Privacy Policy
Plain summary: PostLayr stores your email, hashed password, Instagram tokens, and scheduled posts. We use this data only to run the service. We don't sell your data, serve you ads, or share it with third parties beyond what's needed to publish to Instagram.
1. Who we are
PostLayr is a social media scheduling service operated by LyfWis, India. Website: postlayr.com. Contact: privacy@postlayr.com
2. Information we collect
2.1 Account data
- Email address — for login and support
- Password — stored as a PBKDF2-SHA256 hash (100,000 iterations). We cannot read your password.
- Name — for personalisation
2.2 Instagram data (via Meta's official API)
- Instagram user ID, username, profile picture
- Long-lived OAuth access token (expires ~60 days)
- Follower count (display only)
- Facebook Page ID linked to your account
We use these tokens only to publish the posts you schedule. We don't read DMs, stories, or any content you haven't asked us to publish.
2.3 Content you upload
Media files and captions you upload are stored to publish at your chosen time. Files are deleted when you delete the post or close your account.
2.4 Technical data
- IP address (rate limiting and abuse prevention)
- Browser user agent
- Login timestamps and publish logs
No third-party analytics trackers (Google Analytics, Mixpanel, etc.) are used.
3. How we use your information
- To authenticate your account and maintain your session
- To publish your scheduled content to Instagram
- To show you analytics about your own posting activity
- To detect and prevent abuse and fraud
- To comply with legal obligations
4. Legal basis for processing (GDPR)
For EEA/UK users: Contract performance (providing the service), Legitimate interests (security, abuse prevention), Legal compliance (where required by law).
5. Data sharing
Meta Platforms: When publishing, we transmit your media and caption to Instagram's Graph API. Meta's use is governed by their Privacy Policy.
Cloudflare: Infrastructure provider (Workers, D1, R2). Acts as a data processor. Cloudflare Privacy Policy.
Lemon Squeezy: Payment processing (Merchant of Record). PostLayr never receives your card details. Lemon Squeezy Privacy Policy.
Legal disclosures: We may share data if required by applicable law or to protect the safety of our users.
6. Data retention
- Account data: retained while active. Deleted within 60 days of a deletion request (cancellable by logging back in).
- Media files: deleted with the post or on account deletion.
- Instagram tokens: deleted when you disconnect the account or close your account.
- System logs: 90 days, then auto-purged.
- Billing records: 7 years (Indian accounting law).
7. Your rights
You may request: access, correction, deletion, portability, or objection to processing. Email privacy@postlayr.com. We respond within 30 days. You can also delete your account directly from the Dashboard.
8. Security
- All data over HTTPS with TLS 1.2+
- Passwords hashed with PBKDF2-SHA256, 100,000 iterations
- Session tokens are cryptographically random
- Daily encrypted database backups
9. Children's privacy
PostLayr is not directed at children under 13 (or 16 in the EEA). If you believe a child has an account, contact us immediately.
10. Indian compliance (IT Act 2000 & DPDP Act 2023)
PostLayr complies with India's IT Act 2000, SPDI Rules, and the Digital Personal Data Protection Act 2023 to the extent applicable. We collect data only with your consent, for declared purposes, and provide rights as a Data Principal.
11. Changes
Material changes will be announced in-app with at least 14 days notice. Continued use after the effective date constitutes acceptance.
12. Contact
Email: privacy@postlayr.com · Website: postlayr.com