Postkey privacy policy

The short version: we use your data only to run Postkey for you, we never sell it, and you can disconnect or ask us to delete it at any time. The details are below.

Last updated: October 19, 2026

1. Who we are

Postkey (postkey.pro) is run by Rabbithole LLC, 1666 Ponce de Leon Avenue, San Juan, PR 00909. This policy explains what personal data Postkey collects, why, who we share it with, how long we keep it, and the choices you have.

For data about you as a Postkey customer, we decide how it is used (we are the "controller"). For data about the people who message or comment on your accounts, our customer decides, and we process it for them (section 3).

Last updated: October 19, 2026. Contact: support@postkey.pro.

2. What we collect about customers

From you, as a Postkey customer:

Account details: your email address and name, and your password (stored by our sign-in provider, never in plain text). If you sign in with Google, we receive your name and email address from Google.
Workspace data: your Postkey accounts, team members and their roles, settings and preferences.
Content: posts, captions, threads, schedules, uploaded images and videos, templates, automations and sequences.
Connected accounts: the name, handle and id of each social account you connect, and the access tokens that let Postkey post for you. X tokens are encrypted by Postkey before they are stored.
Connected AI assistants: which assistant you connected, who approved it, when, the access it has, and what it asked Postkey to do.
Billing: your plan and payment status. Card details go straight to Stripe. We do not see or store your full card number.
Usage and logs: what was posted or sent and when, error records, and usage counts we need for plan limits. Product analytics records which pages and features are used, and error reports record what broke (section 7). Our hosting provider keeps short-lived server logs that include IP addresses. For sign-up limits we keep only a scrambled form (a hash) of the IP address, never the address.
Messages to us: what you write to support, and your contact details.
Affiliates: if you join the affiliate program, your payout details and commission records.

3. Data about people who message you

When you use comment and direct message automation, Postkey processes data about the people who comment on or message your accounts (your "contacts"). We do this for you, as your processor or service provider, and only on your instructions.

This can include their public name, handle, profile picture and account id on the network, the messages they send and receive, comments that trigger your automations, answers they give (such as an email address or phone number), tags and notes you add, link taps, and their opt-in choices for email, SMS, WhatsApp or Telegram.

The business you messaged is responsible for telling you how it uses your data. If you are a contact and want to see, correct or delete your data, ask that business first. You can also write to us (section 13). We will delete your data held in Postkey and tell the business.

4. How we use data

We use personal data only to:

publish your posts and run your automations as you set them up;
show your calendar, inbox, contacts and results;
give the AI assistants you approved the access you chose;
run your account, team and plan, and bill you;
send you service email such as team invites, approval requests and plan notices;
keep Postkey secure, stop abuse (for example with a bot check on sign-up) and fix problems;
understand how Postkey is used, so we can improve it;
answer your questions;
meet legal obligations.

5. Our legal bases (EU, UK and similar laws)

We use your customer data because we need it to provide Postkey under our contract with you; for our legitimate interests in keeping Postkey secure, stopping abuse and improving it; and to meet legal obligations such as tax records. Where we rely on consent, you can withdraw it at any time.

For your contacts' data, the legal basis is the business's, not ours.

6. What we do not do

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not use your content, your contacts or data from connected networks for advertising, and we do not build profiles of people for anyone else.

We do not use data from connected networks, or your contacts' data, to train AI models, and we do not let our providers do so.

We do not make decisions about people with legal or similar effects by automated means alone.

7. Who we share data with

We share data only with the service providers that run Postkey for us, and only what each one needs. They may use it only to provide their service to us. The list:

Supabase (United States): our database, sign-in and file storage.
Vercel (United States): hosting for the Postkey app, and its server logs.
Our posting and messaging provider (Spain, European Union): the service that publishes posts and sends and receives comments and direct messages on Instagram, Facebook, TikTok, YouTube, LinkedIn, Threads, Pinterest, Bluesky, Reddit, Discord, Telegram, Google Business Profile and other networks.
The social networks you connect, such as X, Meta (Instagram, Facebook, Threads, WhatsApp), TikTok and Google (YouTube): they receive what you publish or send there.
Stripe (United States): payments and invoices.
Resend (United States): service email from Postkey, such as team invites.
Amazon Web Services (Amazon SES, United States): email your automations send, when you use the email channel.
Anthropic (United States): replies drafted by Postkey AI, only when you turn Postkey AI on.
Telegram: messages on the Telegram bot you connect, and our own error alerts.
Twilio: text messages, sent with your own Twilio account when you connect it. Twilio's terms with you apply.
Cloudflare (Cloudflare Turnstile, United States): the bot check on sign-up.
PostHog (United States): product analytics and error reports, so we can see which features are used, where people get stuck and what breaks. It records page views, clicks and, for some visits, a replay of the screen. Everything you type in a form field, and the messages, comments, names, handles and email addresses of the people you talk to through Postkey, are hidden from those replays and clicks before anything leaves your browser. Network recordings keep timings only, never contents. When you are signed in it knows you by your account id and your workspace by its id, not by a name or email. Inside the app it keeps one first-party cookie and a matching browser storage entry (ph_..._posthog) so it can tell a returning visit; on our public pages it sets no cookies until you sign in. It is off if your browser sends Do Not Track or Global Privacy Control.
Cloudflare Web Analytics (United States): counts page views without cookies.

8. Other times we share data

With the AI assistants you connect, as section 9 explains. When the law requires it, for example a valid court order. To protect people, Postkey or the networks from fraud or abuse. And if Postkey is sold or merged, with the new owner, who must keep this policy's promises.

9. AI assistants you connect

You can connect your own AI assistant (for example ChatGPT, Claude or Grok) to your Postkey account. Postkey shares data with it only after you approve it on Postkey's consent screen, and only inside the access you pick there.

With read, inbox or contacts access, the assistant and the company that runs it receive your contacts' names, handles, email addresses, phone numbers, comments and direct messages, as well as your posts and automations. That company handles the data under its own terms and privacy policy, not ours. Some assistants train AI models on conversations unless you turn that off or use a business plan. Check your assistant's settings.

An assistant can send or publish only what its access allows. With "ask me first" on (the default), nothing it sends goes out until a person approves it. You can disconnect any assistant at any time under Agent & API. It then loses access at once.

We keep a record of each connection: which assistant, who approved it, when, and with which access. We keep it while your account is open, because the networks ask us to be able to show you approved the sharing.

10. X (Twitter) data

When you connect X, Postkey asks X for these permissions only: tweet.read, tweet.write, users.read, media.write and offline.access. It does not ask for access to direct messages. Postkey publishes only the posts, threads and first comments that customer writes and schedules in Postkey, at the times they choose. Every post is previewed before it is scheduled.

Postkey does not like, follow, repost, reply to other people, send direct messages, read timelines or collect X data for analysis or resale. The same or nearly the same text cannot be sent to more than one X account.

Customers disconnect at any time, which revokes the token. Posting volume is capped per customer per month.

We never sell, rent or share X data with anyone, we do not use it to train AI models, and we follow the X Developer Policy (https://developer.x.com/en/developer-terms/policy). If X or the account owner asks us to delete X content we hold, we delete it within 24 hours.

11. Google and YouTube

Postkey uses YouTube API Services when you connect a YouTube channel. By connecting it, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy (https://policies.google.com/privacy) explains how Google handles your data.

We use YouTube data only to publish the videos you schedule and to show you their status and results in Postkey. You can disconnect YouTube in Postkey at any time.

You can also remove Postkey's access in your Google security settings (https://myaccount.google.com/permissions). When you disconnect, or ask us to delete it, we delete the channel's data within 7 days.

Postkey's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

12. Meta (Instagram, Facebook) and TikTok

When you connect Instagram, Facebook, Threads, WhatsApp or TikTok, Postkey receives the account details, comments and messages it needs to run the posts and automations you set up. We use that data only for you, only for those features, and only as this policy describes.

We never sell it, never use it for advertising or to build profiles, never use it to decide anyone's eligibility for anything, and never use it for surveillance.

You can disconnect at any time in Postkey, or remove Postkey from the apps and websites settings of the network. To delete the data, follow the steps in the next section.

13. Deleting your data

You can delete posts, library items, automations and contacts in the app, and disconnect any social account. Disconnecting X revokes Postkey's token at X and deletes it from Postkey.

To delete your whole Postkey account and all data in it, or the data of a connected Instagram, Facebook, TikTok, YouTube or X account: email support@postkey.pro from the email address on your account, with the subject "Delete my data". Say which account. We confirm by email and finish within 30 days (YouTube data within 7 days). We also tell our providers, such as our posting and messaging provider, to delete it.

If you messaged or commented on a business that uses Postkey, and want your data deleted: ask that business, or email support@postkey.pro with the subject "Delete my data" and your handle on the network (for example your Instagram username). We confirm by email, delete your data held in Postkey within 30 days, and tell the business.

Some records, such as invoices and tax records, are kept as long as the law requires. Backup copies are overwritten as backups roll over, within 30 days.

14. Getting a copy of your data

A self-serve export is not available yet. Email support@postkey.pro and we will send you a copy of your data in a common format.

15. How long we keep data

We keep your data while your account is open, because we need it to run Postkey for you. When you delete something, or ask us to delete your account, we delete it as described above.

When you disconnect a social account, Postkey stops posting and sending for it. For X, posts still scheduled for that account do not go out.

Invoices and tax records are kept for as long as tax law requires, usually up to 7 years.

16. Cookies

Postkey uses only cookies it needs to work, plus one first-party analytics cookie inside the app. It sets no advertising cookies and no third-party cookies. Our public pages set no analytics cookies.

Sign-in cookies from Supabase, which keep you signed in.
pe_account and pe_prefs: which Postkey account you were working in, and your display preferences (up to one year).
pk_human: a short-lived cookie after the bot check on sign-up.
Short-lived cookies while you connect a social account or an AI assistant.
pk_ref: if you arrived through an affiliate's link, which link it was, for up to 90 days, so the affiliate can be credited.
ph_..._posthog: inside the app only (after you sign in), PostHog's analytics cookie and the matching browser storage entry, with a random id that tells a returning visit apart, for up to one year. Not set on our public pages, and never if your browser sends Do Not Track or Global Privacy Control (section 7).
pk_src: if you arrived through one of Postkey's own links (for example from Postkey's bot on Grok), which link it was, for up to 30 days. When you create a workspace, that one word is saved with it so we can count how people find Postkey. Nothing else about you is kept with it.

17. Security

Data is encrypted in transit. Access tokens for X are encrypted by Postkey before they reach the database. Access to data inside Postkey is limited by account and by team role. AI assistants get only the access you approved, and you can cut it off at any time.

No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and as the law requires.

To report a security problem, email support@postkey.pro.

18. Where data is processed

Postkey is run from the United States. Your data is processed in the United States and in the countries where our providers work, such as the European Union (our posting and messaging provider). These countries may have different data protection laws from yours.

If you are in the EU, the UK or Switzerland and need a data processing agreement with the standard contractual clauses for your contacts' data, email support@postkey.pro.

19. Children

Postkey is not for children. Customers must be at least 18. We do not knowingly collect data from children under 13 (or under 16 where local law sets that age), and the networks Postkey works with do not allow accounts for children under 13. If you think a child's data is in Postkey, email us and we will delete it.

20. Your rights

Depending on where you live, you may have the right to know what data we have about you, to see it, correct it, delete it or get a copy of it, to object to or limit how we use it, to withdraw consent, and to complain to a data protection authority.

To use any of these rights, email support@postkey.pro. We may ask you to confirm it is you. We answer within the time the law sets: one month in the EU and UK, 45 days in California. Using your rights never costs you anything or changes the service you get.

21. California residents

In the last 12 months we collected the categories of data listed in sections 2 and 3: identifiers (such as name, email address and account ids), commercial information (your plan and payments), internet activity (usage and logs), and the content of messages processed for our customers. We collected them from you, from the networks you connect, and from your contacts through your automations. We used them for the purposes in section 4 and disclosed them only to the providers in section 7.

We do not sell or share personal information, and we do not use sensitive personal information for anything but providing Postkey. You may use an authorised agent to make a request. We will ask the agent for your written permission.

22. Changes to this policy

We may update this policy. If a change matters, we will tell you by email or in the app before it applies, and change the "last updated" date above.

23. Contact

Questions or requests about privacy: support@postkey.pro. Post: Rabbithole LLC, 1666 Ponce de Leon Avenue, San Juan, PR 00909.