Privacy Policy for PostNest

Last updated: June 24, 2026

This Privacy Policy explains how PostNest ("PostNest", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you use the PostNest service available at https://postnest.qasimmehmood.com (the "Service"). PostNest is operated by Qasim Mehmood, an independent solo developer.

In short (plain-English summary): PostNest is an independent tool that connects to your Pinterest business account using Pinterest's official OAuth 2.0 and REST API v5 so you can create, schedule, and manage Pins and boards, and view your read-only Pinterest analytics. PostNest authenticates only through Pinterest's OAuth flow using access tokens — we never ask for, collect, or store your Pinterest password or login credentials. We access your Pinterest data only to provide this service to you, the account holder. We call the Pinterest API at the time of use rather than stockpiling your Pinterest data. We never sell your data or share Pinterest API data with any third party (including advertising services). We store your OAuth tokens encrypted and let you disconnect or delete them at any time. You remain responsible for complying with Pinterest's own Terms and policies. PostNest is not affiliated with, sponsored by, or endorsed by Pinterest.

1. Introduction and Scope

PostNest is a software tool that connects to a user's Pinterest business account through Pinterest's official OAuth 2.0 authorization and REST API v5 in order to:

create, schedule, edit, publish, and manage Pins and boards (organic content publishing); and
retrieve and display Pinterest analytics and insights data (read-only; PostNest does not modify, run, or manage advertising campaigns).

This Privacy Policy applies to all users of the Service and to all personal information processed through the Service. It should be read together with our Terms of Service at https://postnest.qasimmehmood.com/terms. By using PostNest, you acknowledge that you have read and understood this Privacy Policy.

This Service is primarily intended for the operator and/or a small number of connected Pinterest business users. The canonical, current version of this policy is always published at https://postnest.qasimmehmood.com/privacy.

We are committed to being honest and transparent about what PostNest does and the data it accesses. PostNest's functions are limited to the publishing/scheduling and read-only analytics features described above; we do not misrepresent these functions or our level of access to Pinterest.

2. Who We Are — Data Controller and Contact Details

For the purposes of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and similar laws, the data controller responsible for your personal information is:

Operator: Qasim Mehmood (independent / solo developer, operating the PostNest service)
Contact for privacy matters: [email protected]
Website: https://postnest.qasimmehmood.com

PostNest is operated by an independent solo developer and is not affiliated with, sponsored by, or endorsed by Pinterest. Pinterest is a separate and independent data controller in respect of the data held on its own platform (see Section 6).

Data Protection Officer / EU–UK Representative: Given the small scale of the Service, no Data Protection Officer and no EU or UK representative has been formally appointed. For all privacy questions and requests, please use the operator contact above ([email protected]).

3. Information We Collect and Its Sources

We collect and process the following categories of personal information. We collect some of it directly from you, and we obtain some of it from Pinterest via its API when you authorize the connection.

3.1 Information obtained from Pinterest via the API (with your authorization)

Pinterest OAuth access and refresh tokens — credentials issued by Pinterest that allow PostNest to act on your behalf via the Pinterest API. We obtain these tokens only through Pinterest's OAuth 2.0 flow; we never collect your Pinterest username, password, or login credentials.
Pinterest account / profile information — such as your Pinterest account identifier and basic profile details exposed through the API.
Your boards and Pins — the boards and Pins associated with your connected account, as needed to display and manage them.
Pinterest analytics / insights data (read-only) — performance and insights data about your own Pinterest account and content.

The source of the data in this Section 3.1 is Pinterest, accessed through its REST API v5 after you grant authorization through Pinterest's OAuth 2.0 flow.

3.2 Information you provide directly

Content you create or schedule through PostNest — for example, Pin text, links, images, target boards, and scheduling times.
Basic registration / account data — for example, your email address, if you create an account.

3.3 Information collected automatically

Technical and usage data — such as your IP address, server logs, device/browser information, and similar diagnostic data.
Cookies and local storage — including essential session identifiers and OAuth state values (see Section 13).

We do not intentionally collect special-category/sensitive personal data through the Service, and we ask that you do not submit such data through PostNest. To the extent OAuth tokens or account log-in identifiers are treated as "sensitive personal information" under certain laws (such as the CPRA), we use them solely to provide the Service to you and not for any purpose that would require an opt-out (see Section 11).

4. How and Why We Use Your Information

We use the information described above for the following purposes:

Connecting your account — to authenticate and connect your Pinterest business account via OAuth 2.0.
Publishing and managing content — to create, schedule, edit, publish, and manage your Pins and boards.
Analytics display — to retrieve and display your read-only Pinterest analytics and insights.
Operating and securing the Service — to run, maintain, secure, debug, monitor, and improve the Service, and to prevent fraud and abuse.
Communicating with you — to respond to your requests and send essential service-related messages.
Legal compliance — to comply with applicable legal obligations and to establish, exercise, or defend legal claims.

Purpose limitation. Consistent with Pinterest's Developer Guidelines, we only use information from your account to provide the Service to you. We do not combine your Pinterest account information with information from other people's accounts or with information from other services.

No automated decision-making. PostNest does not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you.

5. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases under Article 6(1):

Purpose	Legal basis
Connecting your Pinterest account; creating, scheduling, publishing, and managing Pins and boards; displaying your analytics	Performance of a contract / steps to provide the service you requested — Art. 6(1)(b)
Securing, operating, logging, debugging, preventing fraud, and improving the Service	Legitimate interests — Art. 6(1)(f)
Non-essential cookies / optional analytics (where used)	Consent — Art. 6(1)(a)
Meeting legal obligations and responding to lawful requests	Legal obligation — Art. 6(1)(c)

Legitimate interests. Where we rely on legitimate interests, those interests are operating a secure and reliable service, protecting the Service and its users against fraud and abuse, and maintaining and improving the Service. We balance these interests against your rights and freedoms. You may object to processing based on legitimate interests (see Section 11).

Withdrawing consent. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Necessity of providing data. Connecting a Pinterest account and providing the data needed to do so is necessary to use PostNest. Without it, the core functions of the Service (publishing/scheduling content and reading analytics) cannot operate.

6. Pinterest Connection, OAuth Tokens, and API Data

This section explains specifically how PostNest interacts with Pinterest.

6.1 How the connection works

PostNest connects to your Pinterest business account using Pinterest's official OAuth 2.0 authorization flow and REST API v5. When you authorize the connection, Pinterest issues PostNest an access token (and a refresh token) that PostNest uses to read data from Pinterest and to write content (Pins and boards) to Pinterest on your behalf. PostNest only acts within the scope you authorize. PostNest authenticates exclusively via these OAuth tokens; it does not solicit, collect, or use your Pinterest password, session cookies, or other login credentials, and it does not act on any account you have not connected and authorized.

6.2 What Pinterest data we access

Through the API, PostNest accesses your Pinterest account/profile information, your boards and Pins, and your read-only analytics/insights data, and it writes the Pins and boards you create or schedule. PostNest accesses information only from accounts you have connected and authorized.

6.3 How OAuth tokens are stored and secured

Tokens are obtained only with your authorization through Pinterest's OAuth flow.
Tokens are encrypted at rest and transmitted only over HTTPS/TLS.
Tokens are never placed in insecure client-side storage such as browser localStorage.
Access to tokens is restricted and they are used solely to call the Pinterest API on your behalf.
We keep our API access credentials private and confidential, as required by Pinterest's Developer Guidelines, and we do not use anyone else's credentials or allow others to use ours.

6.4 We do not stockpile Pinterest API data

Consistent with Pinterest's Developer Guidelines, PostNest does not persistently store information accessed through the Pinterest API. We call the Pinterest API at the time of use and rely only on minimal, short-lived caching (on the order of minutes) to render your current view. Any such cache holds only what is needed to display your current view, is automatically expired and actively swept, and is deleted when you disconnect — consistent with Pinterest's storage restrictions. Only stable Pinterest identifiers (such as your account, board, and Pin IDs) and your encrypted OAuth tokens are kept durably. PostNest does not run or manage Pinterest advertising campaigns and therefore does not rely on the Developer Guidelines' limited exception permitting storage of campaign analytics about a developer's own account.

6.5 No selling or third-party sharing of Pinterest API data

PostNest does not sell or share Pinterest API data with any third party, including any advertising service. Information obtained from your Pinterest account is used only to provide the Service to you, the account holder, and is only returned to that same account holder.

6.6 Independence, your Pinterest obligations, and Pinterest's own terms

PostNest is an independent tool and is not affiliated with, sponsored by, or endorsed by Pinterest. "Pinterest" is a trademark of its respective owner. PostNest accesses Pinterest solely through the official Pinterest API in accordance with Pinterest's Developer Guidelines and Developer/Platform Terms, and does not misrepresent its relationship with, or level of access to, Pinterest.

Your use of Pinterest, and the data held on Pinterest's platform, is also governed by Pinterest's own terms and policies, which you are responsible for reviewing and complying with, including the Pinterest Terms of Service and the Pinterest Privacy Policy at https://policy.pinterest.com/en/privacy-policy. Pinterest is an independent data controller for the data held on its platform, and that data is processed under Pinterest's own policies.

7. How We Share and Disclose Data

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as defined under the CCPA/CPRA. We do not use Pinterest API data for any form of online behavioral advertising. We disclose personal information only as described below:

Pinterest — data is read from and written to Pinterest via its API in order to provide the Service. Pinterest processes that data under its own policies (see Section 6).
Hosting and infrastructure providers / sub-processors — service providers that host and operate the Service on our behalf, each under contract and permitted to process data only to provide their services to us. Our current sub-processors are:
- Clerk — user authentication and account management;
- Neon — managed PostgreSQL database hosting;
- Vercel — application hosting and uploaded-image (Blob) storage;
- Inngest — background-job and scheduling infrastructure;
- Resend — transactional email delivery (where enabled).
Each has its own privacy policy. None of these providers is given Pinterest API data for advertising, and Pinterest API data flows only to Pinterest.
Legal and protective disclosures — where required to comply with applicable law, legal process, or enforceable governmental request, or to protect the rights, property, or safety of PostNest, our users, or others.
Business transfers — if the Service is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to this Privacy Policy.

We do not disclose Pinterest API data to any of the above parties for advertising purposes, and we do not return Pinterest account information to anyone other than the account holder it came from.

8. International Data Transfers

PostNest, its hosting providers, and Pinterest may process personal information in countries outside your own, including outside the European Economic Area ("EEA") and the United Kingdom. Where we transfer personal data internationally, we rely on an appropriate safeguard or transfer mechanism, which may include:

transfers to recipients covered by an adequacy decision, such as the EU–US Data Privacy Framework (and its UK extension), where applicable; and/or
the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Agreement/Addendum), together with supplementary measures where appropriate following Schrems II.

You may request information about the safeguards we rely on by contacting us at [email protected].

9. Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy, according to the following criteria:

OAuth access and refresh tokens — retained until you disconnect your Pinterest account, revoke access, or request deletion, after which they are invalidated and deleted.
Account/registration data (e.g., email) — retained for the life of your account and deleted within a reasonable period after account closure.
Content you create or schedule — retained as long as needed to provide the scheduling/publishing function, and then deleted or anonymized.
Pinterest API data — not persistently stored; it is fetched from the Pinterest API at the time of use and held only in short-lived, automatically-expired caches (on the order of minutes, actively swept and cleared when you disconnect), not durably retained, consistent with Pinterest's Developer Guidelines (which provide that, except for campaign analytics about a developer's own account, information accessed through the Pinterest API may not be stored). Because PostNest does not run advertising campaigns, it does not store any Pinterest API data under that exception.
Technical/usage logs — retained for a limited period (audit logs for up to ~90 days; raw webhook event logs for ~30 days) for security, diagnostics, and abuse prevention, then automatically deleted.

When personal information is no longer needed, we delete or anonymize it.

10. How We Protect Your Information

We implement appropriate technical and organizational measures designed to protect personal information, including:

Encryption in transit (HTTPS/TLS) and encryption at rest for sensitive data such as OAuth tokens;
access controls restricting who and what can access tokens, credentials, and personal data;
credential protection, keeping API access credentials private and confidential, in line with Pinterest's requirement to keep API access credentials private; and
monitoring and breach-handling practices to detect, respond to, and where required notify relevant parties of security incidents.

No method of transmission or storage is completely secure; while we strive to protect your information, we cannot guarantee absolute security.

11. Your Privacy Rights

Depending on where you live and the applicable law, you may have some or all of the following rights.

11.1 GDPR / UK GDPR rights

Access — to obtain confirmation of and a copy of your personal data.
Rectification — to correct inaccurate or incomplete data.
Erasure — to have your data deleted ("right to be forgotten").
Restriction — to restrict processing in certain circumstances.
Portability — to receive your data in a structured, commonly used, machine-readable format.
Objection — to object to processing based on legitimate interests.
Withdraw consent — at any time, where processing is based on consent.
Complaint — to lodge a complaint with your local data protection supervisory authority.

11.2 CCPA / CPRA rights (California)

The categories of personal information we collect, the sources of that information, the business purposes for which we use it, and the categories of third parties to whom we disclose it are described in Sections 3, 4, and 7. Subject to applicable law, California residents have the following rights:

Right to know / access the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties to whom it is disclosed.
Right to delete personal information.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information — note that PostNest does not sell or share personal information, and does not "share" it for cross-context behavioral advertising.
Right to limit use of sensitive personal information — note that PostNest uses any sensitive personal information (such as account log-in credentials/tokens) only to provide the Service and not for purposes that trigger this right.
Right to non-discrimination for exercising your rights.

11.3 How to exercise your rights

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on your request, and we will respond within the timeframe required by applicable law. You may use an authorized agent where the law permits.

12. How to Revoke Pinterest Access and Delete Your Data

You are in control of your connection to Pinterest at all times.

Disconnect within PostNest — use the disconnect option in PostNest to end the connection. This invalidates and deletes the stored OAuth tokens for that connection and stops further processing of your Pinterest data.
Revoke from Pinterest — you can also revoke PostNest's access from your Pinterest account's connected-apps / security settings. Once revoked, the tokens can no longer be used and PostNest's access stops.
Request deletion — to request deletion of your account and associated personal data (including stored tokens), email us at [email protected]. We will verify your request and complete it within the timeframe required by applicable law.

The effect of revocation or disconnection is that PostNest can no longer access your Pinterest account, and processing of your Pinterest data via the API ceases.

13. Cookies, Local Storage, and Tracking Technologies

PostNest uses a limited set of cookies and local storage:

Essential cookies — session identifiers (managed by our authentication provider) required to keep you signed in and operate the Service.
OAuth state (stored server-side) — the state value that secures the Pinterest authorization flow is generated and stored on our server (in our database), not in a browser cookie or local storage, and is passed only through the authorization redirect URL. (For clarity, Pinterest OAuth access and refresh tokens are likewise not kept in browser localStorage; they are stored encrypted server-side as described in Section 6.3.)
Functional local storage — a single theme preference (a theme key) is stored in your browser's local storage to remember your light/dark display choice. It contains no personal or tracking data and is not shared.
Non-essential cookies / analytics — none are currently used. If they are introduced in the future, they will only be set with your consent, and you can withdraw consent at any time.

You can control cookies through your browser settings; blocking essential cookies may break core functionality. Note that Pinterest may set its own cookies or use its own tracking technologies through its services and widgets, governed by Pinterest's own policies.

14. Children's Privacy

PostNest is not directed to or intended for children under 13 years of age (or under 16 in the EEA where applicable), and we do not knowingly collect personal information from such children. If we become aware that we have inadvertently collected personal information from a child below the applicable age, we will delete it promptly. If you believe a child has provided us personal information, please contact us at [email protected].

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" / "Effective date" date shown in this policy and post the updated policy at https://postnest.qasimmehmood.com/privacy. For material changes, we will take reasonable steps to notify you where appropriate. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Operator: Qasim Mehmood
Email: [email protected]
Privacy policy URL: https://postnest.qasimmehmood.com/privacy
Terms of Service: https://postnest.qasimmehmood.com/terms

This Privacy Policy is governed by and construed in accordance with the laws of Pakistan, without prejudice to any mandatory data-protection rights you may have under the laws of your country of residence.

Effective date: June 24, 2026