Privacy Policy

PostMost ("PostMost," "we," "us," or "our") provides software that lets sellers create a single listing and publish it to multiple online marketplaces. This policy explains what information we collect when you use PostMost, how we use it, and the choices you have. It applies to postmost.co and the PostMost application.

1. Information we collect

Account information

When you create a PostMost account, we collect your email address, a password (stored only as a salted cryptographic hash — we never store or can recover your plain-text password), and, optionally, your name.

Listing content

Titles, descriptions, prices, condition, category, and other details you enter for your listings, along with any photos you upload. Photos are stored in our object storage provider and served over HTTPS.

Connected marketplace accounts

To cross-post on your behalf, PostMost needs to authenticate with each marketplace you connect. Depending on the marketplace, this works one of two ways:

• Marketplaces with a public API (eBay, Etsy): you authorize PostMost directly through that marketplace's own sign-in page (OAuth). We receive and store an access token and refresh token issued by that marketplace — never your marketplace password.
• Marketplaces without a public API (Poshmark, Mercari, Depop, Facebook Marketplace, Craigslist, OfferUp, Vinted, Grailed): you provide your username and password for that marketplace directly to PostMost, and we use automated browser sessions to sign in and manage listings exactly as you would in a browser, on your instruction. For Poshmark, you can instead connect via the PostMost browser extension: you log into Poshmark normally in your own browser, and the extension sends us the resulting session (not your password) — see "The PostMost browser extension" below.

All stored credentials, tokens, and sessions — for every marketplace — are encrypted at rest and are never shown back to you or anyone else after you save them.

Payment information

Subscription payments are processed by Stripe. PostMost does not receive or store your full card number — Stripe provides us only what we need to manage your subscription (such as plan status and a billing identifier).

Usage information

We record events like account creation, listings published, and cross-post outcomes so the product can show you accurate usage, plan limits, and analytics. We do not sell this data or share it with advertisers.

2. The PostMost browser extension

The optional PostMost browser extension runs in two places, and only ever acts when you take an action that triggers it — it does not run in the background or monitor your browsing otherwise:

• On postmost.co: when you publish a listing to a marketplace marked "Via extension," the extension reads that listing's content (title, description, price, photos) so it can fill it into a marketplace's listing form for you. It also reports back to PostMost when you confirm a listing was posted or sold, using your existing signed-in PostMost session.
• On a marketplace site (Facebook Marketplace, OfferUp, Poshmark, Mercari, Depop, Vinted, Grailed, or Craigslist): the extension fills the listing-creation form with the content above.
• Session capture (Poshmark, when you choose "Browser session" to connect your account): only when you click "I've logged in — connect my session," the extension reads Poshmark's cookies from your browser and sends them to PostMost, which stores them encrypted and uses them to sign in on your behalf, the same way your own browser would. This never includes your Poshmark password, and never happens automatically or for any other site.

The extension only requests access to postmost.co and the specific marketplace domains it supports — never all websites you visit.

3. How we use information

• To operate the core service: creating, publishing, and syncing your listings across the marketplaces you connect.
• To power optional AI features (photo-based listing generation, title/description suggestions, pricing suggestions, and background removal), which send the specific photo or text you submit to the AI provider below to generate a result.
• To process payments and manage your subscription.
• To provide customer support and respond to you when you contact us.
• To detect, prevent, and investigate fraud, abuse, or security issues.
• To improve the product based on aggregate usage patterns.

4. Third-party service providers

We use the following providers to operate PostMost. Each processes only the data necessary to perform its function for us, under its own privacy and security terms:

• Vercel — application hosting.
• Neon — database hosting.
• Cloudflare R2 — photo/image storage.
• Stripe — subscription billing and payment processing.
• OpenAI — AI-generated listing content, title/description optimization, and pricing suggestions, when you use those features.
• fal.ai — background removal for photos, when you use that feature.
• The marketplaces you connect (eBay, Etsy, Poshmark, Mercari, Depop, Facebook Marketplace, Craigslist, OfferUp, Vinted, Grailed) — we send your listing content to whichever of these you choose to publish to, using the credentials or authorization you provide.

5. Cookies

PostMost uses a single session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

6. Data security

Passwords are hashed, never stored in plain text. Marketplace credentials and OAuth tokens are encrypted at rest. All traffic to PostMost is encrypted in transit (HTTPS). No method of storage or transmission is 100% secure, but we work to protect your information using industry-standard practices.

7. Data retention & deletion

We retain your account and listing data for as long as your account is active. To request deletion of your account and associated data, email hello@postmost.co from the email address on your account. We will delete your data within a reasonable time, except where we're required to retain certain records (for example, billing records) by law.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at hello@postmost.co.

9. Children's privacy

PostMost is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you directly.

11. Contact us

Questions about this policy or your data? Email hello@postmost.co.