Privacy

Last updated 19 August 2026

The short version: we store your domain, whether it has a plan, and a count of how much you have used. We do not store the pages you submit, the posts we write, or your email address. There are no analytics and no advertising trackers on this site.

What we store

About your website

The registered domain — example.com, not the full URL you pasted — with its plan and expiry, whether the free set is spent, and how many sets have been generated. Subdomains are reduced to the site they belong to, so we never store which particular page you submitted.

If you buy a licence

An encrypted copy of your licence key, sealed with AES-256-GCM, plus the plan and status Lemon Squeezy reports. The server needs the key to re-check that your licence is still valid. Your browser holds only an opaque session token, which grants nothing on its own.

For rate limiting

A one-way HMAC hash of your IP address with a counter attached. Never the address itself, and the hash cannot be reversed. The counters delete themselves after an hour, a day or a week.

What we do not store

The page you submit. It is fetched, read, used to write your posts, and discarded. It is never written to a database.
The posts we write. They are returned to your browser and not kept. Close the tab and they are gone, so copy anything you want.
Anything you type in the notes box. Used for that one request, then discarded.
Your email address. We never ask for it. Lemon Squeezy holds it for your purchase; we do not receive a copy.
Analytics of any kind. No page-view tracking, no session recording, no advertising pixels, no third-party scripts beyond the one listed below.

Who else touches your data

Running this service means a few other companies are involved. Each one, and why:

Who	What they receive	Why
OpenAI	The text of the page you submitted, and your notes	To write the posts. Sent through their API, under whichever data policy OpenAI applies to API traffic — we do not control it, so read theirs if it matters to you.
Upstash	Domain records, encrypted licence keys, hashed-IP counters	The database this all lives in.
Vercel	Ordinary web request data, including your IP	Hosting. Standard server logs.
Lemon Squeezy	Your payment and billing details	They are the merchant of record. We never see your card.
Cloudflare	A bot-check signal, if Turnstile is switched on	To stop automated abuse of the free tier.

The page you point us at

Exactly the one URL you give us — not your sitemap, not other pages, nothing linked from it. The crawler identifies itself as PostForSiteBot, refuses private network addresses, and does not try to get past logins or paywalls.

Please only submit pages you are entitled to process. If a page is confidential, do not paste it here.

Cookies

One, and only if you activate a licence: pfs_session. httpOnly, so scripts cannot read it, holding a random token. No tracking or advertising cookies — which is why there is no cookie banner. There is nothing to consent to.

How long things are kept

Domain records: for as long as the domain has a plan, or until you ask us to remove it
Licence records: for the life of the licence
Session tokens: 180 days, or until you sign out
Rate-limit counters: between one hour and one week, then automatically deleted

Your rights

Email support@postforsite.com and we will tell you what is held against your domain, correct it, or delete it. Deleting a paid domain's record ends its access, so we will check first. There is no account to close.

Changes

If what we store or who receives it changes, the date at the top changes with it.

Questions: support@postforsite.com · Terms · Back to Post for Site