Privacy Policy
This Policy explains how Gameaton (“we”, “us”) processes personal data when you visit or use Post Engine at https://post-engine.io (the “Service”). It applies to invited account holders, workspace members, and visitors. For contractual terms, see our Terms of Service.
1. Data controller
The controller of personal data processed through this Service is Gameaton.
- Privacy contact: sp@gameaton.com
- Website: https://gameaton.com
This instance of Post Engine is self-hosted on a virtual private server in the European Union. It is not the hosted Postiz.com product and is not operated by Gitroom / Postiz.
2. Data we collect
Account and workspace
- Email address, password (stored hashed), display name / company name if provided, role in a workspace, and authentication cookies.
- Security logs such as IP address, user agent, timestamps, and error events needed to run and protect the Service.
Connected social platforms
When you connect a platform (for example Meta / Facebook / Instagram / Threads, X, YouTube, TikTok, or LinkedIn), we receive the data that platform’s OAuth flow and APIs provide for the scopes you approve. That typically includes:
- account or page identifiers, handle, avatar, and basic profile or page metadata;
- OAuth access and refresh tokens, granted scopes, and token expiry;
- content you choose to publish (captions, media, scheduling metadata) and delivery / error status returned by the platform;
- limited analytics or post insights if you use those features and the platform supplies them.
We do not ask you to paste platform API keys into the Service. Authentication is done through the official OAuth screens of each platform.
Media and drafts
Images, videos, and other files you upload are stored on this instance (local storage on our EU server) so they can be attached to scheduled or published posts. Public media URLs may be required by connected platforms to fetch the file at publish time.
AI features
If you use AI-assisted drafting, the prompt text you submit and generated suggestions are processed to provide that feature. Do not include information you do not want processed for that purpose.
Information we do not sell
We do not sell personal data. We do not use connected-platform data for advertising, for training independent AI models for unrelated products, or for credit-worthiness decisions.
3. Why we use data (purposes and legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and authenticate accounts, keep you signed in | Contract (Art. 6(1)(b)); legitimate interest in securing the Service (Art. 6(1)(f)) |
| Connect platforms and publish / schedule content you request | Contract; your instruction when you connect the account |
| Store drafts, media, and delivery logs | Contract |
| Security, abuse prevention, debugging | Legitimate interest |
| Optional AI drafting | Contract / legitimate interest, depending on how you use the feature |
| Respond to privacy or support requests | Legal obligation (Art. 6(1)(c)) and legitimate interest |
4. Sharing
We share data only as needed to run the Service:
- Connected social platforms — when you publish or manage content, the relevant caption, media, and identifiers are sent to that platform under its terms and privacy policy. Review those policies before connecting an account, including the Google Privacy Policy for YouTube.
- Hosting and infrastructure — our EU VPS provider processes server-level data (IP addresses, traffic) as a processor / hosting provider.
- AI subprocessors — only if you use AI features, the prompts needed to generate a suggestion.
- Authorities — if required by law or to protect rights, safety, or the Service.
Workspace admins you belong to can see content and connected-channel metadata for that workspace.
5. Google / YouTube API services (Limited Use)
Post Engine’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube / Google data only to provide the features you request (connecting your channel, uploading or scheduling videos, reading status needed to operate publishing). We do not use that data for serving advertisements, and we do not allow humans to read it unless you give permission, it is necessary for security or legal reasons, or the data is aggregated and no longer identifiable.
6. International transfers
The Service itself is hosted in the European Union. Connecting a social platform often means transferring data to that platform, many of which are in the United States or other countries. Those transfers are initiated by you when you connect the account and are governed by the platform’s terms. Where we otherwise transfer data outside the EEA/UK, we rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses.
7. Retention
- Account and workspace data: kept while your account is active, then deleted or anonymised within a reasonable period after closure (unless we must keep records for legal claims or security).
- OAuth tokens: kept until you disconnect the channel or we close the account; then revoked and deleted.
- Media and drafts: kept until you delete them or the account is closed.
- Security and application logs: typically up to 12 months, unless needed longer to investigate an incident.
- Content already published on a third-party platform is retained by that platform under its own policy; disconnecting Post Engine does not automatically delete posts already live.
8. Cookies
We use strictly necessary cookies (and similar storage) to keep you signed in, remember the active workspace, and protect the session. These are required for the Service to function. We do not use advertising cookies on post-engine.io. If a third-party login button is shown, that provider may set its own cookies on its domain when you use it.
9. Your rights
If GDPR or UK GDPR applies to you, you may request access, rectification, erasure, restriction, objection, or portability of your personal data, and you may withdraw consent where processing is based on consent (withdrawal does not affect prior processing). Email sp@gameaton.com. You may also lodge a complaint with a supervisory authority. For France, that is the CNIL (cnil.fr).
You can disconnect a social channel from the Service at any time; we will then stop using that channel’s tokens for new publishing.
10. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16.
11. Security
We use HTTPS, hashed passwords, restricted registration, and access controls on the server. No method of transmission or storage is 100% secure. You must keep your password and connected-platform sessions confidential.
12. Changes
We may update this Policy. The current version is always at https://post-engine.io/privacy-policy. Material changes will be reflected in the “Last updated” date.
13. Contact
Privacy requests: sp@gameaton.com.