Privacy Policy

1.Who we are

Postsorter ("we", "us") runs this website and the Postsorter browser extension. For the personal data described below we are the controller. You can reach us at support@postsorter.in.

2.What we collect

We only collect what is listed here.

• Account: your email address, username, first and last name, and your password. The password is stored only as a salted hash by our authentication provider. We cannot read it.
• Optional profile details: country and profile picture, if you add them. If someone invited you, we also store the referral code you signed up with.
• Plan and payments: which plan you bought, when it starts and ends, and the Paddle order number. Paddle collects your card or PayPal details, billing name, address and tax details. We never see or store your card number.
• Crypto payments: the currency, the transaction hash, the wallet address you paid from, and any note you add, so we can verify your payment.
• Browsers using your plan: for each browser where you use the extension we store the browser name and version, the operating system, a random install ID, the approximate country (from the connection), when it was last seen, and its login session ID. This powers the Devices page and lets you log out or block a browser.
• Messages: your name, email and message when you contact us.
• Security data: to stop abuse we keep short-lived counters per IP address. The address is scrambled (hashed) before it is stored. Our hosting provider also keeps standard server logs.

3.What the extension does and does not do

The extension works inside your own browser on the Instagram and TikTok pages you open. Sorting, statistics and downloads are done on your device.

To know whether your plan is active, the extension contacts our server with your login session, its random install ID, and the browser and operating system names. It is not sent the content of the Instagram or TikTok pages you view, your Instagram or TikTok login, or your browsing history.

4.Why we use it

• To create your account, sign you in and keep it secure (contract).
• To sell, activate and support your plan, and keep records required by law (contract and legal obligation).
• To limit abuse, fraud and brute-force login attempts, and to keep the service reliable (our legitimate interest).
• To answer your messages (contract / legitimate interest).
• We do not use your data for advertising, profiling or automated decisions, and we do not sell it.

5.Cookies and local storage

We use only what the site needs to work: sign-in cookies that keep you logged in, and a small setting in your browser that remembers your light or dark theme. We use no advertising or tracking cookies and no analytics.

If you press play on the demo video, it is loaded from YouTube (youtube-nocookie.com), which may set its own cookies under its own policy.

6.Who we share it with

Only the companies that help us run the service, and only what they need:

• Supabase: database, sign-in and file storage (your account data, plan records, profile picture).
• Paddle: payment processing. Paddle is the merchant of record and also an independent controller of your payment data. See paddle.com/legal/privacy.
• Our hosting provider: serves the website and runs our server code.
• An email provider: sends sign-up confirmation and password-reset emails.

We may disclose data if the law requires it or to protect our rights and users from fraud or abuse. We do not sell or rent personal data.

7.International transfers

Our providers may process data in countries other than yours, including the United States and the European Union. Where required, they rely on safeguards such as the EU Standard Contractual Clauses.

8.How long we keep it

• Account data, plan records, devices and notifications: until you delete your account.
• Payment records: Paddle keeps them as long as tax and accounting law requires, even after your account is deleted.
• Messages: until you ask us to delete them.
• Rate-limit counters: a few minutes to a few hours.

9.Your rights and choices

Depending on where you live (for example under the GDPR or UK GDPR) you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, and move it to another service. You can also withdraw any consent you gave.

• Edit your name, username, country and picture under Settings in your dashboard.
• Delete your account yourself under Settings. This removes your profile, plans, devices, notifications, referrals, crypto submissions and picture. It cannot be undone and it does not refund a plan.
• See, log out or block your browsers under Devices.
• For anything else, email support@postsorter.in. We reply within 30 days. If you think we handled your data wrongly you can complain to your local data protection authority.

10.Security

Connections use HTTPS. Passwords are hashed. Database access is restricted so each account can only read its own records. Sensitive actions such as deleting an account ask for your password again. No system is perfectly secure; if we learn of a breach that affects you we will tell you as the law requires.

11.Children

Postsorter is not for children under 16 and we do not knowingly collect their data. If you think a child has given us data, email support@postsorter.in and we will delete it.

12.Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for big changes, tell you by email or in your dashboard.

13.Contact

Questions or requests: support@postsorter.in.