POSTROOM / UPDATED 16 OCTOBER 2026

Data collection.

Current release

Postroom processes account identity, granted permissions, encrypted server-side credentials, selected captions/media, scheduling settings and provider delivery receipts to perform the workflows you authorize.

Available connected-account insights are cached by date range. Optional daily snapshots build growth history. Supported inbox tools retrieve comments and replies and can send confirmed replies or moderation actions with the required permissions. Instagram messages retrieve recent conversation text and participants for confirmed replies in the permitted window. Explicitly enabled Instagram keyword rules store a selected post, keyword and reply, and process matching comment webhook events. These are not TikTok messaging capabilities. X report refreshes require consent to API credit usage. TikTok reporting requires the relevant approved and granted scopes; personal LinkedIn publishing does not grant analytics.

Brand kits store identity, voice, visual instructions and private reference files. Logo, creative, PDF and text uploads are owner-restricted and opened through temporary signed links. Detaching a reference does not immediately delete the stored file. Automatic AI interpretation is not enabled.

Published Smart Links page text and destinations are public. Aggregate click counters count requests without storing visitor identities. Infrastructure logs may contain IP addresses and browser/request details. Publishing media storage uses publicly retrievable URLs; do not upload confidential files.

When you authorize an AI assistant through MCP, the selected assistant provider receives the tool results you request: workspace identity, connected-account names, brand guidance, cached insights, post content and publishing states. You choose read-only or scheduling access and can revoke the connection immediately. Social-provider credentials remain on our servers. ChatGPT attachments are copied into public publishing-media storage only when you authorize import. OAuth credentials are stored as hashes; authorization requests and access tokens expire. Tool audit records contain connection identifiers, tool names and timestamps, not captions or credentials, and are retained for approximately seven days with hourly expiry cleanup.

Supported or testing destinations are Facebook Pages, linked professional Instagram accounts, Threads, TikTok, LinkedIn personal profiles, Bluesky, Pinterest boards and X. Google Business Profile locations and YouTube channels also have implemented Google-connected workflows, subject to the project and account permissions, verification and review status. We do not sell connected-account data or treat OAuth as permission for unrelated actions. Instagram messaging is limited to supported replies to existing conversations; cold outreach and bulk or automatic DM sending are not offered.

Questions or verified data requests: privacy@notacompanynameyet.com.