Privacy Policy

Account information.When you sign in with Google, we receive your name, email address, and profile photo. Sign-in may be restricted to your school's Google Workspace domain if that organization has configured one.

Content you submit. Images and captions you upload for a post, along with any comments an approver leaves when reviewing it.

Optional integrations. If an administrator connects a team to Google Drive as an asset pool, postApprover requests access only to files/folders it creates itself (the drive.filescope — never your whole Drive) plus your connected Google account's email address. If a team connects an Instagram Business Account or a Slack webhook, postApprover stores what's needed to publish posts and send notifications through those services.

To authenticate you, enforce who can submit or approve posts for a given team, run the approval workflow, publish approved posts to the connected Instagram account, and email or notify you about the status of your posts.

Approved posts are published to Instagram via Meta's Graph API. Sign-in uses Google OAuth. Email notifications are sent via Gmail SMTP. If a team enables it, approval notifications may also be sent to a Slack channel. We do not sell or share your information for advertising purposes.

Data is stored in a PostgreSQL database and images in Vercel Blob storage. Instagram and Google Drive access tokens are encrypted at rest (AES-256-GCM) before being stored.

Every post is kept for 365 days after submission (in case you need to reference it) and then automatically deleted by a daily cleanup job, regardless of its status — including posts already published to Instagram, though the live Instagram post itself is unaffected. Other account data is retained for as long as your account remains active in the system.

postApprover is used by high school students as part of a school-administered program. Access requires an invite from school staff and, typically, a school-issued Google account — it is not open to the general public.

Questions about this policy, or requests to access or delete your data, can be sent to scott@ssmalone.net. This policy may be updated from time to time; the date above reflects the most recent change.