Privacy Policy

We collect the following categories of personal data:

• Account information — your name, email address, password (stored only in hashed form), workspace and organisation details, timezone and account settings.
• Connected social accounts — when you connect a channel (such as Bluesky, Mastodon, Facebook or TikTok) we store the account identifiers, the public profile details the platform returns (such as your username, display name and avatar) and the access tokens the platform issues so we can publish on your behalf. Access tokens are stored encrypted.
• Performance data — for the accounts you connect we retrieve and store audience figures (such as follower, following and post counts) and engagement on the posts PostDaily published for you (such as likes, comments, shares and views), including a daily history, so we can show you analytics. We only read data for the accounts you connected, and we show it back only to your workspace.
• Content you create — the posts, drafts, captions, threads, schedules, tags and media (images and video) you build and upload in the Service.
• Billing information — your plan, subscription status and billing history. Payments are handled by our payment provider (Polar); we do not store your full card details.
• Usage & device data — collected automatically, such as IP address, browser and device type, the pages and actions you take in the Service, and diagnostic logs, to keep the Service secure and reliable.
• Support & communications — the messages you send us and related details when you contact support.
• Creator Partner applications — your name, creator or business name, email address, website and social profile links, the platforms you use, approximate audience size, primary audience region, how you plan to promote PostDaily, and anything else you tell us. We also record the application's status and dates, and the version of the Creator Partner Program Terms you accepted.
• Creator Partner accounts — for approved partners: partner and referral identifiers, the referral code and link, the applicable customer discount and commission rate, campaign details, partner status, private dashboard access, referral statistics, commission records and payout history.
• Referral and attribution — when someone arrives through a partner link or uses a partner code: the referral or partner identifier, the code, the date and time, the landing page, expiry, whether a qualifying sign-up or payment followed, the subscription it relates to, and the attribution status. This may be linked to an account or subscription where needed to run the Program.
• Commission and payouts — commission amounts and the net subscription revenue they are calculated from, pending, payable and paid balances, refund and chargeback adjustments, payout dates, status and method, and the payment details needed to pay a partner (for example through PayPal or a bank). We ask only for what is reasonably necessary to make the payment.

We use the personal data we collect to:

• operate the Service — create your account, connect your channels, store your media, and schedule and publish the posts you queue;
• provide our AI composer features (see section 6);
• process payments and manage your subscription;
• send you service communications — verification, security, billing and important account notices;
• keep the Service secure, prevent abuse and fraud, and diagnose problems;
• comply with our legal and regulatory obligations;
• run the Creator Partner Program — review applications, approve partners, create referral links and codes, attribute qualifying referrals, calculate commission, keep commission and payout records, pay partners, provide dashboard statistics and answer partner queries;
• detect self-referral, artificial traffic, fraud and Program abuse, investigate disputed attribution, prevent manipulation of links, codes or commission, and enforce the Creator Partner Program Terms.

A referral does not give a Creator Partner access to the referred customer's account. Partners are not shown individual customer names, email addresses, phone numbers, billing or payment details, connected social accounts, posts or media — their reporting is aggregate.

We do not sell your personal data, and we do not use the content of your posts or media to serve advertising.

Under UK data protection law we rely on the following lawful bases:

• Contract — to provide the Service you sign up for, manage your subscription, take steps you ask for before we agree, receive and process a Creator Partner application, administer an approved partner relationship, calculate and pay qualifying commission, and perform our obligations under the Creator Partner Program Terms.
• Legitimate interests — to secure, support and improve the Service, run the Creator Partner Program, keep referral attribution accurate, resolve attribution and commission disputes, prevent fraud and self-referral, detect artificial or manipulated traffic, and keep proper operational records — each balanced against your rights and freedoms.
• Legal obligation — to meet tax, accounting, financial record-keeping and fraud-prevention requirements, and to respond to valid legal requests.
• Consent — where required, for example optional marketing emails, non-essential cookies and certain referral tracking technologies. You can withdraw consent at any time, and doing so does not affect processing carried out lawfully beforehand.

When you connect a social account you authorise PostDaily to access that account, publish the content you schedule, and read back the profile and performance information needed to run your channel — your username and profile details, your audience figures, and the engagement on posts PostDaily published for you. We use the access tokens the platform issues only to perform the actions you request, and we request the minimum permissions needed to schedule, publish and report on your posts.

We do not sell this information, use it for advertising, or share it with third parties beyond the infrastructure providers that operate the Service. Disconnecting a channel stops PostDaily from accessing that account, and we delete the access tokens, the profile details, the performance figures and the network's own identifiers for the posts we published within 30 days. We keep the account identifier itself, so that reconnecting the same account is recognised as the same channel rather than creating a duplicate. Anything still held is also removed when the workspace or your PostDaily account is deleted.

You can disconnect a channel at any time from your channel settings, and revoke PostDaily's access from the network's own app settings. Our use of information received from social platform APIs complies with each platform's developer terms and limited-use requirements.

YouTube. PostDaily uses YouTube API Services to upload the videos and Shorts you schedule and to read back your channel details and per-video statistics. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy. You can revoke PostDaily's access to your Google account at any time at security.google.com/settings/security/permissions. We delete the data we hold from your YouTube channel within 30 days of you revoking that access, and within 7 days of a direct deletion request to support@postdaily.app. While a channel stays connected we re-verify our authorisation to it at least every 30 days, and we never combine YouTube data across different channel owners.

LinkedIn. For a connected LinkedIn Company Page, PostDaily shows the comments people leave on posts it published for you, alongside each commenter's name and profile photo as LinkedIn provides them. Comments are fetched from LinkedIn when you open a post and are never saved by PostDaily. To stay within LinkedIn's rate limits, a commenter's name, profile photo link and profile link are kept in a temporary server cache for at most 24 hours, then fetched again; they are never written to our database. Where LinkedIn does not share a commenter's details, PostDaily shows "LinkedIn member" and a link to the comment on LinkedIn instead.

Pinterest. PostDaily publishes the image and video pins you schedule to the board you choose, and reads your list of boards so you can pick one. Pinterest's developer terms let apps keep only campaign analytics, so we read the rest each time instead of storing it: your boards are fetched when you open the composer, and a pin's impressions and saves are fetched from Pinterest at the moment you open that pin in PostDaily. Neither is saved, so Pinterest pins have no performance history in PostDaily's analytics pages. For a connected Pinterest channel we store your Pinterest username — which is the identifier Pinterest uses for the account — your display name and profile picture, the access tokens (encrypted), and the identifiers and links of the pins PostDaily published for you. Disconnect the channel and we delete all of it within 30 days, apart from the username, which we keep so that reconnecting the same account is recognised as the same channel; you can also revoke PostDaily's access at any time from your Pinterest account settings.

PostDaily's AI assistant helps you draft, rewrite and schedule posts. When you use it, the text you provide is sent to our AI infrastructure provider (Cloudflare Workers AI) to generate suggestions, which are returned to you. This content is processed only to provide the feature — it is not used to build advertising profiles, and our provider does not use it to train its foundation models. You remain responsible for reviewing and editing AI-generated content before you publish it.

To answer a request, the assistant is given the draft you are working on, the channels you have selected and their character limits, your workspace's brand-voice settings, and — when you ask a question that needs them — summaries of your own posting schedule and published-post metrics. It is never given your social network access tokens, and it cannot publish or schedule anything without you confirming the action in the app.

We store the following so the feature works across sessions:

• Chat transcripts — the messages in each assistant conversation, kept with that conversation so you can reopen it. Deleting a conversation deletes its transcript; deleting the workspace or your account deletes every transcript in it.
• Brand-voice settings — the tone description, preferences and example posts you save for a workspace. Deleted with the workspace.
• Usage counts — how many AI credits a workspace has spent in the current month, for billing limits. This is a number only; it holds no message content.

AI apps you connect — you can connect an outside AI app, such as Claude, ChatGPT, Cursor or Codex, to PostDaily through our MCP server or with an API key you create. You choose the workspaces it can use and whether it has full access, can only create drafts, or can only read. You can disconnect it at any time in Settings → AI agents, and changing or resetting your password disconnects every AI app and API key.

A connected app receives only what its requests return from the workspaces you chose: your name, workspace and channel names and handles, posts and their text, media links, schedules and publishing status, your queue and your analytics. It is never given your password or your social network access tokens. What the app does with that information is governed by its provider's own terms and privacy policy, not ours.

For each connection we store:

• The connection — the app's name and identifier, the address it signs in from, the access level and workspaces you granted, when it expires and when it was last used. For an API key we store only its first characters and a one-way hash, never the key itself.
• Short-lived records — a sign-in approval, which can be used for 30 minutes, and a record of each change the app asks for, used for 24 hours so a retried request cannot post twice.
• Activity — an audit log entry for each change an app makes, and usage statistics (which tool, whether it worked, which app) that contain no post content.

Deleting your account deletes its connections along with the rest of your data.

We operate the PostDaily Creator Partner Program, which lets approved partners refer potential customers using referral links and promotional codes.

When you apply, we use what you provide to assess the application, understand your promotional channels, decide whether your audience suits the Program, contact you about it, and administer the relationship if you are approved. Applying does not guarantee approval.

Approved partners receive a referral link such as postdaily.app/r/PARTNERCODE and a promotional code. When someone follows a referral link we may remember the partner who referred them for up to 60 days, where that tracking is permitted — see our Cookie Policy. A customer may also enter a valid partner code at checkout, in which case the code is stored against the subscription so we can apply the discount, determine attribution and calculate commission.

If automatic referral tracking is unavailable — because of your privacy choices or for technical reasons — a valid partner code entered manually at checkout still works. We do not work around your choice.

Where a customer becomes associated with a referral we record that attribution internally against the account or subscription, because that is what decides whether commission is owed. It does not give the partner access to the customer's account. Partners are not given customer names, email addresses, billing or payment information, posts, media, connected social accounts or anything else that identifies an individual customer.

Partners get a private dashboard of aggregated figures — link clicks, sign-ups, paying customers, conversion rate, and pending, payable and paid commission with payout history. It is designed to show how their referrals perform without revealing who the customers are.

Where a qualifying referral earns commission we record what is needed to calculate it, apply the partner's rate, track whether it is pending, payable or paid, account for refunds and chargebacks, process payouts and keep financial records. Payment details supplied for payouts are used only for payment, financial, security and compliance purposes.

We analyse referral and transaction information to detect and prevent self-referral, fake or duplicate accounts, artificial traffic, automated clicks, fraudulent transactions, referral manipulation, coupon abuse, cookie stuffing, chargeback abuse and other breaches of the Creator Partner Program Terms. Where we detect suspicious activity, the relevant commission, links or payouts may be reviewed or held while we investigate.

We share personal data only with trusted providers who process it on our behalf under contract, and with the networks you choose to publish to:

• Cloudflare, Inc. — hosting, content delivery, media storage, database connectivity, AI inference and transactional email.
• Amazon Web Services, Inc. — managed database hosting for your account and content data.
• Polar Software Inc. — subscription billing and payment processing.
• The social networks you connect — such as Meta (Facebook), Mastodon servers and Bluesky — to publish the content you schedule.

Creator Partner payouts — where you take part in the Creator Partner Program we share the minimum needed to pay you with your chosen payment provider or bank, which may include PayPal, banks, payment processors and intermediaries involved in international transfers. They may act as independent controllers under their own privacy policies.

Where reasonably necessary we may also share information with accountants, legal advisers, auditors, fraud-prevention providers, regulators, law enforcement and tax authorities, where required by law or to protect PostDaily, the Creator Partner Program, our users or our legal rights.

We also disclose personal data where required by law, or where necessary to protect our rights, our users or the public. Some of our providers are located outside the UK, including in the United States. Where we transfer personal data internationally we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision. A current list of our subprocessors is available on request at support@postdaily.app.

We use cookies and similar technologies to keep you signed in, protect your account, remember relevant preferences, understand how the Service is used, and — where you allow it — support Creator Partner referral attribution. We do not use third-party advertising cookies to build advertising profiles.

Creator Partner referral tracking — when someone follows a partner referral link we may store a first-party referral identifier for up to 60 days, so we can tell whether a later qualifying sign-up or subscription should be attributed to that partner. It gives the partner no access to your browsing or your account. Where consent is required for a non-essential technology, we use it only in line with your cookie choices.

For the full list of what we store, how long it lasts and how to change your choices, see our Cookie Policy.

We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete your account we delete or anonymise your personal data within 30 days, except where we must retain certain records — such as billing and tax records — for longer to meet legal obligations, resolve disputes or enforce our agreements.

Referral attribution — a referral identifier that never leads to a qualifying attribution is intended to expire after 60 days.

Partner applications — we keep application information for a reasonable period after a decision so we can maintain records, answer questions, prevent repeated fraudulent applications, reconsider an application where appropriate, and establish or defend legal rights. Rejected applications are scrubbed on our normal retention schedule, and an applicant can ask us to erase their details sooner.

Approved partners — we keep Program records while the relationship is active. Afterwards we keep only what we need for final commission calculations, refunds and chargebacks, payout and accounting records, tax obligations, fraud prevention and resolving disputes. Financial records may need to be kept longer where the law requires it.

Under UK data protection law you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can exercise most of these directly in your account settings or by emailing support@postdaily.app; we may need to verify your identity first.

These rights apply equally to information we hold about you in connection with the Creator Partner Program — partners and applicants can contact us to access, correct or otherwise act on their information. If you object to or withdraw consent for referral tracking, we may not be able to attribute a future transaction automatically through a referral link; a valid partner code entered at checkout can still be used.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk — though we would appreciate the chance to help first.

We protect your data with encryption in transit and at rest, encrypted storage of connected-account tokens, scoped access controls and monitoring. No method of transmission or storage is perfectly secure, but we work hard to safeguard your information and will notify you and the ICO of a personal-data breach where the law requires.

A Creator Partner's public referral code is deliberately separate from their private dashboard: a code they publish can never open their financial statistics. Dashboard access uses a long, random, unguessable token that we can revoke or reissue, and partners are responsible for keeping their link confidential — tell us if one is exposed and we will replace it. The dashboard shows aggregated referral figures, never identifiable customer information.

PostDaily is not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact support@postdaily.app and we will delete it. Taking part as an individual Creator Partner is subject to the eligibility requirements in the Creator Partner Program Terms.

We may update this Privacy Policy from time to time. We will update the "last updated" date above and, for material changes, give notice in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

We may also update it when we introduce or materially change parts of the Creator Partner Program, referral tracking or partner payouts. Where a change materially affects how partner or customer data is used, we will give notice where required.

Questions about this policy or your data? The data controller is Galaxyway AI Ltd. We are happy to help. For privacy questions about the Creator Partner Program, partners, applicants and referred customers can also reach us through our contact page.