Privacy Policy

1. Information we store

Account details. Your email address, your display name, and your password. Passwords are never stored in readable form — only a bcrypt hash is kept, and the original is not recoverable by us. Each account also holds a plan name and an API key generated for you.

Connected social accounts. When you connect Facebook, Instagram or Threads, we store the account’s identifier and username on that platform, its display name, and the OAuth access token the platform issues. Tokens are what allow the Service to publish on your behalf and to read the engagement numbers of posts it published. Where the platform issues a token with an expiry (Threads tokens last 60 days), the expiry is stored so the token can be refreshed before it lapses.

Your content. The text of your posts, any per-platform variations you write, the scheduled time, the publish status, and — once published — the post’s public link and its identifier on that platform. Images and videos you upload are stored in a Supabase Storage bucket and are publicly readable by URL, because Meta requires media to be fetchable from a public address in order to publish it.

Engagement numbers. Impressions, likes, comments and shares reported by each platform for posts the Service published. These are read from the platform’s API and cached so the analytics page does not have to query it on every visit.

Cookies. A signed session cookie keeps you logged in. A language cookie remembers whether you chose English or Vietnamese. Short-lived cookies are set during a social login to protect that exchange against cross-site request forgery. No advertising or third-party tracking cookies are used, and the Service runs no analytics or advertising scripts.

2. What we do not do

• We do not sell or rent your data, and we do not share it for advertising.
• We do not read your private messages, and the Service requests no permission to.
• We do not post anything you did not ask us to post. Publishing happens only when you publish or schedule a post yourself.
• We do not use your content to train machine learning models.

3. Who your data is shared with

Only the parties required to operate the Service:

• Meta Platforms — Facebook, Instagram and Threads receive the posts you publish and return the engagement numbers for them.
• Supabase — hosts the database and the media storage bucket.
• Netlify — hosts and serves the application.

We may disclose data if legally compelled to, and will tell you unless prohibited from doing so.

4. How long it is kept

Account data, posts and engagement numbers are kept while your account exists. Disconnecting a social account clears its stored access token immediately, so the Service can no longer act on that account; the record of what was already published is kept so your history stays intact. Deleting your account removes your posts, connected accounts and stored metrics.

5. Removing your data

You can disconnect any social account from the Accounts page at any time. Removing the Service from a connected platform also works: the platform notifies us, and the corresponding access token is deleted and the connection marked expired. For Threads, the Service additionally implements the platform’s data deletion request callback, which deletes the stored account and its publishing history and returns a confirmation code you can use to check the request.

To delete your whole account and everything attached to it, write to the contact address below and we will action it.

6. Security

All traffic is served over HTTPS. Passwords are stored only as bcrypt hashes. Access tokens are held server-side and are never exposed to the browser. No system is perfectly secure, so if you believe your account has been compromised, contact us and change your password.

7. Children

The Service is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has an account, contact us and we will remove it.

8. Changes

If this policy changes materially, the date at the top of this page is updated. Continued use after a change means you accept the revised policy.

9. Contact

Questions about this policy, or a request to delete your data: khoavo.private@gmail.com. The Service is operated by [LEGAL ENTITY NAME AND ADDRESS].