Privacy Policy

Last updated: October 5, 2026

1. Who is responsible

PostRunner is a service operated by Juan Limberg Hernández del Río, an individual based in Mexico («we», «us»). For any privacy matter, write to hernandezdelriojuan@postrunner.app.

2. What PostRunner does

PostRunner is a tool to prepare, schedule and publish original content on the social media accounts that you connect, and to measure how that content performs. It only acts on your own accounts and only with the permissions you grant.

3. Data we process

  • Your PostRunner account: username, email and password (stored only as a hash).
  • From each network you connect: the ID and name of the account or Page, and the access tokens the network gives us to act on your behalf.
  • What you publish with PostRunner: text, images and videos, their dates, and their metrics (reach, views, reactions, comments, shares).
  • Public comments on your posts, only if you turn on suggested replies (you approve every reply before it is posted).
  • Files you upload: videos, images, logos or product catalogs.

We do not process sensitive data or card payment data (any payments are handled by a third party).

4. Permissions we request from each network

  • Facebook: pages_show_list, pages_manage_posts, pages_read_engagement, business_management (to list your Pages, publish to them and read their metrics) and, if you turn on replies, pages_read_user_content and pages_manage_engagement.
  • Instagram (professional account linked to your Page): instagram_basic and instagram_content_publish.
  • Threads: threads_basic and threads_content_publish.
  • YouTube: youtube.upload (upload your videos) and youtube.readonly (see your channel and your videos' statistics).
  • TikTok: user.info.basic, video.upload, video.publish and video.list.
  • X and Bluesky: the credentials you create on those networks to post to your account.

5. How we use it

Only to provide the service to you:

  • Publish to your accounts what you approve or schedule.
  • Show you your posts and their metrics in the dashboard.
  • Learn, for your accounts only, which formats and times work best for you.
  • Notify you (by email or Telegram, if you turn it on) about pending approvals or errors.

We do not sell your data, use it for advertising, build profiles for third parties, or use it to train general-purpose artificial intelligence models.

6. Google and YouTube data

PostRunner uses YouTube API Services. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and your Google data is also governed by the Google Privacy Policy.

PostRunner's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to upload the videos you choose and to show you your channel's statistics; we do not share it with third parties except as strictly needed to operate the service (section 7), and no person reads it unless you ask us to for support or the law requires it.

You can revoke PostRunner's access to your Google account at any time from your Google Account permissions page. The YouTube statistics we store are refreshed or deleted within 30 days.

7. Who we share it with

Only with the providers we need to operate, and only what is strictly necessary:

  • The networks you connect (Meta, Google/YouTube, TikTok, X, Bluesky), when publishing to them.
  • Hosting: Vultr (servers in the United States).
  • Artificial intelligence providers (for example Anthropic, DeepSeek, OpenAI or Groq): they receive the text or transcript needed to draft a post or a clip. They never receive your passwords or access tokens.
  • Notifications: Telegram or the email provider (Resend), if you turn notifications on.

We may also disclose data when required by a competent authority under applicable law.

8. How long we keep it

  • Access tokens: while the network is connected. When you disconnect it, they are deleted.
  • Generated video clips: 3 days; then the file is deleted.
  • Post history and metrics: while you use the service (archived metrics, up to 1 year).
  • Encrypted backups: rotated every 7 days; there is also an encrypted disaster-recovery copy that is not used for any other purpose.

If you delete your account or ask us to, we delete your data within 30 days. See how to delete your data.

9. Security

Everything travels encrypted over HTTPS. The dashboard uses a protected (httpOnly) session cookie. Each workspace's API keys are stored encrypted, and the server is only accessible to the operator.

10. Your rights

You can request access to your data, its correction or deletion, object to its use, or withdraw your consent by writing to hernandezdelriojuan@postrunner.app. We reply within 20 business days. You can also export your data from the dashboard.

11. Cookies

We use a single cookie, your dashboard session, which is required for it to work. We do not use advertising or tracking cookies.

12. Children

PostRunner is not directed to anyone under 18 and we do not knowingly collect their data.

13. Changes

If we change this policy, we will update the date above and, for important changes, notify you in the dashboard or by email.