Privacy Policy
Last updated November 12, 2026.
Postparrot ("we") lets you connect your social media accounts and give AI agents you choose access to them through the Model Context Protocol (MCP). This policy says what data we keep, why, and how you remove it.
What we keep
- Your Google sign in: name, email address and profile picture, to know who you are.
- Connected accounts: for each YouTube channel, TikTok account, Instagram account or Facebook Page you connect: its id, its name, and the access and refresh tokens the platform gives us. Tokens are encrypted (AES-256-GCM) and are never shown to you, to agents, or to anyone else.
- Agent grants: which agent (MCP client) may use which account, read only or with full access.
- Files you upload for a post, kept 48 hours, then deleted.
- Counts: how many requests your agents made each month, for the free allowance and billing. We do not keep the content of requests or answers.
- Numbers and posts of each connected account, for your panel: its follower, view and post counts, and for its newest posts the title or caption, link, cover picture, and the view, like, comment and share counts. We read them from the platform a few times a day. YouTube numbers are kept 30 days, numbers from the other platforms 365 days, then deleted.
- Billing: your Stripe customer id. Card details are held by Stripe, never by us.
How we use it
Only to do what you or an agent you allowed ask: read from and post to your connected accounts through each platform's official API, show you your accounts, usage and numbers, and bill usage past the free requests. We do not sell data, show ads, or use your data to train AI models.
Google and YouTube data
Postparrot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Postparrot uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can take Postparrot's access back at any time on the Google security settings page.
Who we share it with
- The platform an agent calls (YouTube, TikTok, Instagram, Facebook), only what that call carries.
- The AI agents you allow, only the answers of calls to accounts you granted them, with tokens removed.
- Service providers who run Postparrot for us: Cloudflare (hosting, database, file storage) and Stripe (payments).
We share data with authorities only when the law requires it. We check that each request is lawful, object when it is not, give only the data it requires, and keep a record of it.
How long we keep it
Until you remove an account or delete your Postparrot account; uploaded files 48 hours, YouTube numbers 30 days, numbers from the other platforms 365 days. Removing an account deletes its tokens, numbers and posts at once and, for YouTube and TikTok, ends our access at the platform. Deleting your Postparrot account deletes all of the above at once, except what Stripe must keep for tax law.
Your choices
See, change or delete your data in your panel, or follow the steps on Delete your data. You may ask us for a copy or a correction at hello@postparrot.app. If you are in the EU, the UK or California you also have the rights your law gives, and may complain to your data protection authority.
Cookies
Postparrot stores cookies in your browser only to keep you signed in and to finish a sign in or an account connection. We use no advertising or analytics cookies, and we do not let third parties serve ads or other content on Postparrot or read information from your device.
Security
All traffic uses HTTPS. Tokens are encrypted at rest, each bound to its account. Agents receive short lived access tokens limited to the accounts you chose.
Children
Postparrot is not for anyone under 18.
Changes
We will post changes here and change the date above; for important changes we will email you first.