← Back to PostPilot

Privacy Policy

Last updated: July 22, 2026

PostPilot ("we", "us") provides an AI-powered social media management service that generates, schedules, and publishes posts to Facebook Pages on behalf of business owners. This policy explains what data we collect, why we collect it, and how it is stored and used.

Information we collect

  • Account information: your email address and authentication details, managed via Supabase Auth.
  • Facebook data: when you connect a Facebook Page, we receive your Page name, Page ID, and a Page access token (via Facebook Login and the Graph API), scoped to the permissions you approve (pages_manage_posts, pages_read_engagement, pages_show_list).
  • Content you create or generate: captions, hashtags, images, and scheduling data for your posts.
  • Usage data: basic application logs needed to operate the service (e.g. cron job activity, error messages).

How we use your information

  • To publish posts to your connected Facebook Page(s) on the schedule you set.
  • To generate post content: caption and hashtag text is generated using AI providers (currently Groq), and post text you request may be sent to these providers to produce a response.
  • To operate account features such as usage limits, the calendar view, and post history.
  • To communicate with you about your account (e.g. token expiry, publishing failures).

Where your data is stored

Your account data, connected Page details, and post content are stored in Supabase (hosted in London). Facebook Page access tokens are encrypted (AES-256-GCM) before being stored and are never exposed to the browser. Generated images are stored in Supabase Storage.

Cookies

We use essential cookies to keep you signed in (via Supabase Auth session cookies) and to complete the Facebook connection flow securely (a short-lived CSRF state cookie). We do not use advertising or tracking cookies.

Data deletion

You can disconnect your Facebook Page at any time from your dashboard, or request full account deletion. See our Data Deletion page for instructions.

Third parties

We share data only with the service providers necessary to run PostPilot: Meta/Facebook (Graph API, to publish your posts), Groq (AI text generation), and Supabase (database, auth, and file storage). We do not sell your data.

Contact

Questions about this policy? Email us at support.postpilot@gmail.com.