Privacy Policy
Last updated October 25, 2026
PostClock lets you publish short videos and posts to your own Instagram, Threads, TikTok and YouTube accounts. PostClock is operated by Cosmo Labs Private Limited (“we”, “us”). This policy explains what data we collect, why, how long we keep it, and how you can remove it.
1. Data you give us
- Your email address and password when you create a PostClock account. Passwords are stored only as a hash.
- The videos, images, titles and captions you upload, and the time you choose to publish them.
- Workspace settings, such as API keys you create and webhook addresses you enter.
2. Data we receive from Instagram, Threads, TikTok and YouTube
When you connect a social account, you sign in on that platform’s own page. We never see your password. The platform then sends us only the data in the table below.
| Platform | What we receive | Permissions we ask for |
|---|---|---|
| Instagram (Meta) | Your professional account ID and username; an access token; for posts published through PostClock, the media ID and view, like and comment counts. | instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights |
| Threads (Meta) | Your Threads user ID and username; an access token; for posts published through PostClock, the post ID and view, like and reply counts. | threads_basic, threads_content_publish, threads_manage_insights |
| TikTok | Your TikTok open ID and display name; an access token; when you post, your creator settings (nickname, allowed privacy levels, comment, Duet and Stitch settings, maximum video length); for videos published through PostClock, view, like and comment counts. | user.info.basic, video.publish, video.list |
| YouTube (Google) | Your channel ID, channel name and handle; an access token and a refresh token; for videos uploaded through PostClock, the video ID and view, like and comment counts. | youtube.upload, youtube.readonly |
We do not receive or store your followers, direct messages, or content you did not publish through PostClock.
PostClock uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. PostClock’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. How we use this data
- To publish the content you choose, to the accounts you choose, at the time you choose.
- To show you whether each post was published and how it performed.
- To show the TikTok posting options your account allows, as TikTok requires.
- To keep the service secure and to answer your support requests.
We do not sell your data. We do not use it for advertising. We do not use your content or platform data to train AI models. We do not share platform data with any third party except the service providers in section 5, who process it only for us.
4. How we protect it
All traffic uses HTTPS. Access tokens are encrypted (AES-256-GCM) before they are stored. Only the PostClock server can read the database; browsers cannot read it directly.
5. Service providers
- Supabase (database, sign-in and file storage, United States).
- OVHcloud (application server, Canada).
- Cloudflare (domain name service).
6. How long we keep data
- Access tokens: until you disconnect the account, or the platform revokes access. Disconnecting deletes the token at once.
- Account IDs, usernames and post results: while your PostClock account exists.
- Uploaded media and captions: while your PostClock account exists, or until you delete them.
- When you delete your PostClock account, we delete all of the above within 30 days.
- Server logs: up to 30 days.
7. Disconnect and delete
- Disconnect an account: in PostClock, open Connections and choose Disconnect. We delete the access token immediately.
- Remove access on the platform: Instagram: Settings → Apps and websites. Threads: Settings → Account → Website permissions. TikTok: Settings and privacy → Security → Manage app permissions. YouTube: remove PostClock at myaccount.google.com/permissions. When Meta tells us you removed PostClock, we delete the token, ID and username for that account.
- Delete everything: follow the steps on our Data deletion page, or email support@postclock.social from your account email.
8. Your rights
You can ask to see, correct or delete your personal data, and you can withdraw consent at any time by disconnecting your accounts. This includes your rights under India’s Digital Personal Data Protection Act, 2023 and, where they apply, the GDPR and US state privacy laws. Email support@postclock.social. We answer within 30 days. Our grievance contact for India is the same address.
9. Children
PostClock is not for anyone under 18. We do not knowingly collect data from children.
10. Changes
We will post any change on this page and update the date above. If a change is significant, we will email account holders before it takes effect.
11. Contact
Cosmo Labs Private Limited, support@postclock.social