Last updated: October 20, 2026
Postflare is open-source social media scheduling software. This Postflare instance at social.aiexplorerapp.com is run by its operator (“the operator”), who decides who may use it. This policy explains what this instance collects about the people who use it (“users”), why, who else receives it, how long it is kept and how to have it deleted.
Each Postflare instance is run independently by its operator, who is responsible for the personal data it processes. The authors of the Postflare software do not receive any data from this instance.
Postflare sets one cookie, the sign-in session cookie, which is needed for the service to work. It uses no advertising or analytics trackers, and no data is collected from people who only view posts you publish.
This data is used only to provide the service: to sign you in and keep your account secure, publish the posts you schedule to the accounts you connected, refresh their access tokens, show you and the members of your workspace the posts' status and performance, send the emails and notifications you expect (sign-in links, invitations, sign-up confirmations, decisions on access requests, publishing results), and prevent abuse. It is not sold, not shared with third parties except as described below, not used for advertising and not used to train AI models.
If you connect an AI assistant or another tool to your workspace through an API key or MCP, that tool can read and change your workspace's data on your behalf; it is your choice and that tool's provider handles the data under its own terms.
Legal bases (where the GDPR, the UK GDPR, Türkiye's KVKK or similar laws apply): providing the service you asked for (contract); keeping it secure, preventing abuse and reviewing access requests (legitimate interests); connecting accounts and push notifications, which you can withdraw at any time (consent); and keeping records the law requires (legal obligation).
When you connect a TikTok account, Postflare uses TikTok's Login Kit and Content Posting API with the scopes below, each only for the purpose listed:
user.info.basic: your TikTok open id, display name and avatar, to show which account is connected.user.info.profile: your username (and profile link), shown in Postflare and used to link to your published posts.video.publish: to publish the videos and photos you schedule directly to your profile with the caption, privacy level (“who can view”), comment, duet and stitch settings and commercial content disclosure you choose. Before posting, Postflare reads your creator info (the privacy options and maximum video length TikTok allows for your account) to offer only valid choices.video.upload: to send videos and photos to your TikTok inbox as drafts instead, when you choose that mode, so you finish the post in the TikTok app.video.list and user.info.stats, only when the operator has turned on TikTok analytics for this instance: the view, like, comment and share counts of the posts published through Postflare (looked up by their ids only), and your account's follower, following, like and video counts, to show you their performance.Videos are uploaded to TikTok from this instance's storage; for photo posts TikTok downloads the images from this instance's media links. Postflare does not read your direct messages, comments, followers, other videos or anything else in your TikTok account. TikTok business accounts connected through the TikTok API for Business (“TikTok Business”) use that API's equivalent scopes (user.info.basic, user.info.username, user.info.stats, video.list, video.upload, video.publish) for the same purposes.
What is stored: the encrypted access and refresh tokens, the profile information above, the posts you scheduled with TikTok's publish ids and post ids, and their metrics. TikTok data is not sold, not shared with third parties, not used for advertising and not used to train AI models; it is shown only to you and the members of your workspace. Your use of TikTok remains subject to TikTok's Terms of Service and Privacy Policy.
To revoke access, open the TikTok app and go to Profile → Menu (☰) → Settings and privacy → Security → Manage app permissions, then remove this app. Postflare then can no longer post or read anything, and the account shows as needing a reconnect. To delete the data stored here, remove the account in Postflare (Accounts → the account → Remove): this deletes its tokens, profile data, posts scheduled for it and their metrics at once. Posts already published stay on TikTok until you delete them there. You can also ask the operator of this instance to delete everything.
When a user connects an Instagram professional account, a Threads profile or a Facebook Page, Postflare uses Meta's APIs only to publish the posts, reels, carousels and stories the user schedules to that account, post the first comment or reply the user wrote for them, and read the account's basic profile (id, username, name, profile picture, account type) to show which account is connected. It reads insights (such as views, reach, likes, comments, shares and follower counts) of posts published through Postflare and of the account, to show the user their performance. Postflare does not read direct messages, does not read or reply to other people's comments, and does not access accounts the user did not connect. Meta data is not sold, shared with third parties, used for advertising, or used to train AI models; it is shown only to the user and the members of their workspace. Removing the app in Facebook, Instagram or Threads settings (Apps and websites) makes Meta ask this instance to delete the data automatically.
When a user connects a YouTube channel, Postflare uses the YouTube Data API only to upload videos the user chooses to the user's own channel, set their title, description, privacy, playlist and thumbnail, and post a first comment. It reads the list of the user's channels, playlists and video categories to offer these choices, and the view, like and comment counts of videos published through Postflare and the channel's subscriber and video counts to show the user their performance. Postflare's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, shared with third parties, used for advertising, or used to train AI models. Postflare uses YouTube API Services: by connecting a channel you also agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. Access can be revoked at any time at myaccount.google.com/permissions.
For every other platform you connect (for example X, LinkedIn, Bluesky, Pinterest or Reddit) the same rules apply: Postflare uses its official API only to read your basic profile, publish what you schedule and read the performance of those posts and of the account.
When data is processed outside your country (for example in the United States), these providers protect it under their data processing terms, including the EU Standard Contractual Clauses where applicable.
Data is stored on Cloudflare infrastructure (Workers, D1 and R2) and sent over HTTPS. Access tokens are encrypted at rest; passwords, API keys, sessions and invitation and sign-in links are stored only as hashes. Workspaces are isolated from each other and members only get the permissions of their role. Media files are served through long, unguessable links, because the platforms must be able to download them; anyone who has such a link can open the file.
You can access, correct, export and delete your data, restrict or object to its processing, and withdraw your consent at any time. Much of this you can do yourself: change your name and password in your profile, remove connected accounts, delete posts and media, and delete a workspace you own. For anything else, including a copy of your data, deleting your user account or correcting information, contact the operator of this instance; requests are answered within 30 days. You can also complain to the data protection authority where you live.
Disconnecting an account in Postflare deletes its stored tokens and profile data. You can also revoke Postflare's access at any time from the connected platform's own settings (for TikTok: Settings and privacy → Security → Manage app permissions; for Facebook, Instagram and Threads: Apps and websites, after which Meta asks this instance to delete your data automatically). See Data Deletion for the details and to check the status of a deletion request.
This instance is not meant for children: you must be at least 16 years old to use it. The operator does not knowingly collect personal data of children under 13 (under 16 in the EEA and the UK). If you believe a child has given us personal data, contact the operator of this instance and it will be deleted.
This policy may be updated; the date above shows the latest version. Material changes are announced to users (for example by email) before they take effect.
For questions about this instance or to have your data deleted, contact its operator.