one workspace, and carries the scopes it requested, such as read-only or read-and-write. Within that workspace, and subject to those scopes, an authorized assistant can act on your behalf.

• Posts and content. Read, create, schedule, and delete posts and media on the connected accounts.
• Analytics. Read performance and audience metrics for your posts and accounts.
• Connections. View the social accounts linked to the workspace.
• Comments, inbox, and engagement. Read and reply to conversations where a platform allows it.

Actions an assistant performs are charged and metered like your own requests, and count against the same workspace limits.

5.3 Data shared with the assistant provider

When an assistant requests data through the MCP server, that data is transmitted to the provider operating the assistant. Once it leaves Onepostly it is handled under that provider's own privacy policy and terms, and we do not control how it is stored, processed, retained, or further disclosed. Review an assistant's privacy policy before connecting it, and connect only assistants you trust.

5.4 What we record

We log the tool calls a connected assistant makes, including the parameters supplied and the identity of the authorized client, as API and product usage data described in Section 2. We use these records to operate the Service, enforce limits, detect abuse, and provide support. We do not receive your conversations with the assistant beyond the data supplied to the tools it calls.

5.5 Model training

We do not use content accessed through our MCP server or API to train machine-learning models.

5.6 Ending an assistant's access

You can end a connection at any time. In your dashboard, open Settings and then Authorized apps, where every assistant you have authorized is listed with the access it was granted and when it was last used. Revoking a connection there takes effect immediately. Its access token, its refresh token, and any pending authorization are all invalidated, so the assistant loses access on its very next request and cannot renew it. The assistant would have to go through the consent screen again to regain access.

Access also ends on its own. Access tokens expire one hour after issue and refresh tokens expire 30 days after issue, so an assistant you stop using loses access automatically. If you gave an assistant an API key instead of connecting it over OAuth, delete that key in your dashboard. Deleting your account revokes all authorizations.

Onepostly uses YouTube API Services to upload videos to, and read data from, the YouTube channels you connect. By connecting a channel or otherwise interacting with YouTube through the Service, you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. Our use of information received from YouTube API Services adheres to the YouTube API Services Terms of Service, including the Developer Policies.

6.1 What we store

When you connect a YouTube channel, we store only what is needed to publish and report on your behalf.

• Authorization tokens. The Google OAuth access token and refresh token issued when you granted consent, together with their expiry and the scopes granted.
• Channel profile data. The channel id, name, handle, and thumbnail, so you can tell your connected channels apart.
• Content you submit. The video, title, description, tags, category, privacy status, and thumbnail you send through the Service for that channel.
• Video metadata and metrics. The ids, titles, and public performance metrics of videos published through the Service, used to show you analytics.

Tokens are encrypted at rest, are used only to carry out the specific consent you granted, and are never shared with third parties or used to train machine-learning models.

6.2 How long we keep it

We store your authorization tokens only for as long as they are needed to carry out that consent. Disconnecting the channel deletes the stored access token, refresh token, and expiry immediately, erases the channel profile data above, and at the same time asks Google to revoke this application's authorization so the grant cannot be renewed.

The connection record and the history of posts published through it are retained so your post history and delivery records stay intact, but the platform's channel id is replaced with an anonymous identifier seven days after you disconnect. That window exists only so reconnecting shortly afterward lands on the same record instead of creating a duplicate. Deleting your account removes the record entirely.

Revoking our access directly from your Google Account has the same effect on the tokens at Google. They stop working on their next use and cannot be renewed.

6.3 How to delete your stored data

You can delete the YouTube data we hold about you at any time, by any of the following routes.

• Disconnect the channel. In your dashboard, open Connections, find the YouTube channel, and choose Disconnect. This deletes the stored access and refresh tokens and the channel profile data immediately and revokes our authorization with Google. The remaining record is anonymized seven days later.
• Ask us to delete it. Email privacy@onepostly.com. We complete verified deletion requests within 30 days.

6.4 How to revoke our access, and governing terms

Independently of anything you do in Onepostly, you can revoke this application's access to your Google and YouTube data at any time from your Google Account, at myaccount.google.com/connections. Select Onepostly under connected apps and services and choose Remove access. Revoking there takes effect immediately. Our stored tokens stop working on their next use, cannot be renewed, and we delete them. To publish to that channel again you would need to reconnect it and grant consent afresh.

Our use of YouTube data is governed by the YouTube Terms of Service, the Google Privacy Policy, and the YouTube API Services Terms of Service, including the Developer Policies.

We use the information we collect in the following ways.

• Provide the Service. Authenticate you, manage workspaces, connect accounts, publish and schedule content, deliver webhooks, show history and analytics, and operate API access.
• Operate billing. Manage subscriptions, wallet top-ups, metered deductions, and plan limits through Stripe and our own ledgers.
• Secure the Service. Keep you signed in, detect and prevent abuse (including via reCAPTCHA), protect API keys, and investigate incidents.
• Communicate with you. Respond to your messages and send service-related notices (for example security, billing, or product changes).
• Improve the Service. Understand reliability, errors, and feature usage so we can make Onepostly better.

Legal bases (for EEA/UK users). We process your data to perform our contract with you (providing the Service and billing), to pursue our legitimate interests (securing and improving the Service) in a way that does not override your rights, and to comply with legal obligations. Where we rely on consent (for example, certain optional cookies or processing), you may withdraw it at any time.

• Account, workspace, and session data. Retained for the life of your account or workspace membership. Sessions expire automatically.
• Connected accounts and tokens. Retained until you disconnect the account, the token is revoked or expires without refresh, or the workspace is deleted. Disconnecting erases the credentials and the platform profile immediately, and the platform account id is anonymized seven days later.
• Posts, media, and delivery records. Retained so you can view history, retry or debug failures, and support webhooks, until you delete them where the product allows or you delete the workspace/account, subject to short-lived backups and legal holds.
• Webhook configurations and delivery logs. Retained while the endpoint exists and for a limited period afterward for debugging and security.
• Billing and wallet records. Retained as long as necessary for accounting, tax, and legal purposes, which may be after account closure.

When you delete your account from your account settings, we delete your personal data, together with the workspaces you solely own and their connections, posts, API keys, webhooks, and billing data held by us, except where we must keep certain records to meet a legal, accounting, or security obligation. We also cancel any active subscription and remove saved payment methods from our payment processor where the processor allows. The processor may retain billing records as required by law.

Some operational records are kept independently of your account and are not removed by account deletion, including short-lived email verification codes (which expire on their own), billing-event records we retain for accounting, and security and audit records. These are deleted or expire under their own schedules.

We use a small number of strictly necessary cookies, primarily a session cookie that keeps you signed in. In production this cookie may be set on the .onepostly.com parent domain so your session is shared between the website, the app, and the API. We also set a preference cookie that remembers your appearance settings. Google reCAPTCHA may set its own cookies as part of bot protection.

We may also use local storage in your browser for appearance preferences and similar client-side settings. We do not use advertising or cross-site tracking cookies for marketing.

Depending on where you live, you have some or all of the following rights.

• Access. Get a copy of the personal data we hold about you.
• Correction. Fix inaccurate or incomplete data. You can update most profile information in the app.
• Deletion. Delete your account and its personal data from your settings, or ask us to do it for you.
• Portability. Receive certain data in a portable format.
• Objection and restriction. Object to or restrict certain processing.
• Withdraw consent. Where we rely on consent.

To exercise any of these, email privacy@onepostly.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

We take reasonable technical and administrative measures to protect your data. OAuth tokens and similar secrets are encrypted at rest. API access is gated by authentication. Media and workspace data are stored with access controls appropriate to a multi-tenant service. Our own secrets are kept out of logs where practical. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data and to limit what is stored.

Onepostly is intended for adults. You must be at least 18 to use it, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact privacy@onepostly.com and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after a change takes effect means you accept the updated policy.

For any privacy question or request, contact us at privacy@onepostly.com.