Privacy Policy

PostMax (“PostMax”, “we”, “us”) is a web app at post-max.com for writing, scheduling and publishing posts to X, LinkedIn, Facebook, Instagram, YouTube, TikTok, Threads and Bluesky. This policy explains what information we handle when you use it and why. Questions go to support@post-max.com.

• Account details. Your email address and password. Passwords are stored hashed by our authentication provider; we never see them in plain text. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Connected social accounts. When you connect a network, we receive that account’s identifier, name or handle and profile picture, and permission to publish posts for you. We ask for posting permission only: we do not read your feed, messages, followers or analytics. The access tokens for these connections are held by our publishing partner, Post for Me, or, if you connect a network directly, stored server-side with your account. Bluesky has no sign-in screen for apps, so you give an app password (a separate password you create in Bluesky and can revoke there); it is passed to Post for Me to make the connection and PostMax does not store it.
• Content you create. Posts, captions, images, videos, covers, YouTube titles and descriptions, drafts, schedules, profile names, and the results of each post (links to the published post, or error messages).
• Billing. If you subscribe to PostMax Pro, payments are handled by Dodo Payments as Merchant of Record. We receive your subscription status, renewal dates and a customer reference. We never receive or store your card number.
• Technical information. Cookies that keep you signed in, a preference saved in your browser (the profile you last posted from), and standard server logs kept by our hosting providers (such as IP address, browser and time of request) for security and reliability.

We do not use advertising or analytics trackers.

• To run PostMax: publish and schedule posts when you ask us to, show previews, and keep your drafts and history.
• To manage your account, trial and subscription, and to answer support requests.
• To keep PostMax secure, prevent abuse and fix problems.
• To meet legal obligations.

We do not sell your personal information, we do not show ads, and we do not use your content to train AI models. We only publish what you publish or schedule yourself.

When you publish, your post goes to the networks you choose and is then subject to their own terms, privacy policies and visibility settings. Deleting a post in PostMax does not delete it from a network.

Images and videos you upload are stored at long, unguessable public links so the networks can fetch them. Anyone who has a link can open that file, so don’t upload anything you wouldn’t publish.

We share information only with providers that help us run PostMax, and only what they need:

• Supabase: authentication and database (privacy policy).
• Vercel: hosting and file storage (privacy policy).
• Post for Me: connecting social accounts and publishing to them (postforme.dev).
• Dodo Payments: subscription payments, as Merchant of Record (privacy policy).
• Google: sign-in, when you choose it (privacy policy).
• The networks you connect: X, LinkedIn, Meta (Facebook, Instagram and Threads), YouTube, TikTok and Bluesky, which receive the posts you send them.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or of PostMax.

PostMax’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google sign-in is used only to create and identify your PostMax account.

When you connect a YouTube channel, PostMax uses YouTube API Services to upload the videos you choose. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. You can remove PostMax’s access at any time from your Google account permissions, or by disconnecting the channel in PostMax.

We keep your information while your account is open. You can delete drafts, cancel scheduled posts and disconnect accounts at any time. To delete your account, email support@post-max.com; we will delete your account data within 30 days, except records we must keep by law (for example, billing records).

All traffic uses encrypted connections (HTTPS). Database access is restricted so each user can only reach their own data, and access tokens and server keys are never sent to your browser. No system is perfectly secure, so we can’t guarantee absolute security, but we work to protect your information and will notify you if a breach affects you.

Depending on where you live (for example, under the GDPR in Europe or the CCPA in California), you may have the right to access, correct, delete or export your information, and to object to or restrict how we use it. To make a request, email support@post-max.com. We will answer within the time the law requires.

PostMax is not intended for anyone under 16, and we do not knowingly collect information from children.

Our providers may process information in countries other than yours. Where required, they use safeguards such as standard contractual clauses to protect it.

We may update this policy as PostMax changes. We will change the date at the top, and if a change is significant we will tell you by email or in the app before it takes effect.

For any privacy question or request, email support@post-max.com.