Security & Privacy

Postopus connects to LinkedIn and X (Twitter) using each platform's official OAuth 2.0 authorization flow. You are redirected to LinkedIn or X, you grant specific permissions, and those platforms return an access token to us. We never see your password, and we never ask for it.

OAuth access tokens are stored encrypted in Supabase Vault. They are:

• Never logged to application logs.
• Never included in API responses sent to your browser.
• Never shared with third-party services (analytics, error trackers, etc.).
• Read only by our backend functions that act on LinkedIn and X for you: publishing, and on X also metrics, imports and @mention lookups.

Postopus publishes content only when you schedule a post, press “Publish now,” or turn on auto-repost for a post. There are no engagement bots and no automations you did not set up. AI drafts stay in the editor until you publish them. If a scheduled post fails to publish, Postopus retries a limited number of times, then marks it failed and notifies you.

You can disconnect any connected account at any time from Social Accounts inside the Postopus app. Postopus revokes its access at LinkedIn or X and deletes the stored token. You can also revoke access directly from your LinkedIn or X security settings, and our access ends when you do.

You can delete your account yourself from Settings → Danger zone, with no support ticket. Deletion revokes our access to your connected accounts and deletes their stored tokens, your media, and the workspaces you own with their posts, drafts and metrics, then your account. If you own a workspace that has other members, transfer it or delete it first. Owners and admins can export a workspace's data any time from Settings → Your data, and you can always email privacy@postopus.com for anything else.

Postopus is operated by Concealed, Lda., a company registered in Portugal (EU). We are subject to the GDPR and Portuguese Law No. 58/2019. Our legal basis for processing your data is the performance of the contract you enter into when you create an account. We do not sell your data. We do not use your content to train machine-learning models.

As an EU/EEA resident you have the right to access, correct, export, and delete your data, and to object to certain processing. Contact us at privacy@postopus.com to exercise any of these rights.

We use a small number of sub-processors to operate the service:

• Supabase: database, authentication, encrypted vault (EU region).
• Vercel: hosting for the app and this website.
• Polar.sh: billing and subscription management.
• Sentry: error monitoring (no personal data in payloads).
• Cloudflare R2: storage for the media you upload.
• Resend: transactional email.
• xAI, OpenAI and Anthropic: AI writing features.

We share your content with a sub-processor only as far as the feature you use needs it: for example, an AI provider receives your draft when you ask Tako for help, and LinkedIn or X receives the post you publish.

If you discover a security vulnerability, please email security@postopus.com. We aim to acknowledge reports within 48 hours. Please do not disclose vulnerabilities publicly until we have had a chance to investigate and patch.

Questions? Read our Privacy Policy or contact support@postopus.com.