Know exactly what we touch,
and how to switch it off.

Exactly what we read,
and nothing more.

1. Your public schedule. We read the public schedule page of your booking platform (Momence, Mindbody, or Mariana Tek): class names, start times, instructor names, substitutes, cancellations, spots left where the page shows them, and the instructor photos your booking profiles already display. It is the same information anyone sees when they open your booking page. We never log in to your booking platform, and we never ask for credentials to it.

2. Your brand. Your accent color (proposed from your website, confirmed by you), your logo, your typeface choice, the design you picked, up to eight brand photos if you upload them, the short class names you set, your booking line, and the other settings you save in your private setup area.

3. Your Instagram connection. When you connect Instagram, you approve the connection on Instagram's own screens through the official API, and Meta issues an account id and an access token that authorize publishing stories to your account. At launch those two items are held by our posting rail, upload-post, on our behalf. We hold your Instagram handle, the connection status, and the reference that ties your studio to its profile at the rail. The token is never in our website code, never in your browser, and never in an email.

4. Your account, each night's story, and billing. Your studio name, your time zone, your contact email, and, if you add one, a second address that receives previews (the front desk). For each night: the schedule as it stood at preview time, the two rendered images (today, then tomorrow), what happened (previewed, approved, held, posted, skipped, or failed), and the rail's reference for each published frame. For billing: your Stripe customer id, subscription id, plan, and billing status. Card numbers go to Stripe and never touch our systems.

5. Email between us. The emails we send you, including the preview images inside them, and what you send us. Every email we send replies to stop@dayposter.com. Our software reads the sender, subject, and body of each message to that address to find a STOP, START, or PAUSE, and records who sent it and when. Posting requests require confirmation from the owner mailbox. Recognized account support requests go to a person; unknown senders cannot change your account.

6. Optional design feedback. If you use the AI design assistant, Cloudflare Workers AI receives the words you submit and your current appearance choices: color, typeface, design, teacher-photo visibility, name format, alignment, and spacing. We do not attach your account email, billing details, schedule, or uploaded photos. Anything you type in the request is sent, so keep it to design feedback. Its output can change only those appearance settings. Our application retains keyed request and rate-limit digests, abuse signals, and the resulting choices, rather than the submitted conversation. Browser dictation is optional and uses your browser’s speech service; you review its text before sending.

That is the whole list. We hold no client lists, no member records, no bookings, and none of your clients' payment details. We do process the public instructor names and photos your booking page shows, because they appear on the story.

How our reader
identifies itself.

When you paste your website, our reader opens it the way a browser would, plus at most a few pages that look like a schedule or booking page. It always calls itself Dayposter, it signs every request so the visit can be verified as ours, it obeys your robots.txt, and it never comes back on its own. The reader, in full, and how to block it.

What we can never do.

• Read your messages, comments, or followers. The connection covers publishing and basic account identity only. Your inbox, comments, and follower data are outside it entirely.
• Post anything except your schedule story. The only thing Dayposter is built to publish is the daily schedule story you were shown. There is no other content path: no captions, no feed posts, no reels.
• Change your profile, bio, or settings. Not part of the connection.
• See your Instagram password. The connection happens on Instagram's screens, not ours. Your password is never shared with us.
• Log in to your booking platform. We read the public page, nothing behind it.
• Post a day you were never shown. Nothing posts without a preview having gone out first. If you choose "post approved updates automatically" for overnight changes, an updated story can post on top of a preview you already received; if you choose "ask me first", it waits for your tap.
• Guess. A class your booking page marks cancelled is always removed. An empty day never posts. A schedule page we cannot read never posts. When we hold a story and hear nothing, the day skips.
• Keep posting after you say stop. The stop flag is read again in the moment before each publish. Stop means stopped.

How every night runs,
step by step.

1. 8:00 pm, your time. We read your public schedule page, build today's story with tomorrow's as a second frame, in your brand, and send the preview by email with four links: Looks good, Skip, Pause, Stop. Do nothing and it posts on time. Reply in plain English to change something.
2. 12:00 am, your time, or the time you set. We read your schedule page again. If nothing changed, the story posts. If your booking page marks a class cancelled, it is removed and the story posts. If anything else changed, your setting decides. Ask me first: we send the updated story and wait for your tap; no answer by the cut-off (six hours after your post time unless you set otherwise) and the day skips. Post approved updates automatically: the updated story posts on time. You choose between the two during setup; neither is chosen for you.
3. Every night, without exception. The second read always runs; it is not a switch you can leave off. Days off never post. Empty days never post. A broken feed never posts.

Stop means stop. Instantly.

Use the stop link in your account emails and confirm on the page to stop future posting. You can also reply STOP to request a confirmation at your account email address. Messages from an unverified sender cannot change your studio. Before each publish, our software checks your current posting permission and stops if it cannot verify it. A post already accepted by Instagram may still finish. Resuming also requires your confirmation.

Switch it off yourself,
without asking us.

Stop posting. Open the stop link in a service email and confirm on the next page, or reply STOP and confirm the email sent to your account address. Once confirmed, no further publishing request is started; a request already accepted by Instagram may finish. Your designs, settings, and history stay exactly where they are, and you can resume whenever you like.

Pause. Tap Pause in the preview. No previews and no posts until you resume. Everything stays where it is.

Revoke the Instagram connection. In the Instagram app, open Settings, then Website permissions, then Apps and websites, and remove the publishing connection (it may be listed as Upload-Post). The access token dies immediately and we can no longer post.

Close the account. Open your private setup link, choose Delete account and data on the account page, and confirm the deletion. Posting stops first, then we cancel the subscription, remove the publishing connection, and delete live account data within 7 days. A story already being delivered may finish. You can also email us to request deletion after we verify ownership. Required billing records remain with Stripe, and restricted database recovery copies expire within 30 additional days. The data deletion page explains the steps and exceptions; we email confirmation when cleanup is complete.

Where your data lives,
and who can reach it.

• Dayposter runs on Cloudflare: Workers for the software, D1 for the database, R2 for images, Browser Rendering for the pictures, Workers AI for optional design feedback, and Email Routing for inbound mail. Data moves over HTTPS and is encrypted at rest by Cloudflare.
• Rendered stories live in a private bucket with no public address. The preview rides inside your email, and the posting rail receives the image directly. There is no public image host.
• Your account has a private studio area. A one-use email link expires after 15 minutes and signs you into a secure, HttpOnly browser session lasting up to 12 hours. Studio URLs alone cannot open your account. Billing changes, deletion and Instagram replacement require a fresh email confirmation. Completing a new sign-in invalidates earlier access; requesting a link alone does not. Keep sign-in emails private and protect your inbox.
• Secrets are kept in managed secret storage, outside the website code. The public administrator API is closed at launch. It can open only after verified operator identity is configured; a shared API token alone cannot authorize access.
• Private setup, preview, and action pages tell browsers not to cache them or send their addresses as referrers. Application logs redact credentials, email addresses, and submitted content. Automatic request invocation logging is disabled so private link addresses are not copied into those logs. Limited abuse-prevention records use hashed identifiers instead of raw client IP addresses.
• We are a small company. We do not hold a SOC 2 audit today, and we will not claim badges we don't hold. What we offer instead is this short list, a working off switch, and a person who answers.

Who else touches
your data.

We update this table before adding anyone to it. No one on it may use your data for anything except the service named.

Found something?
Tell a person.

Write to hello@dayposter.com with the subject "Security". A person reads it and replies within two business days. If you report a real vulnerability, we will credit you here if you'd like.