Privacy Policy

PostBox is owned and operated by Stratus Ventures LLC, which is the company responsible for the personal data described below and the one to contact about any of it.

PostBox posts from your Mac. The captions you write, the accounts you post to, and — for almost every platform — the images and videos you attach do not pass through us when you post from the app. Threads and Instagram are the exception, and the next section is about exactly how.

What changed, and when. On September 19, 2026 this page said we had begun keeping an encrypted copy of your connection tokens on our servers, so that PostBox could post while your Mac was shut. That has been reversed. The feature it was for was dropped before it shipped, the server that would have held those copies has been deleted, and the tokens are back to where they were: in your Mac's Keychain and nowhere else. We are saying so with both dates rather than quietly removing the paragraph, because the earlier one was published and dated and you are entitled to know which way it went.

More changed than that, and all of it in the same direction. PostBox no longer has accounts. There is no sign-up, no email address, no sign-in code, no device identifier and no database — the paid plan those things existed to support was withdrawn, and everything built to administer it went with it. What is described below is what is left, and it is very little.

The exception: images and videos posted to Threads and Instagram

Meta's APIs will not accept a file. They take a web address and fetch the picture or video from it themselves, which means the only way to post an image or a video to Threads or Instagram is to put that file somewhere Meta can reach for as long as it takes Meta to read it. So for those two platforms — and only those two — your file is uploaded to a private bucket we run, handed to Meta as a single-use link, and deleted as soon as the post is published. It is the only thing of yours that reaches us at all, and it is measured in minutes.

The link is unguessable, is never indexed or listed, and stops working on its own after thirty minutes whether or not anything else has happened. Anything left behind by an interrupted post — a finished file or a half-sent one — is deleted by the bucket itself within twenty-four hours, whether or not anything remembers to ask. We do not look at these files, we do not back them up, and nothing about them is kept once they are gone. The bucket is Cloudflare R2, it is private, and nothing in it can be listed or browsed: a file is reachable only through the single expiring link handed to Meta.

Every other platform takes the file directly from your Mac, and for those nothing you attach touches our servers at any point. That includes video: X, LinkedIn, YouTube and TikTok all accept the bytes directly, so a video posted to any of them goes from your Mac to that platform and nowhere else. If you would rather no file of yours ever passed through us, posting to Threads and Instagram is the thing to avoid — everywhere else is unaffected.

What we hold

Nothing that identifies you. That is the whole of this section and it is meant literally: there is no account, so there is no email address, no sign-in code, no password, no device identifier, no post count and no row in any database with you in it. There is no database.

Until September 2026 this section listed three things — an email address, a hashed device fingerprint and a count of posts — because PostBox had accounts and a paid plan. It has neither now. Those records are gone, not archived.

The one thing of yours that reaches us at all is an image or a video on its way to Threads or Instagram, for the minutes described above. It is not filed against a name, an address or an account, because there is nothing to file it against.

What stays on your Mac

• Your social accounts. One revocable credential per connected account, in your Mac's Keychain. Your account password is never sent to us — you sign in on the platform's own page and we never see what you type there. For X and Bluesky you paste a key or an app password you generated yourself on that platform, which is not your password either. The Keychain copy is what the app posts with, and it is the only copy: nothing is kept on our servers.
• One qualification, because "it never leaves your Mac" would be too strong. Nothing is stored anywhere but the Keychain, and that is true of every platform. But for Threads, Instagram, LinkedIn and Dribbble the credential arrives through us: those four publish no PKCE flow and will only issue a token to a holder of an app secret, which cannot safely ship inside a downloadable app — so the app asks our server to make that one exchange and hand the result straight back. It passes through and is never written down. For X, YouTube and TikTok the exchange happens entirely on your Mac and we are not in it at all. We would rather say which four than let a shorter sentence stand.
• Your drafts. Captions and attachments live in ~/Library/Application Support/PostBox/ until you post them, and the files are deleted once every platform has finished with them.
• Your posting history. The last seven days of links, and a running count of posts you have made. Both are local, and the count is now local only — it used to be reported to us as well.

How this is protected

Almost all of this is a consequence of the section above: the safest way to protect something is not to hold it, and we now hold nothing about you. What remains is protected like this.

• In transit. Every request between the app, this site and our servers travels over TLS. The site sends a two-year HSTS header covering its subdomains, so a browser that has seen it once will not fall back to an unencrypted connection. There is no plaintext endpoint to downgrade to.
• On your Mac, which is the only place. Platform tokens — every platform's, including YouTube's — live in the macOS Keychain and are never copied anywhere else. The one file PostBox keeps outside it is encrypted with AES-GCM under a key derived on your machine, so nothing is legible on disk, in a Time Machine snapshot, or in a cloud-backup folder.
• The media link is the credential. A file on its way to Threads or Instagram is reachable only through a signed link with 256 bits of randomness in it. The bucket is private, so it cannot be listed or walked; the link expires in thirty minutes; and the file is deleted on publish, with the bucket removing anything left within twenty-four hours regardless. We also check that the file really is the picture or video it was declared to be, and refuse it if not — so our domain cannot be used to serve somebody else's content.
• Nobody here has an account of yours to look at. PostBox is operated by one person, and there is no support console that reads accounts, no internal dashboard built on them, and no employee with standing access — because there are no accounts. Our infrastructure providers can reach the systems they host, which is the nature of hosting anything, and they are named under What we do not do.
• How long it is kept. A file on its way to Threads or Instagram is deleted when the post is published, its link stops working after thirty minutes regardless, and the bucket removes anything an interrupted post left behind within twenty-four hours. That is the only retention period on this page, because it is the only thing retained.

What this section used to say. Until September 2026 it also described hashed device tokens, hashed one-time sign-in codes, a salted device fingerprint, sealed server-side copies of platform tokens, per-account row-level security in Postgres, request signing with a Secure Enclave key, and a least-privileged database role. Every one of those protected a record that no longer exists. They were removed because the thing they guarded was removed, not because the guarding stopped mattering.

YouTube API Services

YouTube in PostBox uses YouTube API Services. By connecting a YouTube channel you also agree to YouTube's Terms of Service and to Google's Privacy Policy. Questions about this use of YouTube API Services: email [email protected].

When you connect, PostBox requests one scope — https://www.googleapis.com/auth/youtube.force-ssl — and it is the only Google scope the app ever asks for. PostBox uses it to do three things and nothing else: upload the video you dropped (videos.insert), change that video's visibility if you set it on the receipt (videos.update), and delete it if you press Unpublish (videos.delete). It also reads which channel an upload will land on, once, when you connect, so Settings can name it (channels.list). The token that grants this is stored in your Mac's Keychain and nowhere else. The exchange that trades Google's authorization code for that token now happens entirely on your Mac, using PKCE — a method that proves the request came from the same app that started it without needing a shared secret. It used to pass through our server, because the older method required a secret that cannot ship inside a downloadable app. It no longer does: your Mac talks to Google directly and we never see the code or the token. The video itself goes from your Mac to YouTube and does not pass through us either.

Limited Use. PostBox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means the data is used only to provide the posting features you asked for, and for nothing else: it is not used for advertising, it is not sold, it is not transferred to anyone except as needed to provide those features or where the law requires it, and no human at PostBox reads it. We run no automated processing of it either — no model is trained on it and nothing derived from it is used to build a profile of you.

What we keep, and for how long. The access and refresh tokens for your Google account are the only Google data we hold. They are kept sealed with AES-256-GCM under a key that is not stored in the database and is never written beside it, tied to your account so they cannot be read or used anywhere else, and they are used for nothing but the uploads and deletions you ask for. We hold no other Google data: the video goes from your Mac to YouTube and does not pass through us, and the channel name is displayed from your Mac's own Keychain record. Disconnecting YouTube in PostBox deletes the token from the Keychain, which is the only copy there has ever been — we hold nothing to delete alongside it, and there is no account for it to be filed against.

Disconnect YouTube in PostBox to drop the token from this Mac. To revoke PostBox's access from Google's side as well, visit Google's security settings (myaccount.google.com/permissions is the same page).

TikTok

When you connect TikTok, PostBox reads the account's open id, display name and username so Settings can say who is connected, and asks for permission to publish a video you drop. Connecting also means you agree to TikTok's Privacy Policy. The token is stored in your Mac's Keychain. The exchange that trades TikTok's authorization code for that token happens on your Mac, using PKCE, for the same reason YouTube's does — it used to pass through our server and no longer needs to. We see neither the code nor the token, and we keep no copy. The video is uploaded from your Mac to TikTok directly (FILE_UPLOAD), so the file never touches our servers.

Disconnect TikTok in PostBox to drop the token from this Mac. To revoke PostBox from TikTok's side as well, open TikTok → Profile → Settings and privacy → Security and login → Manage app permissions, and remove PostBox.

What the app sends back

• Update checks. The app asks our update feed whether a newer version exists. Like any web request, that carries your IP address and the version you are running.
• Breakage reports. When a platform changes its website and a posting step stops working, the app reports the structure of the page it could not use — button labels and test identifiers, with addresses trimmed to the site and path. It carries no part of your post, and no page content.

Cookies and measurement on this website

This site sets no cookies and makes no third-party request. There is no analytics, no session replay, no consent banner to dismiss and nothing to opt out of, because there is nothing running. Reading this page writes nothing to your device.

Unless you press play on the demo. The video on the home page is a short silent clip served from this site, and under it sits a button offering the full narrated version. That one is on YouTube, and pressing the button is what loads YouTube's player — at which point Google receives your IP address and can set storage in their frame, exactly as if you had opened the video on their site. Nothing of theirs is requested before you press it: no script, no frame, no cookie. We use the privacy-enhanced player (youtube-nocookie.com), which holds off until playback, and we send them the address of this page rather than the full one you arrived on. If you would rather not, do not press play, or watch it on YouTube directly, where the same terms apply and you at least know you are there.

And the app measures nothing either. PostBox used to send a short list of named steps — that it launched, how far through the first run you got, that a post succeeded — so we could see where people got stuck, with a setting to turn it off. That has been removed entirely rather than defaulted off: the app makes no analytics request at all, and the setting is gone because there is nothing left for it to control. The honest cost of this is ours: we can no longer see when the app is failing people, and we will find out when somebody writes in.

One exception, and it is not ours. Cloudflare sits in front of this site as its CDN and collects page-load and Core Web Vitals timing at the edge. It is injected by Cloudflare rather than by anything in our code, it sets no cookie, and it is part of how the site is served rather than something we added to watch you.

Historically. Until September 2026 this site used PostHog for product analytics, with session replay behind a consent banner and a pb_consent cookie recording your answer. Both are gone, along with the reverse proxy that carried them and the cookie itself. If you still hold that cookie from an earlier visit, nothing reads it.

What we do not do

We do not sell your data, and we do not share it with anyone beyond the two processors named on this page — Cloudflare, who serve this site and hold the private R2 bucket used for the brief media handoff described above, and Railway, who host the small service that signs the links for it. There is no email provider, no analytics vendor and no database provider, because there is no mail, no analytics and no database. We run no advertising pixel, and there is no licence or account for an advertising identifier to be attached to. What you post, who you post it to and what you write never reach us, on the website or in the app.

Government and law enforcement requests

A lawful order is the one thing that can compel us to hand anything over, so it is worth saying exactly how we treat one. Every request is reviewed for its legal basis before it is answered. One we believe is unlawful, overbroad, or improperly served is challenged rather than complied with. Where a request is valid we disclose the least that answers it, never a whole account because a whole account was asked for. We keep a record of each request and of what we did about it. And we tell you that your data was asked for, unless the law forbids us from saying so.

In practice there is nothing that could be handed over, and that is now literally rather than nearly true. Your captions and the accounts you post to never reach us — not because we would refuse to produce them, but because we do not have them. The one file that does pass through us, an image or video on its way to Threads or Instagram, is deleted on publish and gone within twenty-four hours at the outside, and is not backed up, so an order arriving afterwards finds nothing to take. The connections you make to each platform are a token in your Mac's Keychain, never stored by us.

Four platforms are a partial exception, and only in passing. Threads, Instagram, LinkedIn and Dribbble will only issue a token to a holder of an app secret — a secret that cannot safely ship inside a downloadable app — so for those four the app asks our server to make that one exchange and hand the result straight back. It passes through us; it is never written down. Every other platform, including X, YouTube and TikTok, now does that exchange on your Mac and does not involve us at all.

So there is no list of records to compel. What we hold is nothing that identifies you, and an order can only reach what exists.

We have never received a national security request, and we have never disclosed anyone's personal data to a public authority.

If we emailed you first

We have stopped doing this. For a period we wrote to people who had not heard of us, at business addresses they had published themselves. That ended on September 19, 2026. We do not send unsolicited mail any more, and the only email PostBox sends now is to people who asked for it: your sign-in code, and nothing else. If one of those earlier messages is how you found this page, the rest of this section is the account of it.

What we held was an email address, a name, the public page we found them on, and a note of what that person publishes there. Nothing else. We did not buy lists, guess addresses from a pattern, or scrape platforms — every address came from a business contact page put on the public internet, and the page it came from was recorded next to it. The basis was our legitimate interest in telling people who publish work from a Mac about a tool built for that, weighed against how intrusive one email to a published business address is; in Canada, the implied consent that arises when a business address is conspicuously published without a notice refusing unsolicited mail.

We no longer hold any of it. The prospect records are gone, and so is the suppression list — the record of who had opted out — which we deleted on September 19, 2026 along with the sending system itself. That list existed so a later import could not reach someone who had asked us to stop; with no list to import and no sender to import it into, keeping a table of people's addresses was holding personal data for a purpose that no longer exists. The unsubscribe links in messages sent before that date no longer resolve, and there is nothing left for them to unsubscribe you from.

Your rights are the full set: ask what we hold, correct it, have it deleted, object to the whole thing, or have a copy. Email [email protected] and we will act within thirty days. If you would rather complain to a regulator than to us, readers in the EU can go to their national data protection authority, readers in the UK to the ICO, and readers in Canada to the CRTC.

How long we keep it is two years from the last time we wrote to you, or two years from the day we recorded your address if we never did. After that the contact record is deleted, and so is the log of what we sent you — both, because a record is not deleted because the tidiest copy of it was. A sweep runs every day rather than when somebody remembers, so the outside case is a record surviving its own deadline by a day. The one thing that outlives all of this is the suppression list described above: if you told us to stop, that address stays on it, because deleting it is what would let the mail start over.

Deleting it

There is nothing here to delete. We hold no account, no email address, no device record and no count of your posts — so there is no erasure request to make and nothing for us to act on. Deleting PostBox from your Mac removes everything, because everything was only ever there.

Until September 2026 this section said to email us and we would delete your account, your device records and your post counts. Those records existed then and they have been deleted. If you had an account before that date, it is already gone.

If you want to be certain, or want to ask us anything about this page, email [email protected] and we will answer within thirty days. Your rights under the GDPR and the CCPA — to ask what we hold, to correct it, to have it deleted, to object, or to have a copy — are unaffected by there being nothing to exercise them against.

Unpublish on a Threads post you sent from this Mac asks Threads to take that post down, from this Mac, with the token in your Keychain. That is the only delete. We never held a copy of the post, so there is nothing here to erase afterwards. Instagram does not let apps delete posts; take those down in Instagram.

Also here: Terms of Service.