Privacy Policy

Last updated October 2, 2026

Who we are

PostNinja (“we”, “us”) is operated by PostNinja and runs at postninja.app. We are responsible for the personal information described here. You can reach us about anything in this policy at support@postninja.app.

What we collect

Your PostNinja account

• Your name, email address and time zone.
• Your password, which we store only as a one-way hash, never in readable form.
• If you sign in with Google or X: the name, email address and profile picture that service shares with us. We don't receive your Google or X password.
• If you turn on two-step verification: an encrypted authenticator secret and your backup codes.

Social accounts you connect

• The account's ID, username, display name and profile picture.
• Access tokens that let us post on your behalf. These are encrypted (AES-256-GCM) before they're stored, and we use them only for the actions you ask for.
• For posts we publish to Instagram, Threads, Facebook, TikTok, YouTube and Pinterest: views, likes, comments, shares, saves and similar counts, so we can show you how your posts did. We don't read stats for X or LinkedIn posts.

What you create

• Posts, drafts, the text you write for each platform, and when you schedule them.
• Photos and videos you upload.
• API keys you create. We store only a hash of each key.
• Apps you connect by signing in (such as ChatGPT or Claude): which app, what you allowed it to do, and when. We store the access it was granted until you disconnect it in Settings → API.

Plans and credits

• Your plan, its renewal date, and a record of credits added and used. Payments are handled by Stripe and sold through Link, Stripe's merchant of record, which receives your name, email, billing address and payment details to take the payment, calculate tax and send receipts. We never see or store your full card number.

Technical information

• The IP address and browser type of each device you're logged in on, which you can see and log out of in Settings.
• Server logs of requests and errors, used to keep the service running and secure.

How we use it

• To provide the service: publishing your posts at the times you choose, showing your calendar and previews, and reporting results.
• To keep your account and the service secure, including detecting abuse and enforcing our Terms.
• To manage your plan and credits.
• To answer your questions and tell you about important changes to the service.
• To meet legal obligations.

We don't sell your personal information, we don't use it for advertising, and we don't use your posts or media to train AI models.

If you're in the UK or the European Economic Area, we rely on these legal bases: performing our contract with you (running the service you signed up for), our legitimate interests (security, preventing abuse and improving the service), your consent where we ask for it, and compliance with the law.

Who we share it with

• The platforms you connect. When you schedule a post, we send its text and media to the platforms you chose to publish it, using the access you granted. What happens next is governed by that platform's own privacy policy.
• Sign-in providers. If you use Google or X to log in, we exchange the information needed to sign you in.
• Your team. People you invite to a workspace see its connected accounts, posts, calendar, results and credits, and your name and email address. When you invite someone, we email them on your behalf.
• AI assistants and apps you connect. If you connect an app such as ChatGPT, Claude, Gemini or Grok to PostNinja, or give one an API key, it can read and change your accounts' posts as you allowed, and the posts, account names and results it reads are handled under that app's own privacy policy. You choose what to allow, and you can disconnect it at any time.
• Service providers who host and run our infrastructure (such as our cloud server provider), send our account emails (Resend, which receives your name, email address and the email's contents) and take payments (Stripe), under contracts that require them to protect your data and use it only for the service they provide us.
• Authorities, when we're legally required to, or to protect the rights, safety and property of our users or others.
• A buyer or successor, if PostNinja is ever sold or merged, who would remain bound by this policy for the data they receive.

About uploaded media: Several platforms (Instagram, Threads, Facebook, TikTok and Pinterest) download photos and videos from us when they publish them, so each upload is available at a long, unguessable web address. Anyone who has that exact address could view the file. Uploads that aren't attached to a post are deleted after two days.

Platform data

PostNinja's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use data from Meta (Facebook, Instagram and Threads), X, TikTok, YouTube and Pinterest only to provide the features you use, in line with their developer terms, and we don't sell it or use it for advertising.

YouTube. PostNinja uses YouTube API Services to upload videos to channels you connect and to read their view, like and comment counts. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy. You can remove PostNinja's access to your YouTube data at any time from your Google account's third-party connections page. Disconnecting the channel in PostNinja also deletes its stored access tokens straight away.

Cookies

We use only cookies that the service needs to work: keeping you logged in, completing sign-in with Google or X or a connection to one of your social accounts, and remembering a device you've trusted for two-step verification. Your light or dark theme choice is saved in your browser. We don't use advertising or third-party tracking cookies.

How long we keep it

• Your account information, posts and media: for as long as your account exists.
• Tokens for a social account: until you disconnect it, remove PostNinja's access on that platform, or delete your account. When you disconnect an account we delete its tokens straight away.
• Login sessions: up to 30 days, or until you log out.
• Server logs: for a limited period, then they're deleted.

When you delete your PostNinja account, we delete your login, your workspace and everything in it: connected accounts and their tokens, posts, drafts, uploads and API keys. Posts already published stay on the platforms they went to; delete them there if you want them gone.

Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy of it;
• correct anything that's wrong;
• delete your information;
• object to or restrict how we use it;
• take your data to another service.

You can update or delete most information yourself in Settings, and see the other ways to delete your data on our data deletion page. For anything else, email support@postninja.app. We'll respond within 30 days. If you're unhappy with how we handle your information, you can complain to your local data protection authority; in the UK that's the Information Commissioner's Office (ico.org.uk).

Security

We protect your information with encryption in transit (HTTPS) and at rest for platform tokens, hashed passwords and API keys, optional two-step verification, and limited access to our systems. No service can promise perfect security, so please use a strong, unique password and turn on two-step verification.

International transfers

Our servers and the platforms we connect to may be in countries other than yours. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards such as the standard contractual clauses.

Children

PostNinja isn't meant for anyone under 16. We don't knowingly collect information from children; if you believe a child has given us information, contact us and we'll delete it.

Changes to this policy

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll let you know by email or in the app before it takes effect.

Contact

Questions or requests about your privacy: support@postninja.app.