freepost
Log In
Privacy

Privacy policy

What we collect, why, who receives it, and your choices.

Last updated 2026-11-07

Freepost is a content operations workbench: you connect your social media accounts, write and adapt posts, schedule and publish them, keep a media library, and use an AI assistant to help with that work. This Privacy Policy explains what personal information we collect when you use Freepost — the website, the app, the browser extension, and the API and MCP access (together, the “Services”) — how we use it, and the choices you have.

This Policy does not cover personal information that you choose to process through the Services on your own behalf or on behalf of others — the people who appear in your posts and media, and the content of the accounts you manage. For that information you are the controller, and our role is that of a processor acting on your instructions.

Personal information we collect

Information you give us

  • Account details — your name, email address and password when you create an account, and the preferences you set (time zone, language, theme, notification settings). We email you a link to verify the address or to reset the password.
  • Workspaces and team — the names of your workspaces, their members and roles, and the email addresses of the people you invite.
  • Connected social accounts — when you connect an account, we keep what we need to publish as that account: the account’s identifier, username and display name as the platform reports them, and its signed-in session. You connect an account in one of these ways:
    • Hosted sign-in — you sign in on the platform’s own page, inside a browser we run for that account alone, by scanning the platform’s QR code or using its sign-in form in a live view. What you type there is passed to that page and is not recorded. The resulting session — the site’s cookies and local storage — is kept in that account’s browser profile on our publishing service.
    • Browser extension — the extension reads the platform’s cookies from a tab where you are already signed in and sends them to us, where they are stored encrypted.
    • Official API — for platforms that offer one, the access token the platform issues, stored encrypted.
    We never ask for your platform password and do not store it.
  • Proxies — the address and credentials of any proxy you add for an account. They are stored encrypted and used only to route that account’s traffic.
  • Content — your drafts and posts, their schedules and target accounts, your automation rules, and the images and videos you upload. Uploaded media files are stored on our servers and are shown only to signed-in members of the workspace they belong to.
  • Assistant conversations — the messages you send the AI assistant and its replies, kept as your chat history.
  • AI generation requests — when you generate images or videos, the prompt you write, the library images you choose as references and the settings you pick, kept with what they produced. Generated files are marked as AI-generated in your media library.
  • API keys — workspace API keys for programmatic and MCP access. A key is shown once when you create it; we keep only a hash of it.
  • Correspondence — what you send us when you contact us.

Information from third-party sign-in

If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider to authenticate you. We ask Google only for your basic profile and email address, and GitHub only for read access to your profile and email addresses. What the provider shares depends on your settings there.

Comments on your posts

On platforms where Freepost reads comments, we read the comments people leave on a connected account’s posts — the commenter’s name, the address of their profile picture, and what they wrote — through that account’s own session, to show them in your workspace’s comment inbox. We keep a comment for 180 days after it was posted, and delete an account’s comments when you disconnect it. Profile pictures are shown from the platform, not copied. A reply is posted only after a member of your workspace writes or approves it.

Information collected automatically

  • Publishing records — for every post and target account: each attempt, its outcome, the platform’s post identifier and any error. We also check connected accounts periodically to see whether their sessions still work, and record the result.
  • Security records — the IP address and browser user agent of each signed-in session, and the IP address of requests, used to keep you signed in safely and to rate-limit sign-in and other requests.
  • Cookies — a session cookie (httpOnly) that keeps you signed in for up to seven days and is renewed while you use the Services; short-lived cookies during a Google or GitHub sign-in; freepost-locale, your language choice, for a year; freepost-active-workspace, the workspace you selected; and freepost-workspace-invite, which carries an invitation through sign-up for up to 72 hours. We set no cookie for visitors who are not signed in.
  • Preferences in your browser’s local storage — your theme, the state of the sidebars, the workspace you selected, and a post you were composing but have not yet saved. These stay on your device and are not sent to us.

We do not use analytics services, advertising trackers, web beacons or fingerprinting on the Services. When something fails, an error report is sent to our error monitoring provider, as described under “Who receives personal information”.

How we use personal information

  • To operate the Services — to create and secure your account, connect your social accounts, publish and schedule your posts and show you what happened to each one, run the AI assistant, and send you the messages the Services need to send: address verification, password resets and workspace invitations.
  • To bill you, when paid plans are enabled — to manage your subscription and enforce your plan’s limits.
  • To keep the Services safe — to rate-limit requests, detect abuse, and protect connected accounts and their credentials.
  • To comply with law and protect rights — to respond to lawful requests and to make or defend legal claims.

We do not use your posts, media, connected accounts or conversations to train models. We do not send marketing email.

Who receives personal information

  • The social platforms you publish to — they receive the content you publish and, like any site you use, the requests made by that account’s browser session or API client.
  • The AI model provider — to answer you and to prepare drafts, the assistant sends the model provider the Services use your messages, the names, usernames and status of the workspace’s connected accounts, the text of its recent posts, and the results of the tools it uses (for example the posts and schedules it looks up). When you, or a reply rule you set up, ask for comment triage or a reply suggestion, it also receives the comments’ text and commenters’ names and the text of the post they are on. The provider’s terms govern its handling of that data.
  • The image and video generation provider — when you generate media, your prompt and any reference images you chose are sent to Google’s Gemini API, which creates the result. We use Google’s paid service, under whose terms Google does not use them to improve its products; once the result is stored we delete the request from Google’s side. Google’s terms govern its handling of that data.
  • Proxy providers — when an account uses a proxy, that account’s sign-in and publishing traffic passes through the proxy you configured.
  • Our cloud device provider — when an account runs on a cloud phone, the phone is hosted by this provider: the account’s sign-in in the platform’s app (including a username and password, if you ask Freepost to sign in for you), the posts and media published from it, and its network traffic pass through the provider’s systems. Freepost does not store the password.
  • Our email delivery provider — your email address and the messages listed above, in order to deliver them.
  • Our error monitoring provider — when the Services fail, a report is sent to Sentry, in the United States, so that we can find and fix the fault. A report holds the error and where in our code it happened, the address of the page or request with tokens and passwords removed, and identifiers such as a workspace or post id; request bodies and cookies are never included, though an error message can quote a fragment of the data that caused it. A report sent from your browser also carries your browser, operating system, device type, language and time zone, and a short trail of what happened in the page before the error (pages opened, elements clicked, the addresses of requests made). Sentry sees the IP address a report arrives from and keeps an approximate location derived from it. We do not record your screen or your sessions, and we do not measure page performance.
  • Our payment processor, when paid plans are enabled — it handles your payment details; we do not receive or store your card number.
  • Infrastructure providers — the hosting, database and file storage on which the Services run.
  • Professional advisors and authorities — where necessary for legal, compliance or safety purposes, and a successor in a business transfer.

We do not sell personal information and do not share it for advertising.

Your rights and choices

  • Access and correction — your name, email, time zone, language and notification settings are in Settings; your workspaces, accounts, posts and media are in the app.
  • Deletion — you can delete posts and media, disconnect social accounts and delete workspaces in the app. Disconnecting an account erases its stored credentials and its browser profile. You can delete your account from Settings: deletion takes effect after 30 days, during which you can cancel it, and then your account and the workspaces you own are erased. Deleting a workspace or your account does not yet erase the browser profiles of accounts that are still connected; disconnect those accounts first, or contact us.
  • Portability — you can download a copy of your data as a JSON file from Settings.
  • Depending on where you live, you may also have the right to object to or restrict processing, to withdraw consent, and to complain to a data protection authority.

Security

Platform credentials and proxy credentials are encrypted at rest. Browser profiles are kept on our publishing service, which is not reachable from the internet. API keys are stored only as a hash, and passwords are hashed. Access to a workspace is limited to its members by role. No transmission or storage is perfectly secure, and we cannot guarantee that it is.

Retention

We keep your account and workspace data for as long as your account exists and for as long as we need it to provide the Services, resolve disputes, keep the Services secure and meet legal obligations. Publishing records are kept as the workspace’s history. When you delete your account, it is erased at the end of the 30-day period described above.

Where we process data

Our servers are located in the United States. Some of the providers listed above process data in other countries.

Children

The Services are not directed to children under 13. If we learn that we hold personal information from a child without the consent required by law, we will delete it.

Changes

We may update this Policy. When the changes are material we will update the date above and notify registered users at the email address on their account.

Contact

Responsible entity: [TO BE CONFIRMED]

Privacy requests: privacy@freepost.io

Privacy policy — Freepost