YARRAPOST · UPDATED 2 OCTOBER 2026

Privacy policy

Who operates this service

YarraPost is operated by Yarra Systems. Contact support@yarrapost.com for privacy questions, access, correction or deletion requests.

Information we handle

We store workspace and identity details, sign-in identifiers and email addresses, connected channel identifiers and labels, encrypted provider credentials, uploaded media, draft and approved post content, schedules, delivery results and publication links. We also retain activity records, API idempotency records, invitation and sign-in records, webhook configuration and delivery records, and deletion requests.

Why we use it

We use this information to authenticate people and agents, enforce workspace permissions, connect channels with your consent, validate media, obtain approval, publish or schedule the approved content, recover interrupted deliveries and show the outcome. Sign-in challenges and request limits help protect access. Operational diagnostics help investigate failures.

Publishing notifications use verified email addresses of active human workspace administrators to report channel reconnection needs, held schedules and delivery problems. Administrators can disable these operational emails in Channels. Messages contain issue counts and a workspace link, without post content or provider credentials. We retain recipient hashes and email-service acceptance identifiers for retry control; completed older notification batches are cleaned after 30 days.

Friend invitations and free-week benefits

If you follow a referral link, a first-party referral cookie remembers the invitation for up to 30 days. We capture it when sign-in starts and clear the cookie after successful sign-in. We use verified sign-up information and a hashed email identifier to prevent duplicate rewards; this does not link or merge accounts. Referral links are not workspace access invitations. Inviters see their benefit balance and qualifying sign-up count, not friends’ email addresses or workspace content.

We store banked free-week balances and reward/correction records. Designated platform operators can adjust balances or pause invitations, with a recorded reason. Account deletion removes its referral identity and benefits and removes its identity from another person’s reward record; the other person’s earned balance is preserved. Referral information is not sent to social networks.

Google and YouTube data

Google sign-in identifies your YarraPost account. Connecting YouTube is a separate authorization: YarraPost accesses channel information to identify your destination, uploads your selected videos, and reads video status to confirm processing and publication. YarraPost uses YouTube API Services. See the Google Privacy Policy. You can revoke access through your Google account permissions and request deletion of stored data as described below.

Sharing and service providers

Content and media are sent to the social networks you select for publishing. Cloudflare provides hosting, database, object storage and email infrastructure. Workspace administrators control access for other people and agents. If an administrator configures a webhook, workspace event data is sent to that endpoint. Published content is subject to the selected network’s visibility settings and policies.

YarraPost does not provide AI content assistance. Agents you authorize may access workspace data through the API or MCP according to their permissions; review the practices of any agent service you connect.

Cookies and credentials

We use essential session and sign-in flow cookies. If you use a workspace bearer credential in the browser, it is held in session storage. Provider credentials are encrypted before storage. Keep account and agent credentials private.

How we protect your data

These safeguards apply to the Google and YouTube data described above, as well as other connected-channel credentials, workspace records and uploaded media:

• Encryption in transit. The production website and API use HTTPS/TLS. Our connections to Google's authorization, token and YouTube API endpoints also use HTTPS.
• Protection of stored credentials. Provider access and refresh tokens are encrypted with AES-256-GCM before database storage. The encryption key is supplied to the backend as a deployment secret, separately from the encrypted database records. Provider tokens are not returned to browser or agent clients.
• Workspace access controls. Authenticated requests are checked against workspace membership and permissions. People and agents receive scoped access, and media and publishing records are checked against the requesting workspace. YarraPost API credentials are stored as hashes rather than readable credentials.
• Protected media access. Uploaded files are held in private object storage. Workspace media access requires authentication and permission checks. When a selected publishing provider needs to fetch a file, we supply a signed, time-limited link. Anyone holding that link can access the file until the link expires, so it should be treated as confidential.
• Session and authorization safeguards. Production sign-in sessions use Secure, HttpOnly cookies with SameSite controls. Google and YouTube authorization flows use state checks and PKCE to protect the connection process. Request limits help reduce automated abuse.

These controls help protect against unauthorized access, alteration and disclosure. Contact support@yarrapost.com to report a suspected security or privacy issue.

Retention and deletion

Workspace content and publishing records remain stored until removed through a verified deletion process. Disconnecting a channel removes its stored connection credentials but does not erase posts, media or all delivery records. A deletion request is reviewed before erasure, including any active publishing operation. Backup and operational-log retention must be confirmed as part of the deletion response; we do not describe those copies as immediately erased.

See data deletion instructions. Deleting YarraPost data does not remove content already published on a social network. Manage that content on the network itself.

Changes and questions

This policy will be updated when the service’s data handling changes. Contact the operator above if you need information about your data or believe it has been handled incorrectly.