PostDelegate policies: owner review

REVIEW DRAFT — not published or effective. Prepared on 26 October 2026 for one bundled owner review before account creation or publication. No deployment or approval is implied.

Review the standalone Privacy Policy and Terms of Service. Production cross-links inside those drafts target only the proposed privacy/terms routes and the existing source offer; local review starts from these two file links.

Material changes from the existing BrightBean templates

• Describes the deployed Postiz application on OVHcloud, Cloudflare and R2; credits Postiz and links /source.
• Limits Google sign-in to basic profile/email permissions; identifies the account ID and email used by the current handler. It makes no Gmail, Drive, Calendar or YouTube-content permission claim.
• Removes active Anthropic/AI, outbound email, Stripe billing and 14-day trial descriptions. These providers are not active in the current deployment.
• Discloses public R2 media URLs. Removes unverified MFA, encrypted social-token, instant deletion, 14-day deletion grace period and exact legacy-cookie claims.
• Preserves the existing minimum age of 16, disclaimers, liability cap, indemnity and Wyoming governing-law text. No new operator identity or address was invented.

Operator values carried forward from source defaults

Nasida Apps LLC and support@postdelegate.com match the selected public legacy runtime metadata supplied by the deployment agent. Wyoming company-jurisdiction wording is only a source default and remains unconfirmed. The existing governing-law provision (“the State of Wyoming, USA”) is retained for owner review. The legacy address and effective-date values are empty. No private runtime files or secrets were read to prepare these drafts.

Fields and operational facts still unresolved

1. Registered business address: the source default is a placeholder. Supply the actual address approved for publication.
2. Operator jurisdiction: confirm the entity's legal jurisdiction; the Wyoming source default is not independent corporate evidence. Review the retained Wyoming governing-law clause at the same time.
3. Effective date and approval: choose the effective date and approve the final text; draft-preparation date is not an effective date.
4. Retention/deletion: confirm periods and a working process for live records, media, logs and recovery copies. No fixed timing was source-verified.
5. Processing locations/transfers: confirm the actual VPS/R2 locations and any applicable transfer arrangements; the draft does not assume an EU region or executed safeguards.
6. Support contact: confirm that the source-default mailbox is monitored and can receive privacy/deletion requests.
7. Optional tracking: confirm the active tracking flags and cookie behavior before finalizing the cookie and no-advertising statements.

After review, fill confirmed fields, reconcile any remaining factual changes and remove the review banners before publishing. Owner approval of this draft alone does not verify missing operational facts or establish legal compliance.

Evidence used

Existing legacy templates/legal/privacy.html and terms.html; current apps/backend/src/services/auth/providers/google.provider.ts:27–30,58–61; password hashing in libraries/helpers/src/auth/auth.service.ts:35–40; the deployed stack and completed media test recorded in the operations README. Google disclosure requirements were checked against the Google API Services User Data Policy. This is a preparation aid for owner/legal review, not a statement of legal approval.