Privacy Policy

1. Overview & Scope

PostMCP AI (“PostMCP AI”, “we”, “us”) provides a social media scheduling and publishing platform, available at postmcpai.com, together with its API and Model Context Protocol (MCP) server, which lets you connect social accounts and publish content to them — directly or through an AI assistant.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and how you can review, export or delete it. It applies to the PostMCP AI website, dashboard, API and MCP server. It does not apply to the social platforms themselves (Facebook, Instagram, Threads, LinkedIn, X, Bluesky, YouTube), which handle your data under their own policies.

For the purposes of the EU/UK GDPR, PostMCP AI is the data controller for account data and the content you submit to our service. Where you connect a social account, we act on your instructions to transmit your content to that platform.

2. Information We Collect

We limit collection to what is required to operate scheduling and publishing workflows. We collect:

• Account data: your name, email address, avatar URL, and either a hashed password or the provider identifier from the sign-in service you used (Google, GitHub, LinkedIn or X). We never store your social sign-in password.
• Access credentials for connected platforms: OAuth access tokens and refresh tokens issued by the platform you connect — including Google/YouTube (see §5) — and (for Bluesky) the app password and server URL you supply. These are stored encrypted — see §7.
• Connected profile metadata: platform account IDs, usernames/handles, display names, Page or organization names, profile picture URLs, and token expiry dates — used to show you which accounts are connected and to target the right destination for a post.
• Content you submit: post drafts, captions, links, images and video you upload or generate for publishing, and scheduling times.
• AI assistant data: your chat messages with the AI assistant, the assistant’s responses, tool-call logs, proposed actions and token usage counts.
• Workspace data: project names, members and their roles, and the email addresses you enter to invite collaborators.
• Publishing and diagnostic logs: API request and response statuses, published post identifiers, and error messages, used to confirm delivery and troubleshoot failures.
• Billing data: your plan, subscription status and validity, billing email, and a subscription identifier from our payment processor. We do not receive or store card numbers.
• Usage and device data: product analytics events, pages viewed, browser and device type, approximate location derived from IP address, and session cookies — see §12.

We do not knowingly collect special-category data (health, biometrics, religion, political opinions, precise location) and ask that you do not submit it.

3. How & Why We Use Data

We process your information only to deliver, secure and support the service:

5. YouTube API Services

PostMCP AI uses YouTube API Services to publish videos and Shorts to a YouTube channel you connect. By connecting a channel you are also agreeing to the YouTube Terms of Service, and the data Google receives and provides in that exchange is handled under the Google Privacy Policy.

Permissions we request, and why

YouTube data we collect and store

How we store it

Google access and refresh tokens are encrypted with AES-256-CBC before being written to the database, using a key held in our server environment’s secret configuration and never stored alongside the ciphertext (see §7). Tokens are decrypted in memory only for the moment an upload or a token renewal requires them. Channel identifiers and upload results are stored in plain form because they are not credentials.

How often we refresh, update and delete YouTube data

Channel metadata is refreshed daily, with hourly retries and expiry checks. Upload results are not read back from YouTube and are cleared after 29 days. If you revoke access in your Google Account, renewal detects the invalid grant and hourly channel maintenance removes the connection and its stored API data. You can also disconnect a channel or submit a deletion request; YouTube user-data deletion requests are completed as soon as possible and within 7 calendar days.

What we never do with it

• We do not change the visibility of any video after it is uploaded. The privacy status you choose in the composer (public, unlisted or private) is applied to that new upload only, and shown to you before the post is confirmed. To change it later, use YouTube Studio.
• We do not sell, rent, license or transfer YouTube data to data brokers, advertising networks, or any other third party.
• We do not use YouTube data to train, fine-tune or evaluate AI models. The AI drafting described in §6 writes post copy from your own prompt; it is not given your YouTube tokens or channel data.
• We do not use YouTube data for advertising, profiling or any purpose other than performing the publishing actions you requested.
• We do not read, alter or delete videos on your channel that were not published through PostMCP AI.
• We do not upload anything to your channel that you did not create or schedule in PostMCP AI.

PostMCP AI’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your control over this connection

1. In PostMCP AI: remove the YouTube card in the Integration Manager. This deletes the stored channel identifiers and permanently erases the encrypted access and refresh tokens from our database immediately.
2. In your Google Account: revoke PostMCP AI at myaccount.google.com/permissions — the Google security settings page for third-party application access. Revoking there invalidates our tokens instantly, whether or not you have also disconnected inside PostMCP AI.
3. Formal deletion request: use the Data Deletion Request Form to have every trace of the connection erased on a verified request (see §11).

Videos already published to your channel remain on YouTube after you disconnect — delete them in YouTube Studio if you no longer want them.

6. AI Processing

PostMCP AI includes optional AI drafting and image generation, used from the composer, the API and the MCP tools on your instruction. When — and only when — you use them:

• Your prompt and the names of the social networks you selected are sent to a large language model through OpenRouter, which routes the request to the model provider selected for your account. An image prompt, and any reference image URL you supply, is sent to an image model the same way.
• You may supply your own OpenRouter API key; if you do, it is stored encrypted and used only to bill your own AI usage to your key.
• We instruct our AI providers not to train on data submitted through our integration. We do not use your content to train any model of our own.
• Post content is never sent to a model unless you ask for an AI draft. Drafts you write yourself are transmitted only to the social platform you publish to.
• AI drafting never publishes anything. The copy and image land in the composer for you to review, and go out only when you schedule or publish them.

Meta Platform Data is not sent to AI model providers. The model is told which networks a draft is for, never which accounts.

7. Storage, Encryption & Security

• Encryption in transit: all traffic between your browser, our API, and platform APIs uses TLS (HTTPS).
• Encryption at rest: OAuth access tokens (including Google/YouTube), refresh tokens, Bluesky app passwords, MCP API keys and any OpenRouter key you provide are encrypted with AES-256-CBC before being written to the database. The encryption key is held in our server environment’s secret configuration and is never stored in the database alongside the ciphertext.
• Decryption on use: credentials are decrypted in memory only at the moment a publishing or account request is executed, and are not written to application logs.
• Passwords: account passwords are stored only as salted one-way hashes; we cannot read them.
• Access control: tokens are scoped to the owning user and project; database and infrastructure access is restricted to authorized personnel who need it to operate the service.
• Storage location: data is stored in managed cloud infrastructure (see §8) with provider-level disk encryption and access logging.

8. Service Providers (Sub-processors)

We rely on a small number of vetted providers to run the service. Each is bound by contract to process data only on our instructions and to maintain appropriate safeguards:

We do not transfer Meta Platform Data to any of these providers except the infrastructure required to store it securely (database and object storage) and operate the service you requested.

9. Data Sharing & Sale

We do not sell, rent, lease or share your personal data, platform metadata or access tokens for money or for cross-context behavioural advertising. Your data leaves our systems only in these situations:

• To the platforms you authorize — content and tokens are sent to the Meta Graph API, LinkedIn API, X API, Bluesky ATProto API or YouTube Data API to execute the publishing action you requested.
• To the service providers listed in §8, strictly to operate the service.
• To collaborators you invite — members of a project workspace can see that project’s connected accounts, drafts and scheduled posts.
• For legal reasons — where required by law, valid legal process, or to protect the rights, safety or property of PostMCP AI, our users or the public.
• In a business transfer — if PostMCP AI is involved in a merger, acquisition or asset sale, data may transfer to the successor, subject to this policy. We will notify you before your data becomes subject to a different policy.

10. Data Retention

Encrypted backups may retain deleted data for a short additional period and are overwritten on the normal backup rotation.

12. Cookies & Analytics

• Strictly necessary cookies: session and authentication cookies that keep you signed in and protect against cross-site request forgery. These cannot be disabled without breaking the service.
• Preference storage: local storage for settings such as theme and active project.
• Product analytics: we use PostHog to record feature-usage events (for example, a post being scheduled or an account connected), page views, device/browser type and error reports, keyed to your account ID once you sign in. We use this only to understand and improve the product.

We do not use advertising cookies, third-party ad pixels or cross-site tracking. You can block cookies in your browser, and where required by law we ask for your consent before setting non-essential analytics cookies.

13. Your Privacy Rights

Depending on where you live (including under the EU/UK GDPR, the California CCPA/CPRA, and India’s DPDP Act), you have the right to:

• Access the personal data we hold about you and receive a copy in a portable format.
• Correct inaccurate or incomplete data.
• Delete your data — see §11.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be discriminated against for exercising these rights; we do not sell personal information, so there is nothing to opt out of.
• Complain to your local data protection authority (in the EU/UK, your national supervisory authority).

To exercise any right, email [email protected] or use the Data Deletion Request Form. We verify requests against the email on the account and respond within 30 days. An authorized agent may act on your behalf with written proof.

14. International Transfers

PostMCP AI and its service providers operate globally, so your data may be processed in countries other than your own, including the United States and the European Union. Where data leaves the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent UK provisions, together with our providers’ own transfer frameworks. Contact us for details of the safeguards applied to a specific transfer.

15. Children’s Privacy

PostMCP AI is a business tool intended for users aged 18 and over, and is not directed to children. We do not knowingly collect personal data from anyone under 13 (or the minimum age of digital consent in your country). If we learn that we have collected such data, we delete it promptly. If you believe a child has provided us data, contact [email protected].

16. Security Incidents

If we become aware of a breach affecting your personal data or Platform Data, we will investigate immediately, take steps to contain it, and notify affected users and the relevant supervisory authorities — and, where Platform Data is involved, the relevant platform operator — without undue delay and within the timeframes required by applicable law and platform terms. Report a suspected vulnerability or incident to [email protected].

17. Changes to This Policy

We may update this policy as the service evolves. The version number and “last modified” date at the top of this page always reflect the current version. For material changes — for example a new category of data, a new purpose, or a new sub-processor handling your content — we will notify you by email or an in-app notice before the change takes effect. Continued use after the effective date means you accept the updated policy.

18. Contact Us

For any privacy question, data request, or to reach our data protection contact: