Postman
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
They collect account, content, and device data, share tracking with ad partners, auto-renew paid plans with no refunds, and you them.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your uploads, usage, device IDs, IP, cookies, and data from partners and ads companies.
Read the exact line
Privacy policy
“We collect information about the device you use to access our Services, including the type of device, connection type, device settings, operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and crash data.”
Training
They use it to run the product, market to you, improve features, and may use it for AI tools.
Read the exact line
Privacy policy
“We may also use information you provide to develop artificial intelligence (AI) tools and systems as set forth in our Postman AI Terms.”
Sharing
Teammates and admins can see a lot; vendors and ad partners get some data; public workspaces are open to anyone.
Read the exact line
Privacy policy
“Visitor information, however, including information collected via cookies and other tracking technology, may be provided to other parties for marketing, advertising, or other uses.”
Kept
Account data is kept while you are active plus about 15 days; some shared content can stay after you leave.
Read the exact line
Privacy policy
“We retain your account information for as long as your account is active and up to 15 days thereafter.”
Controls
You can update or delete some records in settings, unsubscribe from promos, and request by email.
Read the exact line
Privacy policy
“Our Services have features that let users manage certain information, including the ability to access and update certain records, correct or rectify certain records, delete certain records, delete your account, and disable or remove third-party integrations.”
Fine print
Plans auto-renew with no refunds, you them, is capped, and are waived.
Read the exact line
Terms of service
“Except where expressly stated in these Terms or an Order, all payment obligations are non-cancelable and all Fees paid are non-refundable.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Cancel auto-renew or change plan in billing
Account billing dashboard, or email help@postman.com with subject Cancel Auto-Renewal / Subscription Cancellation
Opt out of sale, sharing, or targeted ads
Your Privacy Choices link (and Global Privacy Control if your browser sends it)
Unsubscribe from promo emails
Unsubscribe link in emails, or https://www.postman.com/settings/me/notifications
or other
Account settings, or help@postman.com / 1-888-616-1665 / https://www.postman.com/company/contact-us/
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If someone sues them because of what you uploaded or how you used the product, you may have to pay their legal bills.
Read the exact line
Terms of service
“Customer will defend Postman and its Affiliates and its and their officers, directors, employees, and representatives from and against any claim, action, demand, or proceeding by a third party”
For example, if an API collection you posted is accused of copying someone else's work, you could owe Postman's lawyer fees.
If you pay for a plan, you generally cannot get that money back even if you stop using it.
Read the exact line
Terms of service
“Except where expressly stated in these Terms or an Order, all payment obligations are non-cancelable and all Fees paid are non-refundable.”
For example, if you cancel a yearly plan in month two, they keep the full year payment.
Paid plans keep charging you unless you cancel auto-renew before the term ends.
Read the exact line
Terms of service
“all paid subscriptions will automatically renew for periods equal to Customer's initial Subscription Term, and Customer will be charged at the then-current rates”
For example, a monthly card charge continues every month until you turn off auto-renew in billing.
Cookie and tracking data can go to outside advertising companies.
Read the exact line
Privacy policy
“Visitor information, however, including information collected via cookies and other tracking technology, may be provided to other parties for marketing, advertising, or other uses.”
For example, an ads partner could use site cookies to show you Postman ads on other websites.
They can lock you out right away and do not have to warn you first.
Read the exact line
Terms of service
“it may suspend Customer's Organization Account and/or User Account, as well as a Customer's Users' access to the Services, immediately and with or without notice.”
For example, if they think you broke the rules, your team could lose access the same day with no email first.
You cannot join a group lawsuit with other users; you would have to sue alone in Delaware courts.
Read the exact line
Terms of service
“CUSTOMER AND POSTMAN AGREE THAT ANY DISPUTE RESOLUTION PROCEEDINGS ARISING OUT OF OR RELATED TO THESE TERMS OF SERVICE AND/OR THE POSTMAN SERVICES WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, OR .”
For example, if many users lost data, you could not join them in one .
What you put in the product may be used to build AI features, under separate AI terms that are not fully spelled out here.
Read the exact line
Privacy policy
“We may also use information you provide to develop artificial intelligence (AI) tools and systems as set forth in our Postman AI Terms.”
For example, feedback or content you submit might help them build Postman AI tools.
You still own your stuff, but they get a wide license to copy and show it so they can run the service.
Read the exact line
Terms of service
“Customer grants Postman and its legal successors a non-exclusive, worldwide, , , transferrable license and right to (i) reproduce, store, archive, parse, display, represent, and perform Customer Content”
For example, they can store and display your API collections on their servers and to teammates you invite.
Staff are not supposed to browse private workspaces unless there is a listed reason such as security or support.
Read the exact line
Privacy policy
“If your workspace is private, you control the access to your Content. Postman personnel do not access private workspace content except for:”
For example, a support person might open a private workspace if you ask them to fix a bug.
They say they do not sell your name and email, though other tracking data can still be shared.
Read the exact line
Privacy policy
“We do not sell information that directly identifies you (like name and contact info) to outside parties.”
For example, they would not sell a list of your name and email to a random advertiser.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- auto-renewal
- Your subscription keeps charging you at the end of each period until you cancel it. For example, a free trial turns into a paid monthly plan unless you cancel before it ends.
- class action waiver
- You agree not to join with other users in one lawsuit; each person must complain alone. For example, if a bug overcharges a million people, you cannot all sue together for a refund.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
How we got here · grade B · score 52/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account and billing info, what you upload, usage, device IDs, IP, crash data, cookies, and some partner and ads data.
Does it record your voice, face or body, and what happens to that?
They say they do not intentionally collect biometric data. Voice or face is not described as a product feature.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say staff do not access private workspace content except for security, support, integrity, legal duties, suspected illegal content, or your consent.
Are you profiled or tracked for advertising?
They and third-party partners use cookies and tracking, and visitor data may go to advertising partners. Some U.S. residents can opt out of targeted ads.
Do they sell or share your data, and can you opt out?
They say they do not sell name and contact info, but cookie and hashed data may go to ads partners, and some states can opt out of sale or sharing.
What rights do they take over what you type and what the AI makes?
You keep ownership. You give them a worldwide, sublicensable license to store and display content to run the service; public items can be forked by others.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account in settings. Account info is kept while active and up to 15 days after. Some shared content may remain for teammates.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe industry-standard safeguards and say the program is aligned with standards such as ISO 27001 or SOC 2. No breach history is stated here.
Is there a real age gate, and are teens protected?
You may not have an account if under 13 in the U.S. or under 18 elsewhere. They close accounts if they learn you are under age. No extra age check is described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated April 2026 and they say they will post changes and notice material ones. Terms say continued use after notice means you accept.
Can they close your account without warning, and can you get your data out first?
They may suspend accounts immediately with or without notice for rule breaks. They can also terminate with about 14 days' notice for free and monthly plans.
If something goes wrong, who pays?
The service is as-is, their payout is usually capped at 12 months of fees, and you must indemnify them for claims about your content and certain rule breaks.
Do subscriptions renew on their own, and can you get a refund?
Paid plans auto-renew and fees are generally non-cancelable and non-refundable. You cancel auto-renew in the billing dashboard or by email.
The privacy policy is 5,584 words at a college graduate level (Flesch reading ease 38); the terms are 19,448 words at a professional or legal expert level.
