Privacy Policy

PostQuest (“PostQuest,” “we,” “us,” or “our”) provides tools that help creators plan, draft, schedule, and publish social media content. PostQuest is currently operated and published by Aleksandr Samokhin as an individual. This policy applies to the PostQuest website, application, MCP server, and related services.

• Account information: your name, email address, password credentials, Google account identifier when you use Google Sign-In, timezone, and account-security settings.
• Workspace and content information: business or creator profile details, goals, audience, content pillars, rough ideas, drafts, scheduled posts, uploaded media, notes, recommendations, and publishing history.
• Connected account information: social platform, account identifier, username, display name, profile image URL, access or refresh credentials, and connection status for accounts you choose to connect.
• Subscription information: plan, subscription, license, and billing status. Payment card details are handled by the checkout provider and are not stored by PostQuest.
• Technical information: IP address, browser or device user agent, session activity, timestamps, security events, and diagnostic logs.
• ChatGPT and MCP information: the MCP client name, OAuth authorization and revocation events, requested tool name, tool arguments you direct the client to send, tool results, response status, timing, and diagnostic error codes. We do not receive your ChatGPT password or the publisher's ChatGPT credentials.

When you connect PostQuest to ChatGPT, Codex, or another MCP client, that client opens PostQuest's authorization flow. You sign in with your own PostQuest account and choose a workspace. PostQuest issues that client a scoped access token; customers never use or share the publisher's ChatGPT Plus account or OAuth credentials.

At your direction, the client may send draft text, media locations, account and post identifiers, scheduling choices, and other tool arguments to PostQuest. Tool results may return your verified PostQuest email through the OpenID UserInfo endpoint, workspace and connected-account details, content, validation results, publishing outcomes, and short-lived media links. OpenAI and other MCP-client providers process the data they receive under their own terms and privacy policies.

You can revoke a client connection and disconnect social accounts. Operational logs are designed to record tool names, outcomes, error codes, and latency without request bodies, OAuth tokens, provider credentials, captions, or media.

If you choose Google Sign-In, Google may provide your Google account identifier, name, email address, and profile image. PostQuest stores the identifier, name, and email needed to create or authenticate your account. We do not store the Google profile image for this purpose, and we do not request access to Gmail, Google Drive, Google Calendar, or your Google contacts.

We use Google Sign-In data only to provide account access, security, and support. We do not sell it, use it for advertising, or use it to develop, improve, or train generalized AI or machine-learning models. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

• Provide, secure, maintain, and improve PostQuest.
• Authenticate users, prevent abuse, and recover accounts.
• Generate recommendations and organize, schedule, or publish content at your direction.
• Connect to social platforms and maintain the connections you authorize.
• Manage trials, subscriptions, usage allowances, and customer support.
• Comply with law, enforce our terms, and protect users, PostQuest, and the public.

When you request AI-generated post ideas, PostQuest sends your rough input and relevant workspace context—such as your business name, niche, audience, goals, tone, content pillars, preferred platforms, and recent post titles—to Anthropic to generate the requested ideas. This processing is optional and occurs only when you use the AI feature. Google Sign-In data is not included in these prompts.

We share information only as needed to operate the service, complete actions you request, protect the service, or meet legal obligations. Recipients may include:

• DigitalOcean and related infrastructure providers for application hosting, compute, networking, databases, and security.
• Cloudflare R2 for object storage of uploaded media and generated assets.
• Anthropic for optional AI-assisted idea generation.
• Post for Me (Day Moon Development) for publishing to social platforms you connect through it. When you use it to connect an account, it holds that platform's access tokens on your behalf, and we send it the post content, captions, and media you schedule so it can publish them. Media is passed to it as a temporary link that is publicly reachable while the post is being processed.
• Freemius and its payment providers for checkout, subscription, license, and customer-portal services.
• Google for Google Sign-In, and Bluesky, Mastodon, LinkedIn, X, or other platforms you connect for authentication and publishing you direct — whether we reach them directly or through Post for Me.
• Email delivery and operational service providers that process information on our behalf.
• Authorities or other parties when reasonably necessary to comply with law, prevent harm or fraud, or protect legal rights.

We do not sell personal information and do not share it for cross-context behavioral advertising.

PostQuest uses essential cookies for sessions, authentication, CSRF protection, security, remembered sign-in, and sidebar preferences. At the effective date of this policy, PostQuest does not use advertising cookies or third-party analytics cookies.

We retain account and workspace information while your account is active and as needed to provide the service. You can delete your account from Profile settings. Account deletion removes your account and associated workspace resources from active systems, subject to limited retention where required for security, fraud prevention, legal, tax, accounting, dispute-resolution, or backup purposes. Connected platforms may separately retain content already published to them under their own policies. Revoking an MCP connection stops future access but does not remove content already returned to a client or published to a social platform. Contact us if you need help with deletion.

We use technical and organizational safeguards designed to protect information, including encrypted transport, hashed passwords, encrypted social access credentials, access controls, signed requests, and abuse prevention. No system can guarantee absolute security.

You may review or update account information, disconnect social accounts, delete individual content and media, or delete your account through PostQuest. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information. Contact us to exercise a right that is not available in the product.

PostQuest and its providers may process information in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers.

PostQuest is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

We may update this policy as PostQuest or applicable law changes. We will update the effective date and provide additional notice when a material change requires it.

For privacy questions or requests, email privacy@post-quest.com.