Privacy Policy
Last updated: October 14, 2026
1. Data We Collect & Purpose
PostNao collects account identity details (name, email address, hashed password via Argon2id), workspace configuration, uploaded media files, and official OAuth tokens granted by you for Facebook Pages, Instagram Professional accounts, TikTok accounts, and YouTube channels. Platform data is used strictly to validate, schedule, and publish content that you explicitly create.
2. Token Encryption & Media Sanitization
All social platform OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with versioned keys and row-bound Additional Authenticated Data (AAD). Tokens are decrypted only in memory immediately prior to an authorized API call and are never exposed in browser responses or logs. Uploaded images have EXIF GPS location coordinates stripped automatically during media processing.
3. Third-Party Platform Compliance (Meta, TikTok, Google/YouTube)
PostNao complies with the Meta Platform Terms, TikTok Developer Terms of Service, and Google API Services User Data Policy (including YouTube API Services Terms of Service). You may revoke PostNao’s access at any time from your Connected Channels page or directly inside Facebook, Instagram, TikTok, or Google security settings.
4. Data Retention, Export & Deletion Requests
When you disconnect a social account, encrypted tokens are permanently wiped and revocations are sent to the platform. When you delete a workspace or your user account (or submit a Meta Data Deletion Callback request), all scheduled targets are cancelled, tokens are wiped, and media objects are purged from S3 storage within 30 days. For data export or deletion inquiries, contact privacy@postnao.com.