Privacy Policy
Version of 28 August 2026. Service: Postomat (the “Service”). This English text is a translation provided for convenience; the Russian version is the governing text.
1. What data we process
- Account: e-mail, name, password hash (bcrypt), time zone.
- Social sign-in data: the profile identifier and name supplied by the provider (VK, Yandex and others), if you choose that sign-in method.
- Integrations: the tokens of your channels (Telegram, VK, MAX) — used solely to publish your posts and send your notifications.
- Content: the texts and images of the posts you upload for scheduling.
- Technical data: IP address, country (derived from the IP), browser type and the page you came from — when you submit feedback forms and to protect against abuse.
- Payments: processed by YooKassa. The Service receives only the fact of payment, the amount and the payment identifier. Card details are never available to the Service.
2. Why we process it
To perform the service agreement (publishing on schedule), to operate your account and billing, to support users, to prevent fraud, and to improve the Service using anonymised statistics.
3. Who receives the data
The payment provider (YooKassa) and the platforms that receive your publications (Telegram, VK, MAX) — to the extent required to publish. There are no other transfers; the data is not sold.
4. Storage and security
Data is stored on servers located in the Russian Federation, in line with Russian data-protection law (152-FZ). Passwords are stored only as hashes; channel tokens are kept in a private database; access to production data is limited to the Service team.
5. Your rights
You can request an export or deletion of your data using the “Write to us” button or at support@postomat.ru. Deleting your account also deletes the channel tokens, posts and publication queue; referral earnings for periods already paid for are retained.
6. Cookies
The Service uses functional cookies: a signed, httpOnly sign-in session; a referral marker (90 days) if you arrived through an invitation. Analytics consent is requested separately and no analytics counters are loaded before you give it.