# Privacy Policy

Last updated: today.

Postim ("we", "us") operates the website postim.org and the Postim scheduling service (the "Service"). This page tells you what data we collect, why, and what we do with it.

## 1. Data you give us
- **Account.** Email and password. If you sign in with a third-party OAuth provider (Google, GitHub, etc.) we receive your email and public profile from them.
- **Content you upload.** Post text, images, videos, scheduling metadata, integration tokens. This is your data — we process it only to provide the Service.
- **Billing.** If you upgrade, our payment processor (Stripe) handles your card. We never see or store the card number.

## 2. Data we collect automatically
- **Server logs.** IP address, user-agent, request URL. Retained for 14 days for abuse and debugging.
- **Cookies.** One auth cookie, one language cookie. No third-party trackers, no advertising cookies.

## 3. How we use the data
- To provide the Service: schedule, publish, and analyse your posts.
- To send transactional email (password reset, billing). No marketing email unless you opted in.
- To respond to legal requests when required.

## 4. Where the data lives
- Production database: PostgreSQL on Supabase (eu-west-1).
- Object storage: local volume on our VPS, or your own Cloudflare R2 bucket if you configure it.
- Backups: not enabled by default.

## 5. Sharing
We don't sell your data. We share it only with the sub-processors necessary to run the Service (Supabase, Stripe, the social platforms you publish to). Each sub-processor has its own privacy policy.

## 6. Your rights
You can export, correct, or delete your account and all associated data at any time from Settings → Account. EU/UK residents have additional rights under GDPR — email privacy@postim.org.

## 7. Security
We use industry-standard encryption in transit (HTTPS) and at rest (provider-managed). If we learn of a breach affecting your data, we'll email you within 72 hours.

## 8. Children
The Service is not directed at children under 16. We do not knowingly collect their data.

## 9. Changes
We will post material changes here and email you at least 30 days before they take effect.

## 10. Contact
privacy@postim.org — we answer within 5 business days.