Privacy Policy

This policy describes how cloaked.agency handles data processed by Postiz, a self-hosted social media management platform operated at postiz.cloaked.agency. Postiz is operated by Jade Johnson Enterprises LLC (d/b/a cloaked.agency) from infrastructure in Arizona, United States.

When an authorized operator connects a social account through Postiz, we receive and store the following on our server:

• OAuth access and refresh tokens issued by the connected platform (Meta / Facebook / Instagram / Threads, TikTok, X / Twitter, and others as added). Tokens are stored encrypted at rest in a single-tenant PostgreSQL database.
• Account metadata returned by the platform during OAuth — typically the handle, display name, profile picture, list of Pages or business accounts the operator manages, and the scopes granted.
• Content you schedule or publish through Postiz — post text, media, publication time, and platform responses.
• Engagement analytics pulled from the platform — counters such as views, reactions, comments, and reach, when the platform’s API exposes them.
• Operator audit data — timestamps and operator identity for administrative actions inside Postiz (who scheduled what, who disconnected what).

• No end-user tracking cookies or analytics beacons.
• No advertising identifiers.
• No data shared with ad networks, data brokers, or third-party analytics providers.

All Postiz data resides on cloaked.agency-controlled servers in the Echo Lab environment in Arizona, United States. The database is single-tenant and is not replicated outside that environment. Backups are retained on cloaked.agency-controlled storage for disaster recovery.

• HTTPS is enforced for all browser and API traffic (Cloudflare TLS + origin certificates).
• Backend network traffic between Postiz components and the operator tunnel transits a private Tailscale mesh — not the public internet.
• OAuth tokens are encrypted at rest. Only authorized operators with database credentials can access raw tokens.

OAuth tokens and associated metadata are retained as long as the account remains connected. When an operator disconnects an account inside Postiz, the tokens are deleted immediately and associated metadata is scheduled for purge within 30 days.

cloaked.agency does not sell, rent, or share Postiz data with third parties. Data is transmitted only to:

• The social platform you connect (e.g. Meta, TikTok, X), limited to what you explicitly schedule or publish.
• Authorized cloaked.agency operators administering the Postiz instance on behalf of you or your organization.
• Law enforcement, only when required by a valid legal process served on Jade Johnson Enterprises LLC.

You may at any time:

• Revoke Postiz’s access at the source platform (Meta Business, TikTok account settings, X app permissions, etc.).
• Request export of data tied to a connected account.
• Request deletion of that data — see Data Deletion.