Privacy Policy

Postiz Bumeran — last updated 2026-05-10

1. Overview

Postiz Bumeran ("the Service") is a self-hosted instance of the open-source Postiz social media scheduling tool operated privately at https://postiz.bumeran.dev. This policy describes what data the Service collects, how it is used, and how it is protected.

2. Operator and scope

The Service is operated by a single private operator for personal and small-team use. It is not offered to the public. Only explicitly invited users have access.

3. Data we collect

The Service collects only the data necessary to operate as a social media scheduler:

• Account information. Email address and hashed password for operator/team login.
• Connected platform data. When the operator connects a social platform (e.g. TikTok), the Service receives and stores: platform-issued access_token, refresh_token, public profile fields (open_id, display_name, username, avatar_url), and any token expiry metadata. No private messages, follower lists, or analytics beyond the operator's own posts are collected.
• Scheduled posts. Caption text, media files uploaded by the operator, target platform, and scheduled date/time.
• Operational logs. Standard server logs (timestamp, request path, status code) used only for debugging. No third-party analytics or trackers are loaded.

4. How data is used

Stored data is used exclusively to:

• Authenticate the operator into the Service.
• Display the connected social profiles in the dashboard.
• Publish content to the connected platforms at the operator's request, via each platform's official API.

Data is never sold, shared with advertisers, or used for any purpose beyond the operator's direct requests.

5. Storage and security

All data is stored in a PostgreSQL 17 database running on infrastructure controlled by the operator. OAuth tokens are encrypted at rest using a secret key stored in environment variables on the host. Database access is restricted to the application container; no external connections are accepted. Public access to the dashboard is mediated via Cloudflare Tunnel with TLS termination.

6. Third-party services

The Service communicates with the official APIs of the social platforms the operator chooses to connect. Each platform processes data according to its own privacy policy:

• TikTok — tiktok.com/legal/privacy-policy
• X (Twitter), LinkedIn, Meta (Facebook/Instagram/Threads), Google (YouTube), Discord, Slack, Mastodon, Pinterest, Reddit, GitHub — see each platform's privacy policy.

The Service does not load any third-party tracking pixels, advertising networks, or analytics scripts.

7. Data retention and deletion

The operator can disconnect any platform integration from the dashboard, which deletes the associated OAuth tokens and profile cache from the database. The operator can delete their account at any time, removing all scheduled posts and platform connections.

8. Cookies

The Service uses one essential cookie for session management (a signed JWT). No tracking or advertising cookies are set.

9. Contact

For questions about this privacy policy or to request data deletion, contact the operator at kuamatzin@gmail.com.