Legal

Data deletion

Last updated: October 26, 2026

This page explains what Postel stores when you connect a social account, how to delete it, and how to remove Postel's access at each network.

Postel is run by JRS Content Solutions UG (haftungsbeschränkt), c/o Robin Sadeghpour Faraj, Bernauer Straße 65, 13507 Berlin, Germany. Privacy contact: joschua.suenneke@postel.app. Our privacy policy is in German; its section Q covers connected accounts in English.

What Postel stores for a connected account

When you connect a social account to a Postel workspace, we store:

  • Account details: the network's ID for your account and, where the network provides them, your handle, your display name and a link to your profile picture.
  • Access: the access and refresh tokens the network gives us, when they expire, and the permissions you granted. For Mastodon and Bluesky, also your server's address. For Bluesky, also the app password you entered. Postel encrypts it before saving it.
  • Posts: the posts you publish through Postel. For analytics on X, LinkedIn, Bluesky and Mastodon, also your account's recent public posts, including ones you posted outside Postel: a link, the first 500 characters, and how each post performed over time.
  • Account numbers: your daily follower count and account metrics, where the network provides them.

Tokens are stored in our database, which is hosted by Supabase. Supabase encrypts all customer data at rest with AES-256 (Supabase security). Access is limited to Postel's servers, the people who run Postel, and Supabase as our database provider. We use the tokens only to run the Postel features you use: publishing your posts, keeping the connection active, and reading your posts' numbers for analytics.

How to delete your data

Disconnect a channel

In Postel, go to Settings → Channels, open the menu next to the channel, and choose Disconnect. Only a workspace owner can do this.

  • Deleted right away: the access and refresh tokens this workspace stored for that account, and the Bluesky app password. Postel stops posting to that account.
  • Revoked at the network: for X, LinkedIn and Mastodon, Postel also asks the network to revoke its access. We skip this when the same access is still in use elsewhere in Postel, for example because you also sign in to Postel with that X or LinkedIn account. Bluesky has no way for apps to revoke an app password, so delete it in Bluesky (see below).
  • Scheduled posts: posts scheduled for that account won't go out while it's disconnected. Each one moves back to your drafts when it comes due.
  • Kept: the account details, your posts, drafts and analytics stay in the workspace so you can reconnect later. To delete them too, delete the workspace.

Delete a workspace

Go to Settings → General and choose Delete workspace. Only a workspace owner can do this.

This deletes the workspace and everything in it right away: its connected accounts and their tokens, posts, drafts, scheduled posts and analytics. Any plan on the workspace is cancelled. Deleting a workspace does not revoke Postel's access at the networks, so also remove it there (see below).

Delete your account

Go to Settings → Profile and choose Delete account.

This deletes your login right away, including the tokens of any account you use to sign in to Postel, such as Google, X or LinkedIn, and removes you from every workspace. It also cancels the plans on workspaces you own.

Deleting your account does not delete the workspaces you own, or the connected accounts in them. Delete those workspaces first. If you don't, a workspace only you were in stays behind with no members, and you will need to email us to delete it. If other people still use a workspace you own, Postel asks you to make one of them owner, or delete the workspace, before it deletes your account.

Email us

Email joschua.suenneke@postel.app from the address you use for Postel, and tell us what to delete. This works even if you can no longer sign in. We delete the data within 7 days and confirm by email.

What stays after deletion

  • Backups: deleted data can stay in our database provider's encrypted backups until those backups expire, which takes up to 30 days.
  • Billing records: invoices and payment records are kept as German tax law requires (up to 10 years). They don't contain your social account tokens or posts.
  • Posts on the networks: deleting data in Postel does not delete posts that are already published on a network. Delete those on the network itself.

Remove Postel's access at each network

You can remove Postel's access at any network at any time. After that, Postel can no longer use the token it stored. To delete the stored token as well, disconnect the channel in Postel.

  • Google (sign-in and YouTube): go to myaccount.google.com/permissions, select Postel and remove its access.
  • Instagram: in Instagram's settings, open Website permissions (or Apps and websites) and remove Postel.
  • Threads: open threads.com in a browser, go to Settings → Account → Website permissions and remove Postel.
  • TikTok: in the TikTok app, go to Settings and privacy → Security and permissions → Apps and services permissions and remove Postel.
  • X: go to x.com/settings/connected_apps, select Postel and revoke its permissions.
  • LinkedIn: go to Settings & Privacy → Data privacy → Other applications → Permitted services and remove Postel (LinkedIn help).
  • Mastodon: on your server, go to Preferences → Account → Authorized apps and revoke Postel.
  • Bluesky: go to Settings → Privacy and security → App passwords and delete the app password you gave Postel.

Network menus change from time to time. If a step above doesn't match what you see, search the network's help center for "connected apps" or email us.