Skip to content
Postloom

Privacy policy

Last updated October 28, 2026

Template — review with a lawyer before launch. This text describes how this Postloom installation works, but it isn’t legal advice.

What we collect

  • Account details: your name, email address and a hashed password (we never store it in plain text).
  • Workspace content: posts, images, schedules, account groups and settings you create.
  • Connected accounts: the profile name and handle of each network account, plus access tokens, which are encrypted at rest.
  • Security records: session data (device, IP address, times) and an audit log of sign-ins and important changes.
  • Messages you send us through the contact form.
  • Billing: when payments are enabled, card details are handled by Stripe; we store only the subscription status, plan and invoices.

Why we use it

Only to run Postloom: to sign you in, publish and schedule your posts, keep your workspace secure, bill your plan and answer your messages. We don’t sell personal data and don’t use it for advertising.

Who we share it with

  • The social networks you publish to receive the posts and images you send them.
  • AI assistants you connect can read and change posts in the workspace you authorized.
  • Service providers that run Postloom (hosting, email delivery and, when enabled, Stripe) process data on our behalf.

Cookies

Postloom uses only essential cookies: a session cookie that keeps you signed in, and short-lived cookies that remember a plan or invitation you chose before signing up. There are no tracking or advertising cookies and no third-party scripts.

How long we keep it

For as long as your account exists. Deleting your account removes your profile, sessions, keys and the workspaces where you were the only member. Posts in shared workspaces stay with that workspace without your name.

Your rights

You can see and change your details in Settings, export your posts by asking us, and delete your account at any time. Depending on where you live, you may have further rights (access, correction, deletion, objection); contact us to use them.

Security

Passwords are hashed with scrypt, tokens for email links are single-use and stored only as fingerprints, network tokens are encrypted, and every page is served with strict security headers.