Privacy Policy
Last updated: November 2026
In short
- Postbelt only processes what it needs to post your videos.
- Your data at Postbelt stays in the EU, on Hetzner servers in Germany, with encrypted backups in a second Hetzner data centre in Finland. Current exception: emails to us, see section 3.
- Postbelt does not sell data and does not use it for advertising.
- Videos are deleted 7 days after posting, access immediately when you disconnect an account.
1. Who is responsible
Gillian Scharf, Kudlichgasse 21/7, 1100 Vienna, Austria
Email: gillian@videowien.at · VAT ID: ATU79919705
Postbelt is a service by Gillian Scharf. Further details in the Imprint.
2. This website
The website postbelt.eu runs on a server of Hetzner Online GmbH in the EU. When you visit it, the server processes technically necessary data (IP address, date and time, page requested, browser type) to deliver the page securely, and keeps it only as long as needed for that. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
The website sets no cookies, uses no analytics or advertising services and loads nothing from third-party servers. The font is served from our own server.
3. Your Postbelt account
To sign in at app.postbelt.eu we need your email address. You receive a sign-in link; there is no password. After you sign in, the app sets a technically necessary cookie to keep you signed in. For your posts, Postbelt stores the video, the caption, the platform settings (such as the YouTube title), the scheduled time, the status, and the post ID and link at the platform. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).
Email and waitlist: if you write to us or join the waitlist, we use your email address only to reply or to tell you when Postbelt launches, and delete it afterwards. Our mailbox is currently hosted by Google (Google Workspace), so emails to us are held by Google until Postbelt has a mailbox with a provider in the EU. The legal basis is your request (Art. 6(1)(b) and (f) GDPR).
4. Connected platform accounts
You connect each account yourself through the platform's own sign-in page (OAuth). Postbelt never receives your password, only an access token with the permissions you agree to. Postbelt only requests the permissions it needs to post and does not read messages, contacts or analytics. Platforms are added step by step; this section applies to each one as soon as it is available in Postbelt.
| Platform | What Postbelt receives and stores | What for |
|---|---|---|
| YouTube | Channel ID and channel name, access (encrypted) with two permissions: upload videos and thumbnails; read the channel name, channel ID and status of videos uploaded through Postbelt | Upload videos to your channel, set title, description, thumbnail and publish time, then check status and link |
| Account ID and username, access to publish (encrypted) | Publish videos and reels, check status and link | |
| Page ID and page name, access token and page token (encrypted) | Publish videos on your page, check status and link | |
| TikTok | Account ID and display name, access to upload (encrypted). The privacy options and maximum video length your account allows are requested from TikTok before each post and not stored. | Upload videos or place them as drafts in your TikTok app, check status |
| X | User ID and username, access to post (encrypted) | Post videos, check status and link |
| Member ID and name, access to post (encrypted). Postbelt stores no other profile data. | Post videos on your behalf |
For each account, Postbelt also stores the permissions granted and when the access expires. Access and refresh tokens are stored only in encrypted form.
When you schedule a video, Postbelt sends it to the platform you chose at the scheduled time. Once published, the platform processes it under its own privacy policy.
5. YouTube API Services
Postbelt uses the YouTube API Services to upload and publish videos to your YouTube channel on your behalf. By using the YouTube feature, you agree to the YouTube Terms of Service. Google's processing is governed by the Google Privacy Policy.
Postbelt requests two permissions from Google: upload videos and thumbnails (youtube.upload), and read the channel name, channel ID and status of videos uploaded through Postbelt (youtube.readonly). Postbelt does not read comments, analytics or any other videos. Postbelt uses this data only to post your videos and shares it with no one. Postbelt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke access at any time: in Postbelt by disconnecting the channel, or in your Google Account at security.google.com/settings/security/permissions. After you revoke access, Postbelt deletes the stored data immediately, within 30 days at the latest.
6. Sharing
Postbelt only shares your data where the service requires it:
- with the platform you want to post to, on your behalf;
- with our subprocessors, see Subprocessors;
- if you use Postbelt through an agency, with that agency: it sees your connected accounts by name, your posts and their status, but never your access tokens.
Postbelt does not sell data, does not use it for advertising and does not pass it on to data brokers.
7. Through an agency
If you use Postbelt through an agency's portal, the agency is the controller of your data and Postbelt processes it on the agency's behalf under a data processing agreement (Art. 28 GDPR). Questions about your data are best sent to the agency, but you can also contact us.
8. Retention
| What | How long |
|---|---|
| Videos | until 7 days after posting; cancelled videos immediately |
| Access to a platform account | until you disconnect the account; then deleted immediately and revoked at the platform |
| Data after you revoke access at Google | Postbelt deletes it immediately, within 30 days at the latest |
| List of your posts (time, status, link) | as long as your Postbelt account exists |
| Error log | 30 days |
| Log of who connected, disconnected, posted or deleted what and when | 12 months |
| Your entire Postbelt account | until you delete it; then immediately, including revoking all access |
How to delete your data is explained under Delete your data.
9. Security
Access tokens for your accounts are stored only in encrypted form. All connections are encrypted over HTTPS. More under Security.
10. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Write to gillian@videowien.at. You can also lodge a complaint with a supervisory authority; in Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
11. Changes
If this policy changes, the new version is published here with a new date. We inform signed-in users of material changes by email.