Privacy policy.

This Privacy Policy explains how Forceplay OÜ (“PostQueen”, “we”, “us”) collects, uses, shares and protects personal data when you visit postqueen.ai, use the PostQueen app at app.postqueen.ai, use our public API and MCP server, or use the PostQueen browser extension. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act, the UK GDPR, and the platform rules of the networks you connect through us.

1. Who we are

The controller of your personal data is Forceplay OÜ, a private limited company registered in Estonia under registry code 17013892, VAT number EE102906853, at Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Estonia. Contact us about anything in this policy at support@postqueen.ai. A person reads every message.

We have not appointed a data protection officer, because our processing does not require one under GDPR Article 37. Privacy questions and requests go to the same address. As we are established in the EU, we have no separate EU representative.

2. What this policy covers, and our role

We are the controller for the data we need to run your account, the website, billing, support and security. If you are a business and your workspace contains personal data about other people, for example your clients, their followers or your teammates, you decide why that data is in PostQueen, and we process it on your behalf as your processor. Email us if you need a data processing agreement under GDPR Article 28.

Each network you connect (for example Meta, TikTok, X or Google) is a separate controller of the data on its own platform, under its own privacy policy. What you publish through PostQueen becomes subject to that network’s terms once it is published.

3. The data we collect

Account and workspace

Your name, email address, password (stored only as a one-way hash), profile photo and bio if you add them, time zone, language, theme and notification settings, the workspaces you belong to and your role in each, and the team members you invite. If you sign in with Google, we receive your Google account ID, name, email address and profile picture. If you sign in with a one-time email code, we store the code only as a hash, and it stops working after 10 minutes. The record of the request, with your email address and the IP address that asked for it, is deleted about a day after the code expires.

Connected social accounts

When you connect a channel, we store the credentials that network needs us to hold to publish on your behalf, plus the account’s basic profile details (account ID, name, username and picture). For a network with an OAuth sign-in, that is the access token and refresh token the network issues, never your password. Networks without one ask for something else: Bluesky an app password, Lemmy and Listmonk a username and password, Nostr a private key, and WordPress, DEV, Hashnode and Moltbook an application password or API key. Skool has no public API either, so the PostQueen browser extension hands us two of your Skool session cookies instead. Section 4 lists what we receive from each major network.

Content you create

Posts, drafts, captions, media, first comments and thread replies, schedules, signatures, saved sets, customer groups, RSS feeds for Auto Post, webhook addresses, and notes or comments your team leaves on previews. After a post goes out we keep its ID and link on the network, any error the network returned, and daily snapshots of its statistics.

AI features

The instructions you give the AI Copilot and the writing assistant, the Copilot conversations (kept so you can return to them), and the images and videos you generate.

Billing

Stripe processes payments for us. We receive your name, email address, billing address, VAT ID if you give one, plan, subscription status, invoices and limited card details (brand, last four digits and expiry date). We never receive or store the full card number. To keep free trials to one per person, when a trial starts we also keep the card fingerprint Stripe gives us (an identifier of the card that is not its number), whether the card is prepaid, and a one-way hash of your email address.

API, MCP and connected apps

Your workspace API key, the apps you approve to act for you through OAuth (for example an AI assistant using our MCP server), and records of the requests they make.

Technical and security data

IP address, browser and device details (user agent), sign-in and request times, server logs, and reports of errors in the app. The IP address and browser you used are also recorded on your account. On the sign-in code form, Cloudflare Turnstile checks that you are not a bot using your IP address and browser signals.

Support

The messages you send us and our replies.

Website visitors

When you visit postqueen.ai, Vercel, our website host, processes your IP address and request details to deliver the page, and tells the site the country the request comes from, so it can apply the cookie rules for your region. Vercel Web Analytics and Speed Insights also record the page, the site that sent you, your country, browser, device type and page loading speed, without a cookie: in the EU/EEA, the UK, Switzerland and Türkiye only if you turn on Analytics in the cookie settings, and elsewhere until you turn it off. If you arrive through an affiliate’s link, the site keeps that affiliate’s code for 90 days and passes it to the app when you sign up, and Dub, which runs our affiliate program, records the click and keeps its ID in a cookie for 90 days. If you then subscribe, the app adds that ID to your customer record at Stripe, and Dub reads it there with the subscription’s payments, so the affiliate can be paid a commission. Details are in the Cookie Policy.

Where the data comes from

Most of it comes from you. The rest comes from the networks you connect, through their official APIs and only with your authorization; from Google if you sign in with Google; from Stripe about your payments; and from your use of the service. If someone invites you to their workspace, your email address comes from them. The public profiles of people you mention come from the network they are on.

4. Data from the networks you connect

We access a network only after you connect it and grant the permissions it shows you, and we request only what the features below need. For every network the same rules apply:

• We use the data only to publish what you schedule to the accounts you choose, to show you those accounts and their results inside PostQueen (in the app, the API, the MCP server and the AI Copilot), and to keep the connection working.
• We do not sell, license or rent it, and we do not buy platform data. We do not use it for advertising, retargeting or ad measurement, to build or add to profiles of anyone, for surveillance, or to make decisions about anyone’s eligibility for housing, work, insurance, credit or anything else.
• We share it only with the processors in section 7 that help us run the feature you are using, and where the law requires it. If you ask the AI Copilot about your results, the statistics it reads are sent to OpenAI to write the answer, and for nothing else.
• People at PostQueen look at it only when you ask us to (for example in a support request), when it is needed to investigate security or abuse, or when the law requires it.
• We keep it only as long as section 9 says, and you can have it deleted at any time as described on Delete My Account.

Facebook, Instagram and Threads (Meta)

• Facebook Pages: your Facebook user ID, name and profile picture, to identify the connection; the Pages you manage and the businesses you can access, to let you pick Pages (Page ID, name, username, picture and Page access token); the IDs and links of the posts, photos, videos, stories and comments you publish; and Page and post insights such as views, reactions, clicks, video views and follows.
• Instagram professional accounts (business or creator, connected directly or through a Facebook Page): account ID, username, name and profile picture; the IDs and links of the posts, reels, stories and first comments you publish; and insights such as views, reach, likes, comments, shares, saves and follower count.
• Threads: account ID, username and profile picture; the IDs and links of the posts and replies you publish; and insights such as views, likes, replies, reposts and quotes.

Insights about comments are counts. We do not read or store the text of other people’s comments. We use this data only as described above, in line with the Meta Platform Terms and Developer Policies. To have it deleted, delete your account or email us, and we delete it within one month. Removing a channel stops all access at once; its profile and the statistics of its past posts stay in your workspace until you delete your account or ask us. To cut off access at Meta as well, remove PostQueen in your Facebook, Instagram or Threads settings. All of this is explained on Delete My Account.

YouTube and other Google data

PostQueen uses YouTube API Services. When you connect a YouTube channel we receive your Google account’s name, email address and picture, your channel’s ID, name and picture, the IDs and links of the videos you upload through us, and YouTube Analytics for your channel and those videos, such as views and subscribers gained and lost. We use it only to upload the videos you schedule and to show you their results. By using YouTube features you are also bound by the YouTube Terms of Service (opens in a new tab), and Google handles data under the Google Privacy Policy (opens in a new tab).

PostQueen’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. We delete YouTube data we hold about you within 7 days of your request. You can revoke our access at any time on your Google Account’s security settings page (opens in a new tab).

TikTok

Your TikTok account ID, display name, username, avatar and public profile details; your follower, following, like and video counts; the list of your videos and their statistics; and the IDs and links of the videos you publish through us. We use them only to publish the videos you schedule and to show you their results.

X

Your X account ID, name, username and profile image; the posts and replies you publish through us, with their IDs; and their public metrics such as views, likes, reposts, replies, quotes and bookmarks. We use them only to publish what you schedule, to run the Auto Plug and repost rules you set, and to show you results. We do not send X data to anyone for advertising. If you delete or change a post on X and ask us to update our copy, we do it within 24 hours. When you type @ to mention someone on X, we look up matching public profiles (name, username and picture) and keep them in a cache to suggest them again.

Skool and the PostQueen browser extension

Skool has no public API, so you connect it with the PostQueen browser extension for Chrome. The extension does one thing: it reads the client_id and auth_token cookies that skool.com set in your browser when you signed in to Skool, and sends them to PostQueen.

• When it reads them: when you choose Skool in Add Channel and accept the notice PostQueen shows you, and after that once a day while the Skool channel stays connected and Chrome is running, so the connection does not lapse.
• What it does not read: any other cookie, any other website, your browsing history or the content of the pages you visit. Only pages on app.postqueen.ai can talk to the extension.
• What we receive and keep: the two cookies, stored encrypted with your other channel credentials. With them we read your Skool user ID, name, username and picture, which we keep as the channel’s profile, and the groups and categories you can post to when you pick one in the composer. We use them only to publish what you schedule to Skool, under the rules above.
• What stays in your browser: for each Skool channel you connect, a signed token that lets the daily refresh update that one channel, and the address of PostQueen, kept in the extension’s own storage. The extension has no analytics and runs no code from anywhere else.
• Stopping it: when you remove the Skool channel in PostQueen we refuse every later refresh for it, and uninstalling the extension deletes what it stored.

Our use of information received through the extension adheres to the Chrome Web Store User Data Policy (opens in a new tab), including the Limited Use requirements.

Other networks

For every other network you connect, we receive the account’s ID, name and picture, the IDs and links of what you publish, and statistics where the network offers them, and we use them under the same rules. Mentions on Bluesky, Discord and LinkedIn work as they do on X: we look up matching profiles on that network and keep their name, username and picture in the same cache. On Discord these are members of the server you post to, and on LinkedIn they are company pages.

5. Why we use data, and our legal bases

Where we rely on legitimate interests, our interests are keeping PostQueen running and fixing its faults, keeping PostQueen and its users safe from attacks, fraud and abuse, keeping free trials fair, telling you about your own posting activity, telling our customers what is new in PostQueen, making it quick to mention people in your posts, protecting our legal position, measuring how our website is used where the law does not require consent first, applying the cookie rules that hold where you are, and paying affiliates for the customers they send us. We have weighed them against your rights and kept the data to the minimum. You can object at any time (section 10).

6. AI features and automated decisions

The AI Copilot and the writing assistant produce drafts, captions, images and videos when you ask for them. They are suggestions: a person in your workspace decides what to schedule and publish. To produce them, we send the providers in section 7 only what the feature needs, such as your instruction, the post text or media you chose, and for the Copilot the data it reads to answer you. We do not use your content to train AI models, and we do not use AI to profile you.

We make no decision based solely on automated processing that has legal or similarly significant effects on you (GDPR Article 22). Three automatic checks exist: Stripe’s fraud screening may decline a payment; a social account that was already connected to another PostQueen account can only be added during a trial if the trial is ended early; and a free trial is not started when the card or email address already had one or the card is prepaid, though you can still subscribe without a trial. If any of these affects you, email us and a person will review it.

7. Who receives data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use these processors, each under a contract that limits them to acting on our instructions and protecting the data:

Data also goes to these recipients, who act as separate controllers:

• The networks you connect, which receive what you publish and the requests we make for you.
• Google, when you choose Sign in with Google.
• Stripe, for its own fraud prevention and legal duties as a payment provider.
• The affiliate whose link you followed, who sees in Dub the click (your country, device and the site that sent you) and, if you subscribe, the sale it earned them.
• Services you connect yourself: an AI assistant or script you give an API key or OAuth approval, the webhook addresses you set, and third-party media tools such as HeyGen or Reel.Farm if you add your own key for them. They receive what you direct us to send.
• Your team: members of a workspace see its channels, posts and statistics according to their role.
• Professional advisers such as our accountant and lawyers, under confidentiality.
• Authorities and courts, only where the law requires it, and a buyer or successor if our business is ever transferred, under this policy.

8. International transfers

Our servers and file storage are in the EU. Some processors in section 7 are in the United States or other countries outside the EEA, or can access data from there. Where that happens we rely on an adequacy decision of the European Commission, including the EU and US Data Privacy Framework for certified companies, or on the European Commission’s Standard Contractual Clauses, with extra safeguards where needed. For the United Kingdom we use the UK equivalents. Email us for a copy of the safeguards that apply.

9. How long we keep data

10. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy of it (Article 15).
• Rectification of data that is wrong or incomplete (Article 16). You can correct most of it yourself in Settings, then Account.
• Erasure (Article 17). See Delete My Account.
• Restriction of processing, for example while the accuracy of your data or our grounds for using it are checked, or when you need it kept for a legal claim (Article 18).
• Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider (Article 20).
• Objection to processing based on legitimate interests (Article 21). We then stop unless we have compelling legitimate grounds or need the data for a legal claim. You can object to product news at any time, free of charge and without giving a reason: turn it off in Settings, then Notifications, or use the unsubscribe link in any of them, and we stop.
• Withdraw consent at any time, for example in Cookie Settings in the footer (Article 7(3)). Withdrawal does not affect what was done before.
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22).

To use any right, email support@postqueen.ai from the address on your account. We may ask you to confirm your identity. We answer within one month; if a request is complex we may extend that by up to two more months and will tell you why within the first month. Requests are free unless they are clearly unfounded or excessive.

11. Complaints

We would like to hear from you first, but you always have the right to complain to a supervisory authority, in particular in the EU country where you live or work or where the issue happened. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee, phone +372 627 4135, website www.aki.ee (opens in a new tab).

12. Do you have to give us data?

To create an account we need an email address and a way to sign in. To start a trial or a paid plan we need billing details, and to publish to a network you must connect it. Without these we cannot provide the service. Everything else, such as a profile photo, is optional.

13. Children

PostQueen is not directed at children. You must be at least 16 to use it. We do not knowingly collect data from anyone under 16, and if we learn that we have, we delete it. If you believe a child has an account, email support@postqueen.ai.

14. Security

All traffic to PostQueen is encrypted in transit with TLS. Passwords and sign-in codes are stored only as one-way hashes, sign-in is protected by rate limits and bot checks, and changing your password ends the sessions that existed before. Service data, including channel credentials, is kept on access-controlled servers that only the people who run the service can reach, and is backed up off the server. No system is perfectly secure, so please use a strong, unique password. If a personal data breach puts your rights at risk, we report it to the Estonian Data Protection Inspectorate within 72 hours and tell you without undue delay where the law requires it.

15. Cookies and similar storage

The website uses essential storage (your cookie choice, the cookie rules for your region, and the affiliate whose link you followed with Dub’s click ID) plus optional page statistics, which run only if you turn them on in the EU/EEA, the UK, Switzerland and Türkiye, and until you turn them off elsewhere. The app uses cookies that are needed to sign you in, keep you secure and remember your settings, our payment provider sets its own security cookies, and Dub’s script keeps the click ID if an affiliate’s link leads straight to the app; the bot check sets none. The full list is in the Cookie Policy. You can change your website choice at any time with Cookie Settings in the footer.

16. United Kingdom

If you are in the United Kingdom, the UK GDPR gives you the same rights as section 10, and you can complain to the Information Commissioner’s Office at ico.org.uk (opens in a new tab).

17. California and other US states

If the California Consumer Privacy Act as amended by the CPRA, or a similar US state law, applies to our processing of your data, this section applies too. In the last 12 months we collected the categories in section 3: identifiers (name, email, IP address, account IDs), commercial information (plan and payment history), internet activity (use of the service, logs), the content you create, and account log-in credentials. We collect them for the purposes in section 5, disclose them only to the recipients in section 7 for those business purposes, and keep them as section 9 says.

We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information beyond what is needed to provide the service, so there is nothing to opt out of. You may ask to know, access, correct or delete your personal information by emailing support@postqueen.ai. We verify requests against the email on the account, an authorized agent must show your written permission, and we will not treat you differently for using these rights.

18. Changes to this policy

We will post any change here and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect, and ask for your consent where the law requires it.

19. Contact and company information

• Company: Forceplay OÜ
• Service: PostQueen, at postqueen.ai and app.postqueen.ai (opens in a new tab)
• Registry code: 17013892 (Estonian Business Register)
• VAT number: EE102906853
• Registered address: Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Estonia
• Email: support@postqueen.ai
• Supervisory authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Related documents: Terms of Service, Cookie Policy, Delete My Account and Trust & Safety.