Privacy Policy

Last updated: 28 September 2026

PostPilot ("the Application") is a self-hosted, single-operator social media scheduling tool. This policy describes what data the Application processes and how.

1. Who uses PostPilot

PostPilot is a private installation used only by its operator. It has no public sign-up, no third-party users and no visitors' data to collect. This website is informational only and sets no analytics or advertising cookies.

2. Data the Application processes

Social account connections. When the operator connects a social media account (Instagram, Facebook, TikTok, YouTube) through the platform's official OAuth flow, the Application stores the account identifier, the account's display name, and the OAuth access/refresh tokens issued by the platform.
Scheduled content. Captions, video URLs and scheduling times the operator provides for their own posts.
Post metrics. Aggregate statistics for published posts (such as views, likes, comments), retrieved through the platforms' official analytics APIs.

3. How data is stored and protected

All data is stored in the operator's own database on the operator's own server.
OAuth tokens are encrypted at rest (AES-256-GCM) and are never displayed, logged or sent to the browser.
All traffic to the Application is served over HTTPS.

4. TikTok data

Through TikTok's official APIs, the Application accesses only: the connected creator's basic profile information (display name), the ability to publish videos the operator schedules (Content Posting API), and view/like/comment/share counts for videos published through the Application. TikTok data is used solely to publish the operator's own content and display its performance to the operator. It is not sold, shared with third parties, or used for advertising.

5. Data sharing

The Application shares data only with the social media platforms themselves, as required to publish the operator's content through their official APIs. No data is sold or transferred to any other third party.

6. Data retention and deletion

Data remains on the operator's server until the operator deletes it. Disconnecting a social account deletes its stored tokens. Revoking the Application's access from the platform's own settings (for TikTok: Settings → Security → Apps and websites) immediately invalidates its tokens.

7. Contact

For any privacy question regarding this installation, contact the operator at marius@craiovaforum.ro.