Poster Privacy Policy

Last updated: 27 October 2026. This is a translation – the Polish version of this policy is binding.

This policy describes which personal data I process in connection with the Poster product page, the sale and activation of PRO licenses, contact with customers and messages about Poster sent to businesses, and what rights you have.

1. Controller. The data controller is Daniel Grodowski, running an unregistered business activity (Article 5 of the Polish Entrepreneurs' Law of 6 March 2018) based in Kraków, Poland, e-mail: kontakt@posterapp.pl. Write to this address about anything related to your personal data, including exercising your rights.
2. The program runs on your side. Poster (LITE and PRO) runs on your server or NAS. Bots, API keys, social media accounts, post content and history stay on your device – I have no access to them, and the program does not send me usage data (telemetry). The program connects directly to the services you configure (e.g. Google Gemini, Telegram, X, Meta), under the terms of those services. Installation and updates download Docker images (e.g. n8n, RSSHub, Node.js) from their official registries, and the n8n editor checks n8n's servers for new n8n versions. You are responsible for the data you process in the program.
3. Product page. The posterapp.pl page is hosted on GitHub Pages (GitHub, Inc.). When you view the page, GitHub processes technical data, e.g. your IP address and browser data, to deliver and protect it – under its own privacy statement. The page uses no cookies, analytics or tracking tools and loads no fonts or scripts from other servers. When you pick a language with the switch, it remembers that choice in your browser's storage (localStorage), from where it is not sent anywhere.
4. Buying a PRO license. PRO licenses are sold by Polar Software, Inc. (USA) – the Polar payment platform – as the merchant of record: you conclude the purchase contract with Polar under its buyer terms, and Polar accepts the payment, issues the sales document and settles taxes. Polar processes the data you enter when buying (e.g. name, e-mail, country and billing address, payment details) as a separate controller, under its own privacy policy. From Polar I receive: name, e-mail, country, order data (product, amount, discount, currency, tax, date, payment status and refunds), and the license key and its activations. I do not receive card or bank account details. I also keep the order data in a sales ledger on my own server.
5. License activation and PRO updates. When you click Check the key in the panel, the panel sends Polar only the license key (the check does not activate the license). The scripts/upgrade-to-pro.sh script sends Polar the license key, the device name (the server's host name) and a public SSH key generated on your device – the private key never leaves it. I add the public key to the private poster-pro repository on GitHub as a read-only key and remove it when the license expires or the payment is refunded. On every update (scripts/update.sh) the device checks the license status with Polar (license key and activation ID) and downloads the new version from GitHub, which sees the device's IP address.
6. Contact and support. When you write to me, I process your e-mail address and the content of your message. Issues in the public poster-app repository on GitHub are visible to everyone – do not put keys or personal data there.
7. Messages to businesses (B2B). I may send an e-mail about Poster to people whose work involves publishing on social media or who run businesses that Poster may help (e.g. marketing agencies, publishers, newsrooms, companies with a YouTube channel). I then process business data: name, work e-mail address, job title, the company's name, website and country, and publicly available information about its activity (e.g. the company's social media profiles), as well as the content of your reply. The data comes from publicly available sources, including company websites, business registries and directories, and professional publications and profiles. I send the messages from kontakt@posterapp.pl, only to work addresses and only to countries where the law allows such contact without the recipient's prior consent – I do not send them to addresses in Poland. If you do not want to receive them, reply "no" – I will not write to you again.
8. Purposes and legal bases.
   • selling licenses, activation, updates and support – performance of a contract (Art. 6(1)(b) GDPR);
   • sales records and tax settlements – legal obligation (Art. 6(1)(c) GDPR);
   • protection against license abuse and establishing, exercising or defending legal claims – my legitimate interest (Art. 6(1)(f) GDPR);
   • answering questions outside the contract – my legitimate interest (Art. 6(1)(f) GDPR);
   • messages about Poster to businesses (direct marketing) and a suppression list of people who opted out of them – my legitimate interest (Art. 6(1)(f) GDPR).
9. Recipients. Data may be received by: Polar (payments and licenses), GitHub (hosting of the page and the PRO repository), Seohost (seohost.pl – hosting of the kontakt@posterapp.pl mailbox), Google (Gmail – my mailbox, to which Polar sends order notifications) and – where the law requires it – tax authorities. Polar's order notification contains the buyer's e-mail address and country. The sales ledger and its backups are kept only on my own server.
10. Transfers outside the EEA. GitHub, Polar and Google may process data outside the European Economic Area, including in the USA. You give the purchase data to Polar directly, and Polar is responsible for it as a separate controller. Transfers to GitHub and Google are based on the European Commission decision on the EU-US Data Privacy Framework or on standard contractual clauses – in line with these companies' privacy terms.
11. How long. Order and sales ledger data – for the period required by tax law (as a rule 5 years from the end of the year in which the tax payment deadline passed). Activation data – for the duration of the license, then until claims become time-barred. Correspondence – for as long as needed to handle the matter, then 12 more months; correspondence about the contract (e.g. complaints) – until claims become time-barred. Data of people I write to as part of messages to businesses – up to 12 months from the last message (your reply is correspondence, see above). After you opt out or object, I keep only your e-mail address on a suppression list so that I do not write to you again.
12. Your rights. You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and the right to object to processing based on legitimate interest – to direct marketing (point 7) at any time and without giving a reason. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland). For data processed by Polar you can also contact Polar directly.
13. Voluntary data. Providing data is voluntary, but without it you cannot buy or activate a PRO license. I do not collect the data for messages to businesses from you – point 7 describes its source. I do not make decisions about you based solely on automated processing, including profiling – the automatic license key validity check only serves the performance of the contract.
14. Changes. I announce changes to this policy on the product page; the current version is always at this address.