Privacy

What PlatPost is

PlatPost writes social media posts in your voice and posts them to your own accounts on the days you choose. Everything below exists to do that one job. We sell no data, run no advertising and share nothing with anyone who is not described on this page.

Your account

When you create an account we keep your email address and, if you choose one, a password. The password is stored only as a hash by our authentication provider; we never see it. If you sign in with Google, Google sends us your email address, whether Google has confirmed it, the name on your Google account, a link to your Google profile picture and your Google account number. Our sign-in system stores them with your account. We use the email address and the account number to sign you in. We do not use or show the name or the picture: the only name PlatPost shows is one you type yourself, on your details form, your Circle profile or a review, and you can ask us by email to remove the name and the picture link Google sent from the stored record. We keep no Google password and get no access to your mail, files, contacts or any other Google data. We never sell what Google sends us or use it for advertising. If you ask for a sign-in link instead, our sign-in system emails it to you. Basis: the contract with you. Kept while the account exists.

When you start, we ask your full name, your country and, if you have one, your business name. We use them to address you, to name your workspace, and to apply the right consumer rules to your plan. Basis: the contract with you, and our legal duty under consumer law. Kept while the account exists.

Your Business Brain

To write in your voice, PlatPost asks you about your business: its name, website, what you sell, who buys it, what problem it solves, how you differ, the words you use and the words you never use, your goal, facts we may quote, and sample posts you have written. We store all of it, and a small profile we work out from your samples, such as how long your sentences run and whether you use emoji. It is sent to our AI provider each time we draft posts for you, and to nobody else. Our AI provider does not train its models on it. On a paid plan you can also ask the AI to read your business. Then the public text of the website or profile link that you type, and the text of recent posts on the accounts that you pick, go to our AI provider once for each reading. We read a link only when you press the button, and we keep the reading that the AI writes, not the page. On a paid plan, Assess my post sends the text of a post you are writing, with your Business Brain, to our AI provider once for each check, only when you press that button; we keep only the cost of the call, never the text. Basis: the contract with you. Kept until you change it or close the account.

Drafts and posts

We keep every draft we write for you, the idea behind it, your yes or no, the time you scheduled it for, and, once posted, the post's id and link on the network and any error the network returned. Drafts you bin are deleted. If a post fails we email you once to say so; that email is sent by our email provider and carries the text of the post. Basis: the contract with you. Kept while the account exists.

The Calendar page has a Notes row. We keep each note you write there, its day and its tick. Only your account can open them. No other member of your workspace and no connected agent reads them, and our admin console does not show them. You can remove a note at any time, and all of them go when the account is deleted. Basis: the contract with you.

The app shows a numbered notice for an action to do or for news on your posts. When you see a notice about news or press Got it, we keep the time against your account, so the number clears and stays clear on your other devices. We keep that time and nothing else about what you looked at. Remind me later keeps nothing with us: it sets a cookie in your browser that ends when you close it. Basis: the contract with you. Kept while the account exists.

Notifications and push

You choose in Settings, at any time, if the app shows the numbered notices and if it plays one bell chime. We keep that choice against your account. Your browser makes the chime itself; no sound file is loaded and nothing is sent.

Push to a phone or a computer is off until you turn it on in Settings for that device and say yes to your browser's own question. We then keep that device's push address and its two encryption keys, which your browser creates. When a post goes out or fails, we send one encrypted message through the push service of your browser's maker. The message holds counts only, never the words of a post, and the push service cannot read it. Turn push off in Settings and we delete the address at once; a device that ends push itself is deleted the next time we try to send. Basis: your consent, which you can withdraw in Settings at any time.

Your connected accounts

When you connect a social account you sign in on that network itself. The sign-in tokens that let us post are held by our publishing provider under its own security; PlatPost stores only the account reference, the network and your handle. We post only what you approved, or what an agent key you allowed to post sent us, and nothing else. We read your direct messages, the comments on your posts, mentions of your page and your reviews only when you open the Inbox page (the section Your inbox below), and we never read your followers' details. To disconnect, use the Disconnect link in Connected Channels or email us; we remove the reference the same day, and you can also revoke the access in that network's own settings. Basis: the contract with you.

Your inbox

The Inbox page shows the direct messages, comments, mentions and reviews that your connected accounts hold on their networks. When you open the page, our server asks our publishing provider for the lists and shows them to you. We store none of it: no message, comment or review is written to our database, and the next open reads the networks again. The provider reads them with the sign-in tokens it already holds for posting. When you open a message thread, we tell the network that you have read it, as the network's own app would. A reply you write to a comment or a review goes through the provider to the network, where it is public under the comment or the review; we do not keep a copy. A message you send goes through the provider to the person's own inbox on the network, and we keep a count of your sent messages (the day and the channel, never the words) to hold the sending limit. A picture or a video in a message is named, never fetched or shown by us. Messages on X are read only after you turn X messages on for that channel on the Inbox page; X charges for each message read and sent, we take that price from your Wallet, and you can turn it off at any time. Comments and mentions on X are not read. An agent key cannot read the Inbox. Basis: the contract with you, for the account you connected.

Agent keys

If you connect your own AI agent, we store the key's name, its first characters, what it may do, when it was made and last used, and a one-way fingerprint of the key. We never store the key itself, so nobody can read it back. We record each action the agent takes, with the key that took it. The agent runs on your side under its own provider's terms. We receive only what the agent sends to PlatPost. Basis: the contract with you. Kept while the account exists.

Your review

If you write a review, we keep your star rating, your words, the name you give, and, if you choose them, one of your social handles, a website address and a profile picture. The website shows as a link that search engines do not count. Nothing shows until we have read it, and then it is public on the reviews page and may show on the home page. The picture is one you upload, or, if you tick the box, a copy of the profile picture of the channel you chose, which we fetch once from that network when you save. We shrink a picture to a small square and remove its location and camera details before we store it; with no picture, your initials show. You can change or delete your review, or remove the picture, on the reviews page at any time, and deleting it removes the picture too. Basis: your consent, which you withdraw by deleting the review. Kept until you delete it or close the account. The Analytics page also shows a copy of each connected channel's own profile picture, fetched from the network at most once a week and shrunk the same way; only the members of your workspace see it, and closing the account removes it.

The Media Editor and the free library

The Media Editor edits your pictures and videos inside your own browser. A picture leaves your device only when you press Save; the saved copy is stored with your other media. A video you choose from your device stays on your device. When you choose it, we store a small snapshot picture of one frame, its file name, its size, its width, height and length, so Your media and your posts can show it. You can put the video on a post. From that moment our server holds a copy of the file, because the post goes out from our server. The copy stays while a post that carries it is a draft, waits for a time or has failed. We delete the copy 24 hours after the last post that carries it has gone out, or 24 hours after you sent it when no post carries it. The snapshot stays until you delete the video in Your media. Your browser also keeps the file in its own storage, so you need not choose it again; clearing your browser data removes that. When you search the free library, our server sends your search words to Openverse, and never your name or email. The small pictures in the results load straight from that source, so it sees your internet address, as any website you visit does. When you press Use, our server copies the file into your media. Basis: the contract with you. Kept until you delete it in Your media or close the account.

Payments

Subscriptions are taken by Stripe. Stripe holds your card and billing details under its own policy; we hold your Stripe customer and subscription ids, the plan, its status and the end of the current period. We never see the card number. Basis: the contract with you. Payment records are kept for six years for accounting.

Page views

When you open a public page of this site, such as the home page or the pricing page, your browser tells our server which page it opened. Our server looks up the country of your internet address in a table it holds itself, then forgets the address. We keep only a count for each day, page and country. The count holds no address, no cookie and no id, so it cannot tell who you are or whether you came before. No outside service sees it. Only the public pages are counted, never the pages inside your account. Basis: our legitimate interest in knowing which pages people read and where our visitors are. Kept as totals for as long as the site runs.

If you press "Accept all" on the cookie banner, the site loads Google Analytics on every page, the pages inside your account included. Google then sees your internet address, your browser details and the address of each page you open. It gives your browser a random number in two cookies, so it can count one visitor across pages and visits. We get totals: visits, pages, countries, devices and how people move through the site. We see no name and no email, and we send Google no account detail. Google's advertising features and signals are off. Google processes this data in the United States under its own policy and the UK extension to the EU-US Data Privacy Framework. Until you press "Accept all", no Google script loads and nothing is sent. Basis: your consent, which you can withdraw at any time on the cookies page; a withdrawal removes the two cookies and stops the counting at once. Google keeps the totals for 14 months.

The footer of the home page shows a domain rating badge and five launch badges. Your browser loads one picture from each badge provider's server (verifieddr.com, tryeasylaunch.com, buildhop.io, divvlaunches.com, producthunt.com and daniellaunches.com), so each provider sees your internet address and your browser, as any website does when you load a picture from it. We send them no cookie, no account detail and no referring page, and none of their code runs on our site. Basis: our legitimate interest in showing an independent rating of this site and where it launched.

The Share buttons on our public pages are plain links. Nothing loads from a social network until you press one; then that network's own page opens in a new tab, under its own privacy terms. Copy link copies the address on your own device and sends nothing to us.

Builders Circle

Every account is a member of the Builders Circle's open circle. We keep a membership row: your email address, your level (open or inner), which door you signed up through (PlatPost or the Circle's page) and the dates. We keep the inner list, the email addresses we add by hand, as a list. Basis: the contract with you for the Circle, which is part of your account. Kept while your account exists. The weekly newsletter is written by PlatPost; it may name a launch, a project or a public handle you shared in the Circle (terms, section 6a), and you can ask us by email to change or remove a mention.

The Circle's Members page, which only signed-in members can open, lists the members who have made a profile. Until you make one, you are not on it and you have no member page: we never show the name your sign-in gave us. Once you make a profile, the page shows the name you chose and the line you wrote, never your email address or any other detail, and your page there lists the launches and projects the weekly newsletter names you for, with the links the newsletter printed. Basis: your consent, given when you make the profile. To change the name, edit your profile; to leave the page, delete your profile, leave the Circle or close your account.

If you make a profile, we keep what you write: a name, a line about what you build, an intro, up to four portfolio pictures with a few words about each, your interests from a fixed list, a website address, a handle for your X profile and up to six more links, your daily updates and comments, and your Nice and I can help reactions (which update you pressed them on). The daily entry is written by PlatPost; your comment on it is kept like any comment. Every signed-in account can see all of it; nobody who is not signed in can (the Circle's front page shows no member content), and we tell search engines not to list the members' pages. A link shows as you typed it, marked so search engines do not count it; we never visit it. A click on it leaves PlatPost. We shrink a picture and remove its location and camera details before we store it. The day on an update is your own day in your workspace's time zone. Basis: the contract with you for the profile and the updates; your consent for each optional field, which you withdraw by removing it. Kept until you delete it, leave the Circle (which removes your profile, pictures, updates, comments, reactions and listings at once) or close your account.

If you report content, we keep the report, your account id and our decision for 12 months, as a record that the law on online safety asks us to keep. If you block a member, we keep the block until you lift it; it hides you from each other. The operator reads reported content and every listing before it shows. Basis: our legal duty under the Online Safety Act 2023.

Your business tools

When you use Bookings, Quotes, Invoices and Clients on a paid plan, you store details about your own clients in PlatPost: their name, email address, phone number, postal address, a note, the jobs you book for them, and the quotes and invoices you send them. You decide what to store and why, so for that data you are the controller and PlatPost is your processor. We use it only to run these tools for you: to show it to you, to send the emails you ask us to send (booking confirmations, reminders, quotes, invoices and repeat invoices, through our email provider, with your business name on them), and to keep your records. We never sell it, never use it for our own marketing, and never send it to the AI. The "Turn this job into a post" button sends the AI only the service, the length of the job, the day and the words you type about it, never your client's name or details.

To print them on your quotes and invoices, we store the trading name, address, tax number, logo, brand colours, payment links and bank details you add in Business settings. Only the workspace owner can change the payment links and bank details, after a sign-in in the last ten minutes, and we email you after every change. We store no card numbers, for you or for your clients.

Your clients' own pages: when your client books on your booking page, we record the booking, the name, email address and phone number they type, and the time; the page counts bookings by internet address and by email address to stop abuse, and it runs the Cloudflare human check described in "The human check on sign-up and sign-in", so Cloudflare sees that visitor's address and browser for that page too. When your client opens a quote or an invoice by its link, we record that the link was opened and, when they accept or decline a quote, the name they typed and the time. Those pages set only the cookies they need to work, are not listed by search engines, and show one document each.

How long we keep it: while your account is open. An issued invoice cannot be changed or deleted on its own, because the law expects your invoice records to stay as sent; to correct one you void it and issue a new one, and you can export every invoice as a file at any time. When you delete your account, we delete your clients, bookings, quotes, invoices, packages and repeat invoices with it, so export first. If one of your clients asks to see or delete their details, that request is yours to answer, and we help you: you can edit or archive a client and export what you hold about them. Basis: the contract with you; for your clients' data, your instructions as the controller. The terms of service, section 6c, are the processing contract between you and PlatPost.

If you are a client of a business that uses PlatPost: that business decides what it stores about you and why, so it is responsible for your data, and its own privacy information applies. PlatPost runs its booking page, its quote and invoice pages and its emails for it, and uses your details for nothing else. To see, correct or delete your details, ask the business first; its name and contact are on every page and email. If you write to us at hello@platpost.com instead, we pass your request to the business and tell you that we did.

Security

Our server records a security event when a request looks hostile. Examples are a failed sign-in, a request for a page that only a scanner asks for, and a request from a program that falsely claims to be a search crawler. An event holds the time, the kind of event, the page asked for, the first 300 characters of the browser's user agent text and a coded form of the internet address.

We make the coded form with a secret key. We never store the plain address. The coded form is a pseudonym, not an anonymous value: whoever holds the key can code an address and match it. We delete events after 30 days.

If an address attacks the site, we block it for a limited time. A block from our rules lasts 24 hours or 1 hour. A block that we set by hand lasts up to 30 days. We keep a note of each block and a daily summary of counts for the operator in the admin console, and we email the operator only when a block shows a serious attack on the site. We do not block a search crawler that a reverse and forward DNS check proves genuine. Basis: our legitimate interest in keeping the site and your account safe.

The human check on sign-up and sign-in

The sign-in page also runs a check of our own. When the page loads, our server prints a signed time stamp and one empty field, which a person never sees, into the form. When you sign in, create an account or ask for an email link, our server checks that the stamp is genuine, that it is between one second and six hours old, and that the empty field is still empty. No third party is involved, no cookie is set and nothing is stored. It covers sign-in as well as sign-up. Basis: our legitimate interest in stopping automated attacks on accounts.

The sign-in page can show a check from Cloudflare (Turnstile) that tells a person from a program. When it shows, your browser loads a script and a small frame from Cloudflare, so Cloudflare sees your internet address and browser details. When you create an account or ask for an email link, the form sends Cloudflare's answer token to our server, and our server sends the token and your address to Cloudflare to confirm it. We store neither. It runs on the sign-in page only, and it is a security check, not advertising or analytics. Cloudflare handles the data under its own policy. If Cloudflare cannot answer, the form still works. Basis: our legitimate interest in stopping automated fake accounts.

What we do not collect

PlatPost sets no advertising cookies, stores no plain IP addresses and stores no card numbers, yours or your clients'. The only analytics cookies are the two Google Analytics cookies above, and they exist only after you press "Accept all". The other cookies that PlatPost sets are the one that keeps you signed in, the one that remembers your cookie choice, the one that remembers your answer to the "Remember me" box on the sign-in page, a marker with no personal data that shows you may be signed in and, if you use "Remind me later" on a notice, a cookie that hides that notice until you close the browser. A ticked box keeps your sign-in on that browser for 30 days. An unticked box ends it when you close the browser. We never save your password. When it shows, the Cloudflare check on the sign-in page is covered by its own policy; the cookies page lists them. Sign-in attempts are rate limited by a short lived count in memory that is not stored. The only stored trace of an address is the coded form in the Security section.

Where the data lives

The database and sign-in run with our database provider in London; the business tools (your clients, bookings, quotes and invoices) use that same database. The site runs with our hosting provider. Drafting runs with our AI provider. Posting to your networks runs through our publishing provider. Emails go through our email provider. Payments go through Stripe. The sign-in page can use Cloudflare for an extra human check. If you accept all cookies, Google Analytics counts your visits. Some of these providers process data outside the UK and the EEA; each transfer is covered by the provider's standard contractual clauses or an adequacy decision. We name any of these providers on request; email hello@platpost.com.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, receive it in a portable format, restrict or object to processing, or withdraw a consent, by emailing hello@platpost.com. We answer within one month. Closing your account deletes your Business Brain, your drafts, your review and its picture, and your connected account references at once; payment records stay for the six years above. You can complain to the Information Commissioner's Office at ico.org.uk or to your local EU data protection authority.