Privacy policy

The short version

PostGryphon stores what you write, the accounts you connect it to, and a log of whether each post went out. That is the whole product, and it is most of the data.

We do not sell it, we do not share it with advertisers, and there are no analytics or tracking scripts on any page. The cookies we set are the one that keeps you signed in, one remembering which brand you were last working in, and a short-lived one that guards a connect flow while it is in progress. None of them follow you anywhere.

We do not read your posts, and nobody here has a screen that shows other people’s accounts. Support access happens only when you ask for it and only for as long as it takes.

Who we are

PostGryphon is operated by Faelore Studios. You can reach a person about anything on this page at support@postgryphon.com.

For the purposes of the UK and EU GDPR, Faelore Studios is the data controller for your account, and you are the controller for anything you publish through it.

What we store

Everything below is a table in our database, and the list is generated from the code rather than written alongside it — a table this page does not describe fails our tests.

Your account

We store your email address, a display name, and the time zone your account defaults to. Your password is handled by Supabase Auth and is stored only as a hash — we never see it, and neither does anyone here.

To sign you in, to address mail to you, and to show times in a zone that means something to you.

How long: Until you delete your account.

Your brands

We store the name and time zone of each brand you set up, and a picture if you choose one. The picture is stored in a PUBLIC bucket — it is the logo you publish under, not a secret, and it is served from a stable link that anybody holding the link can open.

A brand is the container that keeps one set of social accounts and posts separate from another.

How long: Until you delete your account. There is no way to delete a single brand yet — if you need one removed, write to us and we will do it by hand. Removing a brand picture clears the link immediately; the file itself is swept with the rest of your storage when the account goes.

Connected social accounts

We store for each account you connect: the platform, your account id and username on it, your display name and avatar URL as that platform reports them, the permissions granted, and the access and refresh tokens the platform issued.

The tokens are the only way to publish on your behalf. They are encrypted with AES-256-GCM before they are written down, they are never sent to your browser, and they are never shown to you or to us in readable form.

How long: The tokens and the granted permissions are destroyed the moment you disconnect — the database does that on the status change itself, so it does not depend on which part of the code asked. The rest of the row (platform, account id, username, display name, avatar URL) is kept so your publishing history still says where each post went, and goes when you delete your account.

Posts you write

We store the text of each post, when it is scheduled for, and its status.

This is the thing the product is for.

How long: Kept so you have a record of what you published and when. Deleting a post deletes it here; deleting your account deletes them all.

Where each post goes

We store which connected accounts a post is aimed at, any per-platform options you set, and the id and link the platform returns once it is published.

To publish to the right places, and to link you back to the live post afterwards.

How long: Deleted with the post. Disconnecting an account leaves the record of what was sent to it, so your history does not develop holes, but the tokens it was sent with are gone.

Images and video you attach

We store the file itself, its type and size, its dimensions or duration, and any alt text you write.

To attach it to the post and hand it to the platform when the post goes out.

How long: Files live in a private bucket that is not readable without a signed, expiring link. Removing an attachment deletes the file. Deleting your account deletes them all — the bucket is swept before the account goes, so nothing is left behind that no query could find again.

The publishing log

We store for every attempt to publish: when it ran, whether it worked, and what the platform said back — up to the first few thousand characters of its reply, so a failure can be read rather than guessed at.

Silent failures are the reason this product exists. The log is what lets you see that a post did not go out, and why, rather than discovering it a week later.

How long: With the post. Error messages come from the platform and can quote the text of the post that was refused.

AI assistant tokens

We store if you connect an assistant such as Claude: a name you choose for the connection, a SHA-256 hash of the token, its first few characters so you can tell one from another, what it is allowed to do, and when it was last used. The token itself is shown to you once and never stored — we cannot recover it, and neither can anyone who reaches our database.

So an assistant can read your calendar and write drafts on your behalf, and so you can see which ones are connected and switch any of them off.

How long: Until you revoke it or delete your account. A revoked token is kept, with its name and those first few characters, so that if it turns up later in a log or a config file you can tell what it was and that it is already dead.

Your posting schedule

We store the days and times you have told us a brand posts at, and whether a time is reserved for one platform. Nothing else — a slot is a weekday and a clock time.

So that "next free slot" in the composer can put a post where that brand actually posts, instead of asking you to pick a date every time.

How long: Until you remove the time, or delete your account. They are settings rather than history: nothing keeps a record of a posting time you have removed.

Deletion requests from a platform

We store if you remove PostGryphon from your Facebook, Instagram or Threads account: the app-scoped id that platform sends us, which connected accounts were disconnected as a result, when it happened, and a random reference code. No name, no email, and no link to any other account is recorded.

Meta requires an app to accept deletion requests from the platform itself and to publish a page where the status of one can be checked afterwards. The record is how that page can still answer weeks later, and how a repeated request is recognised rather than counted twice.

How long: Kept, deliberately, after the deletion it describes is finished. It is the only evidence that the request was honoured — everything it refers to is gone by then — and it holds nothing that identifies you outside the platform that sent it.

Registered assistants

We store when an assistant connects to PostGryphon: the name it gives for itself, and the addresses it is allowed to be sent back to after you approve it. Nothing about you is in this record — it describes the software, not the person using it.

So the approval screen can tell you which assistant is asking, and so a request to send your approval somewhere that assistant never registered can be refused.

How long: Until the assistant is disconnected. The record is what makes a later connection from the same assistant recognisable rather than anonymous.

Approval codes

We store when you approve an assistant: a SHA-256 hash of the one-time code, which account it was for, which assistant asked, and what you agreed to. The code itself is never stored.

It is the two minutes between pressing Allow and the assistant being connected. It is recorded rather than deleted on use so that a code presented a second time — which means somebody else has a copy of it — can be detected and the whole connection revoked.

How long: Codes expire after two minutes and are cleared out a day later. A used one is worthless to anybody; it is kept only long enough to notice if it is presented again.

Your AI provider key

We store only if you paste one: an Anthropic API key, encrypted before it is stored, plus its last four characters so you can recognise it, and whether it worked the last time it was used.

So the composer can adapt a post for each platform using your own Anthropic account rather than ours. Nothing else reads it and it is never sent anywhere except to Anthropic, as the credential on your own request.

How long: Until you remove it or delete your account. It is never shown back to you — replacing it means pasting a new one — and there is no screen, log or export anywhere that contains it.

Adaptation usage

We store each time you use the adapt button: your account, which brand, how many platforms, which model, and the time. NOT the post text and NOT what came back.

To count the adaptations included with your account each month. Usage paid for with your own API key is recorded the same way but is not counted against anything.

How long: Kept while the account exists, so the monthly count can be worked out. It is a tally, not a copy of your writing — the words are deliberately not in it.

The access tokens, specifically

Connecting a social account gives us a token from that platform. It is the most sensitive thing here, so: it is encrypted before storage with a key that lives only in our server environment, it is decrypted only on our servers and only to talk to that platform on your behalf — publishing a post, refreshing the token, or applying a setting you changed — it is never sent to a browser, and it is destroyed the moment you disconnect the account.

We ask each platform for the narrowest permissions that let us publish and read back the result, and we do not ask for permission to read your direct messages or anyone else’s content. Two of the permissions platforms require for publishing are broader than what we use them for: Meta will not grant posting rights to a Page without also granting read access to that Page’s content and follower data, and YouTube’s upload permission comes alongside read access to the channel. We request them because publishing does not work without them, and we do not read either.

You can revoke our access from the platform’s own settings at any time without coming here first. The next publish attempt will fail and tell you why.

What goes to the social platforms

When a post publishes, its text and any attached media are sent to the platforms you chose. What happens to it there is governed by your relationship with them, not by this policy, and we cannot delete it for you afterwards — deleting a post here does not delete a post that has already gone out.

One detail worth knowing: several platforms will not accept an uploaded file and instead fetch media from a URL. Instagram, Threads, Facebook and TikTok all work this way. So an image or video sent to any of them is briefly readable at a signed, hour-long address on postgryphon.com while that platform collects it. The address names one file, cannot be edited into another, and stops working when the hour is up. It is not single-use — anyone holding the link can fetch that one file until it expires.

Who else touches it

Four companies. Three because the app runs on them, and one only when you ask it to:

All four are United States companies, and your data is stored and processed there. If you are in the UK or the EU, that is a transfer outside your own jurisdiction: it is covered by the standard contractual clauses in each of their data processing terms, linked above.

• Supabase — Hosts the database, the sign-in system and the file storage. All of the above lives there.
• Cloudflare — Runs PostGryphon itself and serves the pages you are reading. Every request to this app passes through them.
• Resend — Sends the mail that tells you a post failed overnight. It sees your email address, your display name, and the reason the post did not go out.
• Anthropic — Adapts a post for each platform, when you press the adapt button. It sees the text of that post and nothing else — not your email address, not your account, not your other posts. It never runs on its own and never runs when publishing.

How it is kept

Every table is protected by row-level security in the database itself, so a query for another account’s rows returns nothing even if the application asks for them. That is enforced by the database rather than by our code being careful, and it is attacked by a test suite that signs in as a real user and tries.

Media files sit in a private bucket with no public address. The one exception is deliberate and temporary: platforms that collect media by fetching a URL are given a signed link that names one file and stops working after an hour. See the section on what goes to the social platforms.

Tokens and any other secret are encrypted at rest. Traffic is HTTPS everywhere.

No system is beyond reach. If we ever discover a breach affecting your data we will tell you what happened and what was in it, without waiting to have a fix.

What you can ask for

You can see everything we hold about you from inside the app — it is your posts, your accounts and your brands, and there is no hidden profile behind them.

You can correct anything wrong, or delete the lot. Deleting your account removes your brands, posts, media and tokens; it happens straight away and is not reversible. Backups roll off within 30 days. There is no one-click export yet — ask, and we will send you your data.

If you are in the UK, the EU, California or anywhere with equivalent rules, those rights are yours by law and you do not have to explain why you are exercising them. Write to support@postgryphon.com and we will do it within 30 days. If we get it wrong you can complain to your data protection regulator.

Age

PostGryphon is not for children. You must be at least 16, or 13 with a parent or guardian’s permission where your country allows it. We do not knowingly hold data about anyone younger, and we delete it if we find it.

Changes

If this policy changes in a way that affects what we do with your data, we will email you before it takes effect rather than quietly changing the date at the top.