Privacy Policy

Last updated 5 September 2026

This policy covers a private, self-hosted installation of Postiz, an open-source social media scheduling tool, running at postiz.asafn.com. It is operated by one person for personal use, to schedule educational videos about historical events and unusual facts.

There is no public sign-up. The software is not offered as a service to anyone else, and no other person holds an account on it.

Where this runs

The application runs on a server owned and physically held by the operator. It is not hosted on a shared or third-party platform. The database and all uploaded files stay on that machine.

What is stored

• An account login for the operator: email address and a hashed password.
• Access tokens issued by connected social platforms, which allow scheduled posts to be published.
• Basic profile details returned by those platforms when an account is connected, such as the account name, ID, and profile picture.
• Post content awaiting publication: text, images, and video files uploaded by the operator.

Connected platforms

Accounts on YouTube, Facebook, and Instagram may be connected using each platform's own authorisation process. The connection grants permission to read basic account information, publish content, and read statistics about published posts.

No password for any connected platform is ever seen or stored. Only the access token issued by that platform is held, and it can be revoked at any time from the platform's own security settings, which immediately ends this application's access.

What is not done

• No data is sold, rented, or shared with advertisers or data brokers.
• No analytics, advertising, or tracking scripts run on this site.
• No content or account data belonging to other people is collected.
• Data from connected platforms is used only to publish and review the operator's own posts.

Who can see the data

Only the operator. There are no employees, contractors, or third-party processors with access. Data may be disclosed if required by law.

How long it is kept

Posts and media are kept until deleted from the application. Access tokens are kept while an account remains connected and are removed when it is disconnected. Disconnecting an account, or revoking access from the platform's own settings, ends the connection.

Security

Traffic to the site is encrypted with HTTPS. The server is not exposed directly to the internet; it is reached through an outbound tunnel with no inbound ports open. Access is restricted to the operator. No system is perfectly secure, and no guarantee of absolute security is offered.

Children

This application is not intended for anyone under 13 and is not directed at children.

Changes

This policy may be updated. The date at the top reflects the most recent revision.

Contact

Questions about this policy can be sent to homelabna@gmail.com.