Pliny Group

Privacy Policy

Effective 26 October 2026

Pliny Group operates a self-hosted deployment of Postiz, an open-source social media scheduling tool, at post.plinygroup.com. This policy describes what that system stores and how it is handled.

Who this applies to

The system is single-operator. It is used by Pliny Group to publish to social media accounts that Pliny Group owns and controls. It is not offered to the public, does not accept registrations, and has no users other than its operator.

What is stored

What is not collected

The system has no public pages apart from its operator sign-in screen, and no analytics, advertising, or third-party trackers. The scheduling interface sets one session cookie in the operator's browser to keep the operator signed in; this website sets no cookies. It does not collect data about visitors to this website, and it does not collect data about anyone who views or interacts with the posts we publish beyond the aggregate metrics that the platforms themselves return to us.

Where data lives

All data is stored on hardware operated by Pliny Group in the United States. It is reachable only over an authenticated connection through Cloudflare Tunnel; the application is not exposed directly to the public internet. Nothing is stored with a third-party hosting provider.

Sharing

Data is not sold, rented, or shared. Content is transmitted to a connected platform only when we publish to that platform, which is the purpose of the system. Cloudflare processes network traffic in transit as our infrastructure provider.

Google and YouTube data

To upload our videos to our own YouTube channel, the system uses YouTube API Services. Connecting a YouTube channel to it means agreeing to the YouTube Terms of Service, and Google's handling of that data is governed by the Google Privacy Policy.

From Google, the system receives the OAuth tokens that authorise it; the connected Google account's name, email address, and profile picture; the channel's name, ID, and avatar; and aggregate statistics for that channel and its videos (views, watch time, likes, comment counts, subscriber changes). It uses them solely to publish our videos to our own channel, set their thumbnails, label the channel in the interface, and show us how our videos perform. It reads no comments, messages, or data about viewers, does not share any of it, and does not use it for advertising, profiling, or training models. Pliny Group's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Access can be revoked at any time from Google's security settings, which invalidates our stored token immediately. Channel data obtained through the API is refreshed or deleted within 30 days, and all of it is deleted when the channel is disconnected or access is revoked.

Retention and deletion

Access tokens are retained until the connected account is disconnected or the token is revoked, whichever comes first. Disconnecting a channel deletes its stored tokens. Scheduled and published post records are retained for our own recordkeeping and can be deleted at any time. Revoking access from within a platform's own settings immediately invalidates our stored token for that account.

Your rights

Because the system holds data only for accounts we ourselves own, there is no third-party personal data to access, correct, or erase. If you believe we hold data about you in error, contact us and we will investigate and delete it.

Changes

If this policy changes, the effective date above will be updated.

Contact

Questions about this policy: [email protected]