Privacy Policy

Effective date: 12 May 2026  |  Last updated: 15 May 2026

This Privacy Policy explains how Postiz ("the App"), accessible at https://postiz-coolify-oracle.13101993.xyz ("the Service", "we", "us"), collects, uses, stores, and protects your personal data when you create an account and connect social-media accounts — including TikTok — to schedule and publish content on your behalf.

By registering an account or connecting a social platform you confirm that you have read and understood this policy and give your free, informed, unambiguous consent to the processing described herein (GDPR Art. 6(1)(a)).

1. Data Controller

The data controller for personal data processed through Postiz (accessible at https://postiz-coolify-oracle.13101993.xyz) is the operator of this application. For all data-related enquiries please contact:

• Email: admin@13101993.xyz
• Platform URL: https://postiz-coolify-oracle.13101993.xyz

2. Data We Collect

2.1 Account data

• Display name, e-mail address, and password (stored as a bcrypt hash — never in plaintext).
• Account creation timestamp and last login timestamp.

2.2 TikTok data TikTok-specific

When you connect a TikTok account via OAuth 2.0 we receive and store the following data, as returned by the TikTok API:

Data field	Purpose	TikTok API scope
Open ID (persistent user identifier)	Uniquely link your TikTok account to your Postiz account	user.info.basic
Display name	Show which TikTok account is connected in the UI	user.info.basic
Avatar / profile picture URL	Display your profile picture in the connected-accounts panel	user.info.basic
Profile link (TikTok URL)	Provide a direct link to your public profile in the UI	user.info.profile
Bio / description	Display account context to the authenticated owner	user.info.profile
Follower count, following count, like count, video view count	Show account statistics to the authenticated owner only	user.info.stats
List of existing videos (title, cover, share URL, duration, view/like/comment counts)	Display a video library so you can reference or repost existing content	video.list
OAuth access token + refresh token	Publish / schedule posts to TikTok on your behalf without requiring repeated logins	video.upload / video.publish

TikTok data is retrieved only on your explicit instruction (connecting the account) and when necessary to fulfil the scheduling service. No TikTok data is read, processed, or stored beyond what is listed above.

2.3 Other social-platform data

For each other social platform you connect (Twitter/X, LinkedIn, Facebook, Instagram, YouTube, Pinterest, Reddit, Mastodon, Threads, Discord, Slack, TikTok) we store the equivalent: platform user ID, display name, avatar, and OAuth tokens. The same principles apply as described for TikTok above.

2.4 Content you create

• Post drafts, published post text, and attached media files you upload.
• Scheduled publication dates and times.

2.5 Technical / log data

• IP address, HTTP request method, URL, response code, browser user-agent, and request timestamp — retained in server logs for up to 30 days for security and abuse prevention.
• Session cookies (see §7).

3. Legal Basis for Processing (GDPR)

Processing activity	Legal basis	GDPR article
Connecting a social account (OAuth) and retrieving profile / stats / video data	Your explicit consent given at the OAuth authorisation screen	Art. 6(1)(a)
Storing tokens & publishing posts on your behalf	Performance of the contract (the scheduling service you signed up for)	Art. 6(1)(b)
Server log / security monitoring	Legitimate interests in securing the platform	Art. 6(1)(f)
Sending transactional emails (password reset, notifications)	Performance of contract	Art. 6(1)(b)

4. Where Your Data Is Stored

All data is stored exclusively on the server hosting this Postiz instance:

• Provider: Oracle Cloud Infrastructure (OCI)
• Region: EU-Frankfurt-1 (or the region shown in your OCI tenancy)
• Database: PostgreSQL 17 running in a Docker container on the same host
• Media uploads: stored on the local filesystem of the same host under /uploads
• In-memory cache: Redis 7.2 running in a Docker container on the same host — volatile, cleared on restart

Data does not leave the server except when publishing a post to the connected social-media platform (in which case the post content is transmitted to that platform's API), or when sending transactional emails via the configured email provider.

5. Data Retention

• Account & social-platform data: retained for as long as your account exists.
• OAuth tokens: retained until you disconnect the social account or delete your account — whichever comes first.
• TikTok video list cache: refreshed on demand; not retained beyond the active session cache.
• Scheduled posts & drafts: retained until you delete them or your account is deleted.
• Server logs: automatically purged after 30 days.

To disconnect a TikTok account (and delete all associated tokens and cached data), go to Settings → Connected Accounts and click Disconnect. Your data will be removed from our database immediately.

To delete your account entirely, contact us at admin@13101993.xyz. We will permanently delete all personal data associated with your account within 30 days of your request.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. Data is shared only in the following limited circumstances:

• Social media platforms you connect — post content and OAuth tokens are transmitted to the respective platform API (e.g. TikTok) solely to perform the publishing action you requested.
• Oracle Cloud Infrastructure — our infrastructure provider. OCI processes data solely as a data processor under our agreement and does not use your data for its own purposes.
• Email provider (Resend, if configured) — your email address is shared only to deliver transactional messages you trigger (e.g. password reset).
• Legal obligation — we may disclose data if required to do so by law or in response to valid legal process.

No other third parties receive your data.

7. Cookies & Session Storage

We use only strictly necessary cookies:

• Session cookie — a signed JWT stored in a browser cookie to keep you logged in. Expires when your session ends or after the configured token lifetime.

We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.

8. Security Measures

• All traffic is encrypted in transit via TLS 1.2+ (Let's Encrypt certificate).
• Passwords are hashed with bcrypt; never stored or transmitted in plaintext.
• OAuth tokens are stored encrypted in the database.
• The server is not publicly accessible on unnecessary ports; database and Redis are not exposed to the internet.

9. Your Rights as a Data Subject (GDPR)

If you are located in the European Economic Area (EEA) or the UK, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten").
• Right to restriction (Art. 18) — request that we limit how we use your data.
• Right to data portability (Art. 20) — request your data in a machine-readable format.
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time (e.g. by disconnecting a social account). Withdrawal does not affect lawfulness of prior processing.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to lodge a complaint — you have the right to lodge a complaint with your national supervisory authority (e.g. the Bundesbeauftragter für den Datenschutz und die Informationsfreiheit in Germany, or the ICO in the UK).

To exercise any of the above rights, contact us at admin@13101993.xyz. We will respond within 30 days.

10. Children's Privacy

This Service is not directed at children under 13 (or 16 where applicable under local law). We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the email address on your account. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact & Data Requests

For all privacy-related enquiries, data access/deletion requests, or questions about this policy, please contact:

• Email: admin@13101993.xyz

← Back to Postiz