Privacy Policy
Last updated: 4 November 2026
PostDecks is a free, browser-based tool for previewing social media posts before you publish them, and for sending them to a client to approve. This policy explains what happens to your data. The short version: your content stays on your device unless you choose to share it as a link.
Who we are
PostDecks is operated by Social Impact Ltd, a company registered in England and Wales (company number 08995296), with its registered office at 12 Limedale Avenue, Oakwood, Derby, England, DE21 2UE. Social Impact Ltd is the data controller for the information described in this policy.
Previewing and exporting
You do not need an account to preview a post or to export it. The images, captions, names, handles, and profile pictures you add are processed entirely in your browser. They are not uploaded and not sent to us or anyone else.
The post you are working on is kept in your own browser's storage on your device, so that reloading the page does not lose it. It is deleted when you press Reset to blank, or after seven days. A client, a logo, or an Instagram grid you save without an account is kept the same way. We never receive any of it, and clearing your browser's site data removes all of it.
If you create an account
An account is optional and free. If you create one we store your email address. We use it to sign you in, by emailing you a link (there is no password), and to tell you when a client responds to something you shared. We do not send marketing email.
Clients and Instagram grids you save while signed in are stored with your account, so they are there on your other devices: the names, handles and profile pictures of saved clients, and the images and profile details of saved grids. They stay until you delete them.
Posts you plan on the content calendar are stored with your account the same way: the day and time, the caption, the formats and the images (resized first). Each post is deleted, with its images, 30 days after its day, or sooner if you delete it. Sending one to a client makes a link, described below.
Links you share
When you share a post or a grid as a link, a copy of it is stored on our servers so the people you send the link to can open it: the images (resized first), the caption, and the profile name, handle and picture you entered. Anyone who has the link can see that copy. Links are long random addresses, they are not listed anywhere, and they are kept out of search engines.
The copy stays until you delete the link from your account, which also deletes its stored images.
When someone approves or comments on a link, we store the name they give and what they wrote, show it to the person who shared the link, and email that person to say a response has arrived.
Connecting an X account
Some accounts can connect an X account, so that posts planned on the calendar are published on X at the time set for them. You connect it on X's own page, and X then gives us a key to that account. We store the key encrypted, with the account's X username and ID and the client it posts for.
We use the key to publish the posts you schedule, with their text and images, and for nothing else. X shows a longer list of what an app with posting access could do. We do not read your timeline or messages, follow or unfollow, like, repost, or change your profile. When a post is published we keep the ID X gives it, so the calendar can link to it, until the calendar post is deleted.
You can also connect an account from a link someone sends you. The page it opens names who is asking, and the account you connect is then used for their posts, in the same way. Your X password never reaches us: you sign in on X's own page.
Disconnecting the account in your account settings deletes the key straight away. You can also remove PostDecks on X, under Apps and sessions in your settings, which stops the key working.
Connecting Claude
Some accounts can let Claude work on their calendar, by pressing Allow on a PostDeckspage or with a token made in account settings. Claude then sees and changes the same clients and calendar posts you do, and nothing else in your account. We keep the app's name, when you allowed it and when it was last used, and a one-way hash of each key, never the key itself. What you ask Claude and what it answers stays between you and Anthropic: we see only the calendar changes it makes.
Disconnecting it, or revoking a token, in your account settings stops it straight away.
Analytics
We use Vercel Web Analytics to understand aggregate usage, such as how many people visit and which formats are popular. It is privacy-friendly: it uses no cookies, sets no persistent identifiers, and does not follow you across other websites. The data is anonymous and aggregated, and cannot be used to identify you. You can read more in the Vercel Web Analytics privacy documentation.
Your privacy choices
If you are in the UK or EU, we ask for your consent before any advertising cookie is set, and you can decline. Everywhere else, measurement is on by default and you can turn it off at any time using the button below. Some privacy laws, including California's, treat this kind of advertising measurement as “sharing”, so this button is how you opt out.
Hosting and third parties
The site is hosted on Vercel, which processes basic request information such as your IP address transiently in order to serve the page and produce anonymous analytics. Accounts, saved items and shared links are stored with Supabase, which provides our database, sign-in and file storage. Email is sent through Resend. Advertisers pay through Stripe, and we never see their card details. If you connect an X account, the posts you schedule are sent to X, which handles them under its own privacy policy. These companies act on our instructions, and some of them process data outside the UK.
We never sell your personal data. The only data shared for anyone else's purposes is the advertising measurement described above, which you can turn off at any time.
Your rights
If you only preview and export, we hold nothing about you. If you have an account, you can delete your links, saved clients, grids and calendar posts, and disconnect an X account, yourself at any time. You can also ask us for a copy of what we hold, to correct it, or to delete your account and everything in it, by writing to hello@postdecks.com. If you are in the UK you can complain to the Information Commissioner's Office if you think we have handled your data wrongly.
Changes to this policy
We may update this policy from time to time. The date above reflects the most recent change.