Privacy Policy
Last updated: 19 October 2026. PostCora is operated by Shan Ali. This policy explains what PostCora stores and why.
What we store
- Your account: name, username, email, a salted hash of your PostCora password (never the password itself), two-factor settings (authenticator secrets are encrypted; recovery codes are stored only as hashes), and security-key public keys.
- Sign-in and security: active sessions with a short browser/device description and an approximate country/city from Cloudflare, a first-party cookie that recognises your browser for new-device alerts, and a security log of sign-ins and account changes.
- Facebook: your name and ID, the Pages you approve, Page access tokens (encrypted with AES-256-GCM), Page statistics and post history.
- Google: for Google sign-in, your Google account ID, email, name and photo. For Google Drive, only the files and folders PostCora creates (scope drive.file); tokens are encrypted.
- Scheduling and tokens: your videos' names and captions, scheduled and published posts, and your token ledger.
How it is used
Only to run PostCora for you: sign-in and account security, uploading, scheduling and publishing what you choose, showing statistics, billing tokens and sending account emails. Your data is not sold or used for advertising.
Service providers
Cloudflare (hosting, database, bot protection with Turnstile, email routing), Resend (sending account and notification emails), Meta (Facebook publishing) and Google (sign-in and Drive) process data only as needed to provide these functions.
Videos
Videos are stored in your own Google Drive. By default PostCora deletes a video file from Drive after it has been published.
Your choices
You can sign out other devices, change your email, or remove PostCora's access in Facebook (Settings → Business integrations) and your Google Account (Security → Third-party access). See Data deletion.