Privacy Policy
This policy explains what PostWharf collects, why, how long it is kept and how to remove it. PostWharf is operated by Eternum Capital FZE LLC, a Free Zone Entity registered in Ajman Free Zone, United Arab Emirates under licence and registration number 2629413327888, at 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates. Contact: [email protected].
PostWharf is a social media publishing tool. You connect accounts you already control, compose content, and PostWharf publishes it to those accounts on your instruction. That is the entire purpose, and it bounds everything below.
1. What we collect
| Category | What it is | Why |
|---|---|---|
| Account data | Email address, password hash, workspace names | To create and secure your account |
| Connected accounts | OAuth access and refresh tokens, platform user ID, handle, avatar, granted scopes | To publish to the accounts you connect, and to show you which channels are live |
| Content | Post text, images and video you upload, scheduling times, per-platform variants | To publish it when you tell us to |
| Delivery records | Publish status, platform post ID and URL, error messages, retry history | To confirm a post landed and to alert you when one fails |
| Technical logs | IP address, browser type, timestamps of requests | Security, abuse prevention and debugging |
| Site measurement | Pages viewed on postwharf.com, a coarse device type (mobile, tablet or desktop), the site that referred you and any utm_ campaign tags on the link you arrived by, tied to a random first-party ID in a pw_vid cookie | To know which pages and channels bring people here, so we can improve them |
On site measurement specifically, because it is the one thing here you did not ask us to do: it is first-party only — no advertising network, no third-party analytics script, and nothing shared with anyone. We never store your IP address or your full browser string against a page view; the IP is used in memory to stop one machine flooding us and is then discarded, and the browser string is reduced to one of three device types and thrown away. We record the name of an ad click ID if the link carried one, never its value. Signed-in activity is kept in a separate record from anonymous visits, and the two are never joined back together. If your browser sends Do Not Track or Global Privacy Control, we do not measure at all.
2. Platform data and how we handle tokens
When you connect a social account, the network gives PostWharf an access token scoped to the permissions you approved on that network's own consent screen. We use those tokens only to perform the actions you request — publishing, scheduling, reading back the status of a post you made through us, and displaying your account name and avatar so you can tell channels apart.
- Tokens are encrypted at rest and are never displayed back to you or to anyone else.
- We do not read your private messages, contacts, or content you did not create through PostWharf.
- We do not use platform data to build advertising profiles, and we do not sell it. Ever, to anyone.
- We do not transfer platform data to third parties except the processors listed in section 4, who act on our instruction only.
- Disconnecting a channel deletes its tokens from our systems immediately. You can also revoke access from the network's own settings at any time, which we honour.
Our use of information received from each platform's APIs adheres to that platform's developer terms and policies, including the TikTok Developer Terms of Service, the Meta Platform Terms, the LinkedIn API Terms of Use, the YouTube API Services Terms of Service, and the X Developer Agreement. Where a platform's terms are stricter than this policy, the platform's terms govern.
Where PostWharf publishes to YouTube, it uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data: policies.google.com/privacy. You may revoke PostWharf's access to your Google account at myaccount.google.com/permissions.
3. Legal basis
We process account data and content to perform our contract with you. We process technical logs on the basis of our legitimate interest in keeping the service secure and working. Site measurement rests on the same legitimate interest, kept narrow enough to qualify: aggregate audience measurement for our own site, no profiling, no cross-site tracking, no sharing — and switched off entirely for anyone whose browser signals Do Not Track or Global Privacy Control. Where consent is the basis — for example connecting a specific social account — you give it on that network's consent screen and can withdraw it by disconnecting.
4. Who we share it with
We share the minimum necessary with a small number of processors:
- The publishing provider that holds the platform API approvals used to deliver your posts. It receives the content and target channels for posts you schedule.
- Hosting and database infrastructure — Hostinger International Limited, which stores the data described above.
- Error and uptime monitoring, which may incidentally record technical logs.
We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose data if compelled by valid legal process, in which case we will tell you unless legally prohibited.
5. Retention
- OAuth tokens — until you disconnect the channel or delete your account, then removed immediately.
- Uploaded media — 7 days after the post is published or cancelled. Uploads are a staging buffer that gets your file to the network, not a media library, so we hold them for as short a time as the job allows.
- Post content and delivery records — for the life of the account, so your history and receipts stay intact.
- Technical logs — 90 days.
- Site measurement — visits and page views for 400 days; the
pw_vidcookie itself expires 13 months after your last visit. Signed-in activity within the app is kept for 180 days. The acquisition channel recorded when an account is created is kept for the life of that account, and deleted with it. - Backups — our hosting provider takes periodic full backups of the server your data lives on. Deleted data disappears from those as they age out of the provider's retention window.
6. Your rights and how to delete your data
You can access, correct, export or delete your data at any time.
- Disconnect one channel — Settings → Channels → Disconnect. Its tokens are erased immediately.
- Delete everything — Settings → Account → Delete account. This erases your workspaces, content, tokens and delivery records within 30 days. Copies may survive a little longer in our hosting provider's server backups, until those age out of its retention window.
- Or email us at [email protected] and we will action it within 30 days.
- Step-by-step instructions, including the API call, are on the data deletion page.
Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your local data protection authority.
7. Security
Data is encrypted in transit with TLS and tokens are encrypted at rest. Access to production systems is limited to those who need it. No system is perfectly secure, and we will notify the relevant authority within 72 hours, and affected users without undue delay, if a breach affects personal data.
8. Where your data is held, and international transfers
PostWharf is operated from the United Arab Emirates, but the servers that store your data are located in Manchester, United Kingdom, operated by Hostinger International Limited. Your data is therefore transferred to and stored in the United Kingdom, and accessed from the United Arab Emirates by us as the controller.
Where we transfer personal data out of the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with the safeguards described in section 7. If you would like a copy of the relevant safeguards, email [email protected].
9. Children
PostWharf is not directed at anyone under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Changes
If we change this policy materially we will email account holders at least 14 days before the change takes effect, and update the date at the top. If you do not agree with a change, you can delete your account before it takes effect.
11. Contact
Eternum Capital FZE LLC — licence no. 2629413327888, Ajman Free Zone
26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
[email protected]