PostAway

Privacy Policy

Last updated: October 17, 2026

PostAway ("we," "our," or "us") is a social media scheduling and automation platform operated by Messina Enterprises LLC. This Privacy Policy explains how we collect, use, and protect your information when you use PostAway at getpostaway.com.

1. Information We Collect

We collect the following types of information:

• Account information: Email address and password (stored securely via Supabase Auth) when you create an account.
• Social media tokens: OAuth access tokens for connected Instagram and TikTok accounts. These are stored in our database with encryption at rest, are never sent to your browser, and are used solely to publish content on your behalf.
• Content you upload: Photos, videos, and captions you submit for scheduling. These are stored in Supabase Storage and deleted when you remove them.
• Brand settings: Brand name, niche, and voice preferences you configure, stored locally in your browser.
• Posting settings: Choices you make for each post, such as who can view a TikTok video and whether it is promotional content.
• Notification settings: Whether you want email updates, and the push notification address of each device where you turn on notifications.
• Usage data: Basic analytics such as posts scheduled, published, and failed, and the number of AI captions you generate each day - used to display your dashboard and apply plan limits.

2. How We Use Your Information

• To authenticate you and manage your account
• To publish posts to your connected social media accounts at your scheduled times
• To generate AI-powered captions using Anthropic's Claude API (images are processed but not stored by Anthropic beyond the request)
• To send email and push notifications about published or failed posts (you can turn these off in Profile)
• To process subscription payments via Stripe
• To improve and maintain the PostAway service

3. Instagram Data

PostAway connects to Instagram professional (Business or Creator) accounts using Instagram Login. We request the following permissions:

• instagram_business_basic: To read your Instagram username, account ID and account type, and verify the connection.
• instagram_business_content_publish: To publish the photos, videos and reels you schedule to your Instagram account on your behalf.

We do not sell, share, or use your Instagram data for advertising. Access tokens are used only to publish content you explicitly schedule through PostAway. You can revoke access at any time by disconnecting your account in PostAway's Profile tab or in Instagram under Settings and activity → Website permissions → Apps and websites.

4. TikTok Data

When you connect your TikTok account, we request the user.info.basic, video.upload and video.publish permissions. We use them to show your TikTok name and profile picture, read your posting options (such as who can view your videos), and publish the videos you schedule. TikTok data is used only to fulfill your scheduled posts and is not shared with third parties.

5. Data Sharing

We do not sell your personal data. We share data only with the following service providers who help us operate PostAway:

• Supabase - database, authentication, and file storage
• Anthropic - AI caption generation (image data is sent per-request only)
• Stripe - payment processing for subscriptions
• Meta (Instagram/Facebook) - publishing content via their API
• TikTok - publishing content via their API
• Vercel - web hosting
• Resend - sending notification emails
• Apple, Google and Mozilla push services - delivering push notifications to your devices

6. Data Retention

We retain your account data and scheduled posts for as long as your account is active. You can delete your account at any time in the app under Profile → Delete account, which permanently removes your data immediately, or by emailing us, in which case we remove it within 30 days. OAuth tokens are removed immediately when you disconnect a social account. Database backups containing your data are overwritten within 30 days. See our Data Deletion page for details.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS), encryption at rest, and row-level security on our database so each user can only access their own data. No method of transmission over the internet is 100% secure, but we take all reasonable steps to protect your information.

8. Children's Privacy

PostAway is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately.

9. Your Rights

Depending on your location, you may have the right to access, correct, or delete your personal data, or to object to or restrict certain processing. To exercise these rights, contact us at the address below.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice in the app. Continued use of PostAway after changes take effect constitutes acceptance of the updated policy.