Privacy Policy

1. Accounts, verification codes, membership and quotas

When you register, sign in or use account benefits, the extension sends your email address, the verification code you enter or your session token to the PostFaro account service at aapi.13bit.cn. The server processes account identifiers, email addresses, sessions, membership types and expiry information, publishing quotas and related authorization records.

Email verification codes are sent through the Resend email service, which processes the recipient's email address and the verification email content. Verification code requests use the request IP address for rate limiting. Your session token is stored locally in the current browser and is used to verify your sign-in status when requesting account or quota services. Quota requests include the task identifier, operation mode and the number of platforms needed for settlement.

Optional membership purchases, in versions that support payments. When you start a purchase in the signed-in extension, the PostFaro backend sends Creem your account identifier, chosen plan, order identifier, and test/live environment marker to create checkout and verify benefit ownership. You submit card or other payment credentials directly to Creem's hosted checkout. PostFaro does not receive full card numbers or security codes. Creem processes checkout, billing, payment, and risk data under its Privacy Notice.

PostFaro stores order and product identifiers, amount, currency, payment status, activation records, and relevant timestamps to confirm payments, grant membership, and handle refunds or disputes. The extension stores pending order references and plans locally per account, not card details. Server payment keys are never sent to the extension. Some order records may need to be retained for settlement, disputes, or legal obligations; the scope of deletion will be explained when you request account-data deletion.

2. Data stored on your device

The extension uses the current browser's extension storage and IndexedDB to store draft text, selected media or references to local files, covers, publishing history and results, publishing combinations, preferences and some cached platform account status. Your configured AI service URLs, models, API keys and Webhook URLs are also stored locally.

Your content is processed when you use the publishing, import or AI features described below. Switching browsers, clearing extension data or uninstalling the extension may make local content unavailable. Please back up important content yourself.

3. Connecting to platforms and optional services at your request

• Third-party platform accounts and publishing. The extension uses existing platform sign-in sessions in your browser to read platform account identifiers, nicknames, profile pictures and related circles, groups and topics, helping you confirm the account and select destinations. When you fill in content or confirm publishing, it transmits the title, body, tags and selected images, video, audio or other media to the selected platforms. Filling in content may also upload media first or create a draft on the platform. The final publishing method depends on what the platform supports.
• Your configured AI services. You choose whether to configure AI features. When you verify a connection, generate adaptation suggestions or enable intelligent segmentation or destination selection, the extension uses your configured API key to request that service. Requests may include the relevant title, body, tags, candidate circles or topics, recent destination selection records and images used for segmentation. Please review the selected AI service's data handling rules before enabling it.
• Webhooks. When you configure and select a Feishu, DingTalk or WeCom bot as a destination, the extension sends the task's title and text content to that Webhook URL. Webhook URLs may contain access credentials, so please keep them secure.

Platforms, AI services and bot services handle the information they receive under their own rules. Before running a task, check the destination accounts, content and media, and confirm that you are willing to send this information to the relevant services.

4. Article link imports and web access

When you paste an article link and run an import, the extension requests that webpage or opens a background tab to extract the title, summary, body, cover and inline images, and may download related images. The destination website receives the access request. When extraction uses a tab, the visit may use your existing sign-in session on that website.

The extension's web access permissions support platform operations, article imports, custom AI services and other features. After importing, please check the content source, usage permissions and actual extraction results.

5. Optional local CLI and Native Messaging

After you install and use the PostFaro CLI, the extension exchanges task content, media information, extension and installation identifiers, browser context and task results with a local program through Chrome Native Messaging. A local Agent can use this information to request filling in content or confirming publishing. Related tasks and diagnostic records may also be stored locally.

Local agents can use the accounts command to inspect platform display names identified by the extension, detection results and cache times. The CLI does not return platform session cookies or access tokens. Failed detection is marked unknown; cached results do not prove a current login. Queries return through the local bridge and do not upload this information to the PostFaro backend. Platforms with only a configured destination, such as podcast links, are marked configured rather than verified as signed in. The CLI may request the official website’s public release manifest for update hints; this request does not include task content, media or platform session cookies.

Tasks initiated by the CLI also use account authorization and connect to destination platforms or your enabled AI and Webhook services as required by the task. Please provide task content and media access only to local programs you trust.

6. Product analytics and diagnostics

Network reporting for product analytics is currently disabled in PostFaro 1.0.0. The extension may generate feature events, task statuses and diagnostic records locally. The current analytics sending function does not send these events to an analytics endpoint. Necessary requests for account sign-in, membership quotas, destination platforms and optional services continue to operate as described in this policy.

When you choose to export or provide diagnostic information, please review the file contents first to avoid including personal information or credentials you do not wish to share.

7. Managing data, deletion and contact

You can delete drafts or publishing records in the extension, adjust publishing combinations and AI settings, or uninstall the extension through Chrome's extension management features. Before uninstalling, back up any local content you want to keep. Signing out of PostFaro removes the current session token from your device and attempts to revoke the current session on the server. Signing out and deleting an account are separate actions.

To access, correct or request deletion of account-related data stored on PostFaro's servers, or if you have questions about this policy, please contact [email protected] and describe your request. Do not send verification codes, session tokens, API keys or platform sign-in credentials by email.

Deleting local data or requesting deletion of a PostFaro account does not automatically delete information already sent to destination platforms, AI services or bot services. Manage that information through the relevant service. If our data handling practices change, we will update this page and its update date.