Privacy Policy

Effective 9 October 2026

Postrova (postrova.app) is a social media planner: it lets you schedule and publish posts to your own social media accounts and see how they perform. Postrova is operated by Parth Hingu, an individual based in India ("we", "us"). This policy explains what information Postrova handles, why, who else sees it, how long it's kept, and the choices you have.

1. Information we collect

Your Postrova account

• Your email address and a password (stored only as a one-way hash), your workspace's name, and when you signed up, confirmed your email and last logged in.
• If you're in a workspace with other people (a team), they see your email address, your role, and what you do there (in the activity log and on the posts you write or approve).
• An activity log of changes in your workspace (for example "scheduled a post", "connected an account", "logged in") and what happened in the background (posts published or failed), so you can see what changed and what went wrong.

What you create in Postrova

• The posts you write: text, titles, tags, the photos and videos you upload, the accounts and times you choose, and drafts.
• Settings you choose, such as the AI writer or vidIQ keys you add (stored encrypted).

From the social networks you connect

When you connect an account, you sign in on the network's own page and choose what Postrova may access. Depending on the network, Postrova receives and stores:

• Access tokens that let Postrova act for you (stored encrypted with AES-256-GCM).
• Account details: the account's or channel's ID, name, username and profile picture.
• Your posts on that account: IDs, links, text and thumbnails of your recent posts and videos, including YouTube videos that are private or scheduled, so they can appear on your calendar.
• Statistics: followers, views, reach, likes, comments, shares and similar insights for your account and posts, and YouTube Analytics reports for your channel (such as watch time, traffic sources and audience age, gender and country, which YouTube provides only in aggregate).

Postrova only reads and posts to the accounts you connect and choose. It does not read your private messages, and it never posts anything you haven't scheduled.

Technical information

• One cookie (pp_session), which keeps you logged in. It's necessary for the service; we use no other cookies.
• Your browser also keeps a few display preferences (such as your calendar view) in its own storage, on your device only.
• Your IP address is used briefly, in memory, to limit repeated login attempts. We don't store it.
• If something in the app crashes, an error report (the error, the page or route, and your user number) is sent to our error-monitoring service. It doesn't include your posts, passwords or email.

2. How we use it

• To provide Postrova: save your posts, publish them at the times you choose to the accounts you choose, retry when a network fails, and show your calendar, activity and analytics.
• To keep your account secure: log you in, send confirmation and password-reset emails, and detect problems.
• To keep the service running: monitor errors and performance, and make backups.
• To contact you about your account or important changes to Postrova.

We don't sell your information, use it for advertising, or use your social media data for anything other than providing Postrova's features to you.

3. YouTube

Postrova uses YouTube API Services to upload videos and Shorts to your channel, schedule and edit your videos, list your channel's videos and playlists, post a first comment you write, and show your YouTube Analytics. By connecting YouTube to Postrova, you agree to be bound by the YouTube Terms of Service. Google's use of information is described in the Google Privacy Policy.

• You can disconnect YouTube in Postrova (Connections → Disconnect) at any time. Postrova then revokes its access with Google immediately and deletes the YouTube data it stored for that channel.
• You can also remove Postrova's access from your Google account's security settings page. Postrova regularly checks that its access still works; if it was removed, Postrova deletes the YouTube data it holds for that channel within 30 days.
• YouTube data Postrova keeps for display (such as your videos' titles and thumbnails) is refreshed or deleted within 30 days. Statistics are kept so you can see your history, while your channel stays connected.

4. Facebook and Instagram

Postrova uses Meta's APIs to publish to the Facebook Pages and Instagram professional accounts you choose and to read their insights. You can disconnect them in Postrova at any time, or remove Postrova in Facebook (Settings & privacy → Settings → Business integrations). When you remove Postrova in Facebook, Meta tells us and we delete the Facebook and Instagram data we hold for you; you can check the status on our data deletion page.

5. Who else processes your information

We use these service providers to run Postrova. Each processes information only to provide its service to us.

We may disclose information if the law requires it, or to protect Postrova, its users or others from fraud or abuse.

6. How long we keep it

• Your account and posts: until you delete them or your account.
• Uploaded videos: deleted from our server once every post using them has been published. Photos stay with their post as its preview; once you delete the post, they're deleted within a day, as are uploads never used in a post.
• Connected accounts and their data: until you disconnect the account; YouTube data as described in section 3.
• Activity log: 90 days.
• Backups: 14 days on our server and 30 days off-site, then deleted.
• When you delete your account: removed from our database at once, and from backups within 30 days.

7. Security

Connections use HTTPS. Access tokens and API keys are encrypted at rest. Passwords are stored only as salted hashes. Each customer's data is kept apart in the database by row-level security. Backups are encrypted before they leave our server. No system is perfectly secure, but we work to protect your information and will tell you about a breach that affects you as the law requires.

8. Your rights and choices

• Access and correction: see and change your information in Postrova, or ask us.
• Deletion: delete your account yourself in Settings → Delete account, or see the data deletion page.
• Withdraw consent: disconnect any account in Postrova, or remove Postrova's access from the network's settings.
• Grievances: under India's Digital Personal Data Protection Act, 2023, you can raise a grievance with us (contact below); we'll respond within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India.
• If you're in the EU, UK or a similar jurisdiction, you also have the rights to data portability, to object to and restrict processing, and to complain to your data protection authority. We process your information to provide the service you asked for (contract) and, for security and service monitoring, for our legitimate interests.

9. Where your information is stored

Postrova's servers and backups are in the United States. By using Postrova you understand your information is transferred there; we rely on our providers' standard safeguards for such transfers.

10. Children

Postrova is not meant for anyone under 18, and we don't knowingly collect information from them. If you believe a child has an account, contact us and we'll delete it.

11. Changes

If we change this policy, we'll update the date above and, for important changes, tell you by email or in the app before they take effect.

12. Contact

For privacy questions, requests or grievances, write to Parth Hingu, Postrova's operator and grievance officer, at support@postrova.app.