Privacy Policy

**Last updated:** June 5, 2026

1. Introduction

This Privacy Policy explains how PostWave ("we", "us") collects, uses, stores, and shares information when you use our website and scheduling service. By using PostWave, you agree to the practices described here.

2. Information We Collect

**Account information**

Email address, password (stored as a one-way hash), timezone, and subscription plan.

**X connection data**

X user ID, username, and OAuth access and refresh tokens (encrypted at rest).

**Content you provide**

Post text, scheduled times, draft posts, and images you upload for Pro scheduling.

**Usage and operational data**

Number of posts scheduled and published, job status, failure logs, and retry history.

**Payment information**

Billing is handled by Stripe. We store your Stripe customer ID and subscription status; we do not store full card numbers.

**Technical data**

IP address, browser type, device information, and standard server logs used for security and debugging.

3. How We Use Information

We use your information to:

Provide the scheduling service and publish posts to X at your requested times.

Authenticate you and maintain your session.

Process subscriptions, invoices, and plan limits.

Send transactional emails (e.g., publish failures, account notices).

Monitor abuse, enforce our Terms, and protect the Service.

Improve reliability and fix bugs.

Comply with legal obligations.

We do not use your data for third-party advertising or sell your personal information.

4. Legal Bases (EEA/UK Users)

Where GDPR applies, we process data based on: performance of our contract with you (providing the Service), legitimate interests (security, improvement, fraud prevention), and consent where required (e.g., optional communications).

5. How We Share Information

We share data only as needed to operate the Service:

**X (Twitter):** To publish posts and manage OAuth on your behalf.

**Stripe:** Payment processing and subscription management.

**Resend (or similar):** Transactional email delivery.

**Infrastructure providers:** Reputable hosting, database, and background-processing providers that run the Service on our behalf under data-protection agreements.

We may disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition, with notice where legally permitted.

6. Data Retention

Account data is kept while your account is active.

Scheduled post content is deleted when you delete individual posts or your entire account.

OAuth tokens are removed when you disconnect X or delete your account.

Logs and backups may be retained for a limited period for security and disaster recovery, then deleted or anonymized.

7. Security

We use industry-standard measures including encryption in transit, salted password hashing, and authenticated encryption for OAuth tokens at rest. No method of transmission or storage is 100% secure; contact us if you suspect unauthorized access.

See our Security page for more detail.

8. Your Rights and Choices

Depending on your location, you may have the right to:

Access, correct, or delete your personal data.

Export your data.

Object to or restrict certain processing.

Withdraw consent where processing is consent-based.

Lodge a complaint with a supervisory authority.

You can delete your account in Settings or email [email protected]. We will respond to verified requests within a reasonable timeframe as required by law.

9. Cookies and Similar Technologies

We use essential session cookies for authentication. We do not use third-party advertising or tracking cookies. You can control cookies through your browser settings; disabling them may prevent login.

10. International Transfers

Your data may be processed in the United States or other countries where our providers operate. We take steps to ensure appropriate safeguards where required by law.

11. Children

PostWave is not directed at children under 13. We do not knowingly collect personal information from children under 13. Contact us to request deletion if you believe we have collected such data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. Continued use after changes constitutes acceptance where permitted by law.

13. Contact

Privacy questions or requests: [email protected]