Privacy Policy

Last Updated: July 3, 2026

Effective Date: July 3, 2026

Revision: 1.1

1. Introduction

This Privacy Policy describes how Sia Makerlab ("we," "us," or "our") collects, uses, and shares information in connection with your use of the PostFlow application (the "App").

By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the App.

2. Information We Collect

2.1 Information You Provide

2.1.1 Blog Account Credentials

To connect to your blogs, the App requires you to provide:

• WordPress: Site URL, username, and application password (stored securely on your device using encrypted storage)
• Ghost: Site URL and Admin API key (stored securely on your device using encrypted storage)

We do not transmit or store these credentials on our servers. All credentials are stored locally on your device using Flutter Secure Storage.

2.1.2 Blog Content

When you create, edit, or manage blog posts through the App, the content is:

• Stored locally on your device as draft data
• Transmitted directly to your blog platforms (WordPress/Ghost) via their respective APIs
• Optionally sent to your chosen AI provider when you use AI writing or image features (see Section 2.1.3)
• We do not have access to or store your blog content on our servers

2.1.3 AI Provider Keys and AI Requests (Optional)

The App includes optional AI-assisted writing and image generation. These features are entirely optional and use an AI provider that you choose and configure with your own API key:

• AI Provider API Keys: You may provide API keys for OpenAI, Anthropic (Claude), Google (Gemini), or a self-hosted OpenAI-compatible endpoint. Keys are stored locally on your device using Flutter Secure Storage and are never transmitted to our servers.
• AI Requests: When you use an AI feature, the App sends your prompt and the relevant post content (for example, a title, outline, or draft you ask it to generate or improve) directly from your device to the AI provider you configured, using the endpoint and key you supplied. This data is processed under that provider's own privacy policy and terms.
• We do not operate any AI service, do not proxy AI requests through our servers, and do not receive or store your prompts, generated text, or generated images.

If you do not configure an AI provider, no AI-related data leaves your device.

2.2 Information Collected Automatically

2.2.1 Local Device Storage

The App stores the following data locally on your device only:

• App Settings: Theme preferences, editor settings, language selection, AI provider configuration
• Draft Posts: Posts you create or edit (stored locally in an on-device SQLite database)
• Blog Connection Data: Encrypted credentials for connected blogs
• Publishing Schedule: Any scheduled publishing times you set, used for local reminders

2.2.2 Advertising Data (Third-Party)

If you use the free version of the App with advertisements, our advertising partner Google AdMob may collect:

• Advertising ID (Android Advertising ID / IDFA)
• Device information (device type, operating system version)
• IP address
• General location data (country/region level)
• Ad interaction data

This data collection is governed by Google's Privacy Policy: https://policies.google.com/privacy

2.3 Information We Do NOT Collect

We explicitly do not collect:

• Contents of your blog posts (never transmitted to our servers)
• Blog credentials or AI provider keys (stored only locally on your device)
• Your AI prompts or AI-generated content (sent only between your device and the AI provider you choose)
• Contacts, photos, or other personal files (except media you explicitly attach to posts)
• Precise location data (GPS coordinates)
• Biometric data
• Health or fitness data
• Browsing history

3. How We Use Information

3.1 Local Data Usage

All locally stored data is used solely to:

• Connect to your WordPress and Ghost blogs via their APIs
• Store and manage your draft posts
• Send optional AI requests to the AI provider you configure
• Schedule local reminders for planned publishing
• Remember your app preferences and settings

3.2 Third-Party Data Usage

Data collected by third-party services (Google AdMob) is used to:

• Display personalized or non-personalized advertisements (based on your consent)
• Prevent fraud and abuse

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Data

We do not sell, trade, or rent your personal information to third parties.

4.2 Blog Platforms

When you publish or update posts, the App communicates directly with your blog platforms:

All communication is between your device and your blog servers. We do not act as an intermediary.

4.3 AI Providers

When you use an AI feature, the App communicates directly with the AI provider you configure. Each provider's privacy policy applies to the data you send:

We do not act as an intermediary for AI requests.

4.4 Legal Requirements

We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5. Data Retention

5.1 Local Data

Data stored locally on your device remains until you:

• Clear the App's data through device settings
• Uninstall the App

5.2 Blog Data

Data published to your blog platforms is retained according to your blog platform's settings. The App does not control data retention on your blog servers.

5.3 AI Provider Data

Data you send to an AI provider is retained according to that provider's policies. The App does not control retention on AI provider servers.

6. Your Rights and Choices

6.1 For All Users

You have the right to:

• Access: View your locally stored data within the App
• Delete: Remove all local data by uninstalling the App
• Disconnect Blogs: Remove blog connections and stored credentials at any time
• Remove AI Keys: Delete your AI provider keys and disable AI features at any time
• Opt-out of Personalized Ads: Manage ad personalization through the App's privacy settings or your device's advertising settings

6.2 For Users in the European Economic Area (EEA), United Kingdom, and Switzerland

Under the General Data Protection Regulation (GDPR) and applicable laws, you have additional rights:

• Right to Access: Request information about data processing
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Request transfer of your data
• Right to Object: Object to data processing
• Right to Withdraw Consent: Withdraw previously given consent at any time

7. Data Security

We implement appropriate technical and organizational measures to protect locally stored data, including:

• Blog credentials and AI provider keys are stored using Flutter Secure Storage (encrypted storage)
• All API communications with blog platforms and AI providers use HTTPS
• No transmission of user data to our servers
• Draft data is stored locally in an on-device SQLite database

However, no method of electronic storage is 100% secure.

8. Children's Privacy

The App is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Updating the "Last Updated" date at the top of this Privacy Policy
• Displaying a notice within the App for material changes

Your continued use of the App after any changes constitutes acceptance of the updated Privacy Policy.

10. Disclaimer of Liability

10.1 Blog Platforms

We are not responsible for the data collection, use, or security practices of blog platforms (WordPress, Ghost) you connect to. Your use of these platforms is subject to their respective terms and privacy policies.

10.2 AI Providers

We are not responsible for the data collection, use, or security practices of AI providers you choose to configure. Your use of these providers is subject to their respective terms and privacy policies.

10.3 Data Loss

We are not responsible for any loss of data, including but not limited to data loss caused by:

• Device malfunction or damage
• App uninstallation
• Blog platform or AI provider failures
• Sync conflicts
• User error

11. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Korea, without regard to its conflict of law provisions.

For users in the European Union, this Privacy Policy shall be interpreted in accordance with applicable EU law, including the GDPR.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Sia Makerlab

• Email: sia@siamakerlab.com
• Company Website: https://siamakerlab.com

---

Summary of Data Practices

*Only when you configure and use the optional AI features. **Collected by third-party services (Google), not by us directly.

---

This Privacy Policy is available in English. If translated versions are provided, the English version shall prevail in case of any discrepancy.