Postly - Chrome Extension Privacy Policy
Privacy Policy - Postly Extension
1. What Postly does
Postly lets you write a post once and publish or schedule it to Facebook groups you are a member of, using your own logged-in Facebook session, only when you start or schedule a run. So that scheduled posts go out at the time you chose, the extension asks Chrome to keep your computer from going to sleep while Chrome is open (the screen may still turn off and lock). It does not read or change your computer's power settings, and nothing about it is sent to us. Postly is an independent product and is not affiliated with, endorsed or sponsored by Meta Platforms, Inc.
2. Where your data is kept
Since version 1.3.43 the extension keeps a copy of your Postly data in your Postly account, so that it is not lost when you change computers or reinstall, and so that you can use Postly from postly.solutions/app/ and from another computer signed in to the same account.
- Copied to your Postly account (backup and sync): your group lists; your scheduled posts, with their text, settings, target groups and the photos and videos attached to them; delivery preferences; post templates; language; the names of your groups; the list of groups you are a member of, as last scanned; and your posting history (when each campaign ran, to which groups, and whether each post succeeded). Once, when Postly moves you from the extension to the website, a post you had not finished writing (its text and attached photos) is also copied there, so you can continue it on the website. It is stored with our backend provider (Supabase) under your account, readable only by your account; photos and videos are kept in a private storage area of your account.
- Kept on your device only: the post you are currently writing and the groups currently selected for it, the 24-hour posting log (see "Diagnostic logs" below for when a copy is sent to us), and your Facebook session.
Your computers. Each installation receives its own random key, of which we store only a one-way hash, together with the installation's id, the extension version, when it was last active, the operating system and browser it runs on, and the name of the Facebook profile signed in there, so the website can tell which of your computers is on and you can tell them apart.
Using Postly from the website. When you use postly.solutions/app/ to sync your groups, publish a post, stop a campaign or switch the profile you post as, the request is stored in your account and carried out by the extension on your computer, under your own Facebook session there. While the website is open, or such a request is running, the extension shares its live progress (for example, how many groups were posted to) with your account so the website can show it.
3. Data sent to our servers
- Account data: your email address and account session token, used to sign you in and check your subscription/credit status (backend: Supabase).
- Usage counters: aggregate counts needed to enforce plan limits (e.g. number of posts used from your credit balance). No post content is included.
- AI writer (only when you use it): the text you ask the AI writer to write or rewrite and, when you add them, a link to a product page and the photo attached to the post, are sent to our servers and from there to an AI model provider (OpenRouter) to produce the suggested versions. Our servers read the linked page to give the model its details. We do not store any of it; we keep only a daily count of how many times you used the writer, to apply your plan's limit.
- Support chat (only when you use it): the messages you write to our support team in the app's support chat are stored in your Postly account, with your account email, so the team can read and answer them; the team is told of a new message, with its text, through Telegram. They are used only to answer you.
- Diagnostic logs: the same 24-hour activity log shown in the extension's engine tab (timestamps, posting steps, error codes, target group links and your account email) is sent to our servers when a run ends with failures, or when you press "send to support" - solely so our support team can diagnose the problem. It never includes your post text, media, messages or Facebook password. You can turn automatic sending off in the extension.
4. Facebook access
To publish on your behalf, the extension interacts with facebook.com under your own logged-in session. It checks whether you are signed in, loads the list of groups you are a member of, uploads your media and publishes your post. Your Facebook password is never seen, stored or transmitted by Postly, and your Facebook session cookies never leave your browser.
5. What we do NOT collect
- No browsing history and no activity on pages other than the posting flow you started.
- No reading of your Facebook feed, messages or friends' data.
- No sale or sharing of personal data with third parties for marketing.
- No credit-card data in the extension - payments are processed on our website by Stripe.
6. Limited Use
Postly's use of information received from Google APIs and from your browser adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements: data is used only to provide the single, user-facing purpose described above.
7. Data retention & deletion
Local data is deleted when you clear it in the extension or uninstall it. Account data, including the cloud copy described above, is kept while your account is active. Earlier versions of each synced item are kept for up to 60 days (at most 30 per item) so that an accidental deletion can be undone. A request from the website that no computer carries out expires after 10 minutes. To delete your account and all of its data, including the cloud copy, its earlier versions and your stored photos and videos, contact us and we will process the request promptly.
8. Contact
Questions or deletion requests: support@postly.solutions