PostApprove Privacy Policy
Last updated: November 9, 2026
1. Introduction
ClearStack Apps ("we", "us", "our") operates the PostApprove mobile application and the client approval pages it serves at postapprove.web.app. PostApprove is where a social media manager plans a client's posts and collects the client's approval. This policy explains what is stored, where, who can see it, how long it is kept and how to delete it. It covers PostApprove only; the rest of ClearStack Apps is covered by our main privacy policy.
A manager using PostApprove is responsible for their own clients' information. A client of a manager should ask that manager about their own handling of it. PostApprove does not publish or schedule posts and does not connect to any social network.
2. What PostApprove Stores
- The business's account: an anonymous account is created when the app first opens. If the manager adds an email address and password, they are held by Google Firebase Authentication and never seen by us. The name a seat gives is stored with the business.
- The business's settings: its name, reply email and whether client nudge emails are on.
- Clients: for each client, the name, the name of the person who approves, an email address if the manager types one, the platforms they post on, a small logo if the manager adds one, the language of their page, and whether the manager recorded that the client agreed to reminder emails, or the client stopped them.
- Posts: the planned date, platform, caption and state of each post, a working copy of its picture (resized to 1200 pixels on the short side) and a small square copy for the board. Original files are not uploaded or kept.
- Approvals and threads: the name a client types on the approval page, the time of each approval or change request, the client's note and the manager's replies.
- Records of activity: a log of events such as a month being sent or a client being deleted, kept with the business's records.
- Purchase check: if the business buys a plan from Google Play, the purchase token, used only to confirm the purchase with Google and to renew or end the plan.
3. The Approval Page
Each client gets one link per month. Anyone holding the link sees the business's name, the client's name and that month's posts that have been sent, with their pictures and captions, and can approve them or ask for a change. A link should be treated like a key. Links are 22 random characters, can be stopped by the manager at any time, stop working a month after the month they cover, and are not listed anywhere or indexed by search engines. The page keeps the name typed on it in that browser's own storage so it does not have to be typed again; it sets no cookies and runs no analytics.
4. Reminder Emails
On the Pro plan, if the manager turns nudges on and has recorded that a client agreed, the client gets one email through Resend when two days pass after a month is sent with no answer at all. It names the business and contains the client's link. Every email has a link to stop them.
5. Crash Reports and Analytics in the App
- Firebase Crashlytics (Google LLC): crash reports, device model, operating system and app version, so we can find and fix bugs.
- Firebase Analytics (Google LLC): basic usage events such as app opens and screen views, tied to a random ID for the app on your phone. The advertising ID is not collected.
These never include client names, posts or pictures. PostApprove shows no third-party ads. The free tier shows a banner for ClearStack's own website service; nothing from the business's records is used to choose it. Nothing in a business's records is sold or shared with advertisers.
6. Where It Is Stored
On Google Cloud (Firebase) in the United States, encrypted in transit and at rest. The app keeps a copy of the board on the phone so it works without a connection.
7. Who Can See It
- Every seat of the business (the owner and, on Pro, one assistant) sees its clients, posts and threads.
- Anyone holding a client's link sees that month's sent posts and can approve them or ask for a change, as described in section 3.
- Google acts as our processor to store the data, and Resend to send nudge emails. We do not read a business's records except when needed for a support request or a legal obligation.
8. Deleting a Client, the Business or Your Account
A manager can delete a single post or a whole client, with every post, picture, thread and link, at any time from the app. To delete the account: Settings, then Delete account, and confirm. Or email support@clearstackapps.com from the address on the account. When the owner deletes the account, the whole business goes with it. An assistant who deletes their account leaves the business; its clients stay.
A client who wants their details or approvals removed should ask the manager, who can delete the client and everything stored for them. Crash reports are kept by Firebase for 90 days and then deleted.