Privacy Policy

Last updated: November 10, 2026

Post First is an iPhone app and website that help creators build a daily posting habit. You connect your TikTok or Instagram account, Post First tracks your posts and stats, and the apps you choose stay blocked until you hit your daily posting goal. This policy explains what data we process, how and why we process it, and how to delete it.

Who we are

Post First is operated by Espindeezy Digital, LLC ("we", "us"). We are the controller of the personal data described here. Contact us about privacy at drew@espindola.io.

Data you give us

• Account: your email address and a hashed password.
• Preferences: your interests, niche, content formats, goals, daily posting target, browsing allowance, reminder time and time zone.
• Public profile and leaderboard: a username and profile photo, if you choose to add them. Setting a username puts you on the public leaderboard, where other people using Post First can see your username, photo, and your totals for posts, views and follower growth. Clear your username in Settings to leave the leaderboard.
• Library: photos and videos you save as inspiration. They are stored privately and only you can access them.
• Content you publish through Post First: the video or photo, caption and post settings you choose.

Data from TikTok

Only if you connect TikTok and approve these permissions on TikTok's authorization screen:

• user.info.basic: your TikTok account identifier (open ID) and profile picture, to link your account and show which account is connected.
• user.info.profile: your username, to show which account is connected.
• user.info.stats: your follower count, to show your follower growth over time.
• video.list: for your public videos, the video ID, publish time, cover image link, share link, description, and view, like and comment counts. We use these to detect that you posted, count it toward your daily goal, and show your stats.
• video.publish: to send a video to your TikTok account when you press Post. Before you post we read your display name, allowed privacy options, comment, duet and stitch settings and maximum video length to show them on the post screen. We do not store these. A video you post from the website is temporarily uploaded to our storage, sent to TikTok, then deleted from our storage.

Data from Instagram (Meta)

Only if you connect a professional Instagram account and approve these permissions on Instagram's authorization screen:

• instagram_business_basic: your Instagram account IDs, username, profile picture and follower count, and for your posts the post ID, caption, media type, thumbnail, permalink, publish time, and like and comment counts. We use these to link your account, detect that you posted, count it toward your daily goal, and show your stats.
• instagram_business_manage_insights: view counts for your most recent posts, to show how they perform.
• instagram_business_content_publish: to publish a video or photo to your Instagram account when you press Post. Instagram retrieves the file from our private storage through a link that expires after one hour.

We store the access tokens TikTok and Instagram issue so we can do the above. They are encrypted at rest and are never shown to the app, the website or anyone else. We do not store copies of the videos on your TikTok or Instagram accounts, only the details listed above.

What stays on your iPhone

App blocking uses Apple's Screen Time API. The apps you choose to block and your app usage stay on your device. Apple does not share them with us, and we never receive them. Photos you browse in the post screen stay on your device unless you choose to upload or post them.

On the website

When you sign in on the website, your session is kept in your browser's local storage so you stay signed in. We don't use advertising or tracking cookies, and we don't use third-party analytics.

How we process it

We collect this data when you use Post First and, for connected accounts, by syncing with TikTok and Instagram when you open the app or website and automatically about every six hours. We process it automatically to run the features described above. We process your data only to provide Post First: counting your posts, showing your progress and stats, publishing what you ask us to publish, storing your library, sending reminders you turned on, keeping the service secure, and responding to you.

What we never do

We do not sell, license or rent your data. We do not use data from TikTok or Instagram for advertising, to build profiles beyond the stats shown to you, to make eligibility decisions about people, for surveillance, or to discriminate against anyone. We do not use it to train AI models, and we do not track you across other apps or websites.

Who we share it with

We share data only with these providers, who process it on our behalf and only as needed to run Post First, or when you direct us to:

• Supabase: database, file storage, sign-in and servers.
• Cloudflare: website hosting and delivery.
• Resend: account emails such as password resets.
• TikTok and Meta (Instagram): receive requests from us when you connect an account, sync or publish. See the TikTok Privacy Policy and Instagram Privacy Policy.

We may disclose data if the law requires it or to protect the safety of people or the service.

How long we keep it

• Access tokens: until you disconnect the account or delete your Post First account.
• Account, preferences, connected account details, post history, stats and library: until you delete them or your account. Post history stays after you disconnect, so your streak and stats stay accurate, unless you ask us to delete it.
• Inactive service: if we stop operating Post First, we will delete data obtained from TikTok and Instagram.
• Backups and service logs: deleted data can remain in encrypted backups and logs for up to 30 days before it is overwritten.

How to delete your data

Everyone who uses Post First can request deletion at any time, whether or not they have the app installed. See Data Deletion for every option, or email drew@espindola.io.

Your rights

Depending on where you live, including the EEA, UK and California, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its processing, and to withdraw consent. We don't sell or share personal data for targeted advertising, and we won't treat you differently for using these rights. To use them, email drew@espindola.io. You may also complain to your local data protection authority.

Legal bases (EEA and UK)

We process your data to perform our contract with you (providing Post First), with your consent (connecting accounts and publishing, which you can withdraw by disconnecting), and for our legitimate interests in keeping the service secure.

International transfers

Your data may be processed in the United States and other countries where we and our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

Security

Data is encrypted in transit (HTTPS). Access tokens are encrypted at rest with AES-256, and database access is restricted so each account can only read its own data. No system is perfectly secure, and we will notify you and regulators of a breach where the law requires it.

Children

Post First is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us data, email drew@espindola.io and we will delete it.

Changes

We'll update this page and its date when this policy changes, and ask for your permission again before using connected account data in a materially different way.