Updated: 13 October 2026
Privacy policy
This policy explains how Postlyra handles personal data in its free Telegram publishing service, including the website, Mini App and connected AI clients.
Operator and contact
Postlyra is operated by Denys Kuznietsov, Thailand. Contact support@postlyra.app for privacy questions, access requests, corrections, account deletion and security reports.
Information we receive
We receive your verified Telegram identifier and available profile fields, such as name, username and language; your posts, revisions, templates, media, buttons and links; connected chat identifiers, titles and permissions; schedules, time zone and delivery results; app authorizations and session information. We also process limited usage and security events, technical request information needed to operate the service, and messages you send to support.
Purposes and legal grounds
We use this information to provide the features you request: sign-in, saving and displaying content, uploads, publishing, scheduling, account controls and support. We also use necessary operational information to enforce limits, prevent abuse and diagnose failures. Where applicable, processing relies on providing the service you requested, legitimate interests in service reliability and security, legal obligations, or consent for optional features. Withholding required account or content information prevents the corresponding feature from working.
Beta MCP diagnostics
During beta testing, extended diagnostics may temporarily retain sanitized tool arguments and results, including post text, confirmation text and error details, for up to 7 days. This covers calls sent to Postlyra, not your full AI conversation. Credentials, signed URLs and common contact details are masked; arbitrary text is not guaranteed anonymous. Content traces are accessible only to the service operator, are excluded from ordinary server logs, expire automatically and are then cleared by a background job. Collection is controlled by a temporary switch and expiry date and stops when beta diagnostics is disabled. The guide shows whether it is currently active. Account deletion removes associated traces. Contact support for access or deletion requests.
Connected AI clients
When you connect an AI client, Postlyra receives the tool inputs and files that the client sends and returns the requested workspace data within your granted permissions. Postlyra does not request your complete AI-chat history and does not provide built-in AI generation in this beta. The AI provider processes your conversation and tool results under its own terms and privacy policy. Review the permissions you grant; a write-enabled client can change or publish content on your instructions.
Who receives information
Telegram receives the content and delivery details needed for the Telegram actions you request. Your authorized AI clients receive tool results and card content. Hosting, storage and network providers process data needed to operate Postlyra; Zoho Mail processes correspondence sent to support. The operator may access information when necessary for support, security or maintenance. Information may also be disclosed when required by law or to protect rights and investigate misuse. Postlyra does not sell your personal data or use your posts to train its own AI models.
Publications and preview links
Publishing shares content with the selected Telegram chat and its audience. A public preview can be opened by anyone who has its link. Some legacy draft-creation and editing tools also create a public preview, as described in those tools. Reading a saved post or opening its private interactive card does not itself create a public preview. Treat shared links as access credentials and do not use public previews for confidential content.
Optional Google Analytics
If you allow analytics, Google Analytics uses cookies to measure page visits, entry sources and selected actions such as opening the workspace, creating a draft, scheduling and successful browser publications. Google receives technical browser/device information and processes network information to provide the service. Our event payloads exclude post content, Telegram account or chat identifiers, draft identifiers, URL query strings and fragments. Advertising features and automatic form/link measurement are disabled. Analytics is optional: no Google tag is loaded before permission. Use Cookie preferences to decline or withdraw; withdrawal stops future collection in this browser and removes its analytics cookies, but does not erase previously collected data. Consent choices last up to 180 days. Google processes data under its privacy policy (https://policies.google.com/privacy), potentially outside your country.
Cookies, sessions and measurement
Postlyra uses cookies and local storage for sign-in, session security and application preferences. Necessary account and feature events help measure connections, first publications, repeat use and reliability. These product events are separate from post bodies. The beta has no advertising or advertising-tracking features. Hosting and network systems also process technical information such as IP addresses when serving requests.
Storage and retention
Posts, media, templates and publication records remain while your account needs them; archiving a post is reversible and does not erase it. The standard account-deletion grace period is 7 days, followed by removal from active Postlyra storage and a minimal 30-day deleted-account record. Export links expire after 24 hours, export history is kept for 30 days, and product/security events normally for 90 days. See Data retention for session expiry, technical records and exceptions.
Your controls and requests
Use Settings > Data & privacy to request an export or account deletion. Manage connected AI clients and active sessions in Connections and Security. Revoking a connection prevents future authorized access through it; it does not erase information already received by that client. You may also contact support@postlyra.app to request access, correction, deletion, restriction or objection, portability, or withdrawal of consent where applicable. We may verify account ownership before acting. You may complain to the data-protection authority competent for your circumstances, including Thailand's Personal Data Protection Committee.
Deletion and external copies
Requesting account deletion revokes Postlyra access and cancels pending work that can still be safely stopped. During the grace period you can cancel deletion using fresh authentication; old sessions and app grants are not restored. Deletion runs in the background and retries after failures. Deleting your Postlyra account does not remove messages already sent to Telegram or copies retained by an AI provider, a recipient or someone who used a shared link. Contact support about technical backups or records subject to a legal retention requirement.
International processing and security
The service is operated from Thailand. Our providers, Telegram and your chosen AI clients may process information in other countries. Postlyra does not promise storage exclusively in your country. We use HTTPS, access checks and protected credentials to reduce unauthorized access. No online service can guarantee absolute security; report a suspected incident to support@postlyra.app.
Age, sensitive information and changes
Postlyra is not directed to children under 13 or below the applicable minimum age for using the service. Do not submit payment-card details, authentication secrets, government identity documents or sensitive personal information that is unnecessary for publishing. If you believe a child has provided data improperly, contact support. Changes to this policy will appear here with an updated date; we will provide additional notice or obtain consent when required by applicable law.