Who we are

PostHub is the service at posthub.shorix.io — one address for every question below.

This policy explains what personal data PostHub stores when you use the service, why we store it, how long we keep it, and the control you have over it. It applies to this website and app only — not to the social platforms you connect to it.

For anything about this policy, or about your own data, write to support@posthub.shorix.io. That is the address we monitor for data-protection requests, and it is the same contact used for support. PostHub is operated by Muhammad Tayyab, based in Pakistan.

What we store

Your account, your content, your connections and your billing proof — nothing else is collected by us.

PostHub stores the following categories of data:

• Account — your email address (this is your login), your display name, a bcrypt hash of your password (the password itself is never stored), the date you joined, sign-in timestamps and the IP address of your most recent sign-in.
• Profile — your avatar photo or avatar colour, email-notification preference, date/time format, time zone, workspace and plan state, and whether two-factor authentication is on (including the authenticator secret and unused backup codes, kept so you can sign in).
• Content you create — posts and their text, media references, scheduling and publish timestamps, per-platform publish results, files you upload to the media library, labels, groups, comments and approvals inside a workspace, in-app notifications, and any support ticket you open (including what you write in it).
• Connected accounts — the platform, the account handle, follower count as shown in the app, connection state and timestamps, and the OAuth access/refresh tokens the platform issued to PostHub so it can publish on your behalf.
• Billing — the plan and billing cycle you chose, the state of your plan (trial, active or expired), renewal dates, credit usage, and the payment-proof screenshot you upload when you pay by wallet or bank transfer.
• Security records — failed and successful sign-in events (IP address, browser user agent, timestamp), security events raised by our anti-abuse systems, and short-lived rate-limit counters.

How we use it

To run the product you signed up for, to keep it safe, and to answer you when you write.

• To provide the service: signing you in, showing your calendar and drafts, scheduling and publishing your posts, and computing the analytics it displays for your own account.
• To send transactional email — sign-in codes, password resets, publish results, weekly digests when you have opted in — through our email delivery provider, acting on our instructions.
• To secure the service: session management, rate limiting, abuse and fraud prevention, and investigation when something looks wrong.
• To bill and support you: activating the plan you paid for, keeping the records needed to answer billing questions, and replying to your tickets.
• To send the product newsletter only where you have subscribed and confirmed it; you can unsubscribe from any edition, and we keep a suppression list so we do not mail you again.

Connected platform tokens

Stored server-side only, encrypted at rest, never handed to your browser.

When you connect Instagram, Facebook, X, LinkedIn, TikTok, YouTube or any other supported platform, that platform issues OAuth tokens to PostHub. We store them in our database encrypted with AES-256-GCM under a server-side encryption key, and they are only decrypted inside server code when we publish, refresh a connection or read analytics for you.

Tokens are never included in what your browser receives, never appear in our logs, and are cleared when you disconnect an account or when your account is deleted. You can disconnect any account at any time from Settings, which revokes our ability to publish to it. Removing the platform connection in the social platform itself also stops PostHub from using the token.

Cookies and local storage

Only the cookies needed to sign you in and keep the app working — no analytics or advertising cookies.

PostHub sets first-party session, security and CSRF cookies, and nothing else. There are no analytics, advertising or cross-site tracking cookies on this site today. We also use your browser’s local storage for interface preferences such as your theme, time zone and the cookie-consent choice itself.

The full list — every cookie name, what it does, how long it lasts and whether it is strictly necessary — is on our Cookie Policy page.

Legal bases for processing

Contract, legitimate interests, consent and legal obligation — the four grounds we rely on.

Where data-protection law such as the GDPR applies to you, we process your data on these bases:

• Performance of a contract — everything needed to run your account: sign-in, publishing, billing and support.
• Legitimate interests — keeping the service secure, preventing abuse, understanding aggregate product usage, and improving the app, in ways a reasonable user would expect.
• Consent — the product newsletter and any optional communication you can decline or unsubscribe from. Your cookie choice is recorded in your browser so we can honour it.
• Legal obligation — records we must keep to answer a tax or accounting request, such as payment references and invoices.

Who we share it with

The platforms you connect, our infrastructure providers, and nobody else — we do not sell data.

We do not sell or rent personal data, and we do not share it with advertising networks.

• The social platforms you connect — we send your post content and media to the platform you asked us to publish to, under that platform’s terms and privacy policy.
• Our service providers acting on our instructions — email delivery and database/hosting infrastructure. They may only use the data to perform the service for us.
• Professional advice or legal requests — if we are legally required to disclose information, we disclose only what is required and, where the law allows, tell you first.
• A successor — if the service is ever transferred or acquired, this policy and your data move with it, and you would be told before that happens.

How long we keep it

While your account is open — then anonymised on deletion, with only short-lived security logs behind it.

• Account, profile and content — kept while your account exists. You can delete the account at any time (see Your rights below).
• Connected-platform tokens — kept while the connection is active; cleared on disconnect or account deletion.
• Billing records — kept for as long as needed to answer billing questions and satisfy accounting obligations.
• Security and login events — kept for a limited period for incident investigation, then removed; rate-limit counters expire within about a day.
• Marketing suppression list — we keep your address on it for as long as needed to make sure we never mail you again after you unsubscribe.

Your rights

Export a copy or delete the account yourself, in Settings — or ask us and we will do it with you.

Where GDPR, CCPA/CPRA or similar laws apply to you, you have rights over your personal data: access, correction, deletion, restriction, objection to processing based on legitimate interests, portability of the data you gave us, and withdrawal of consent. You also have the right to lodge a complaint with your local supervisory authority.

Two of those rights are self-service inside the app: Settings → My account → Your data gives you an Export my data button (a JSON file of your account, profile, posts and connected-account metadata — never platform tokens) and a Delete account action.

• Access and portability — use Export my data, or email us and we will send what the export does not cover.
• Correction — most profile fields are editable directly in Settings; your login email can be changed by asking support.
• Erasure — use Delete account, or email us and we will confirm once it is done.
• Objection or restriction — email us and tell us which processing you want limited.

Security

TLS in transit, bcrypt at rest for passwords, AES-256-GCM for tokens, httpOnly cookies and CSRF everywhere.

• Passwords are stored only as bcrypt hashes (cost 12) and are never logged or emailed.
• Platform OAuth tokens are encrypted at rest with AES-256-GCM; reset and refresh tokens are stored as SHA-256 hashes, so a database copy cannot be replayed.
• Session cookies are httpOnly and Secure in production, and state-changing requests are checked for origin and a signed CSRF token.
• Rate limiting and security-event logging protect sign-in and other sensitive endpoints.
• No system is perfectly secure: if we ever learn of a breach affecting your data, we will notify you and the relevant authority as the law requires.

Children

PostHub is not aimed at children under 13.

You must be at least 13 years old to use PostHub. We do not knowingly collect data from children under 13; if you believe a child has given us data, contact us and we will remove it.

Changes to this policy

Material changes are announced in-app or by email before they take effect.

We may update this policy as the product changes. The date at the top of the page is the last update. For a material change we will give notice in the app or by email before it applies; continuing to use the service after that means you accept the updated policy.

Contact

Data-protection questions: support@posthub.shorix.io.

Email support@posthub.shorix.io with the email address of your account and what you need — an export, a correction, a deletion, or an answer about this policy. We reply within one business day, and we may need to verify it is really you before we act on a request about account data.