Privacy Policy

Last updated: September 6, 2026

Social Fanout ("we," "us") provides an API and dashboard for publishing content and managing explicitly authorized social interactions on behalf of authenticated users. This policy explains what data we collect, how we use it, and the choices you have.

Data We Collect

Account data:

• Your email address and account identifier when you sign up.
• Hashed API keys you generate. We never store API keys in plaintext.
• Billing identifiers from Stripe (we do not see or store card numbers).

Credentials from connected platforms: Depending on the platform and connection method, we receive and store:

• OAuth access tokens and refresh tokens where issued by the platform.
• For Bluesky, the handle or email you supply, your App Password, and an optional service URL. This connector uses the App Password to sign in for credential verification and publishing; it does not use OAuth.
• For Discord, the selected channel's incoming webhook URL and token, webhook metadata, and OAuth tokens and user information returned during connection.
• Provider-dependent profile metadata needed to identify a publishing destination (for example, account ID, username, display name, or Page ID).
• Permission scopes you granted.

Provider secrets are stored server-side in Supabase and are not returned by public API or dashboard responses. They are used only for the capability you authorize: publishing submitted content; subscribing to and receiving authorized comments or customer-initiated messages; sending a public comment reply, setting comment visibility, deleting a stored app-created comment reply, or sending a standard-window private text reply when you explicitly request that action; and refreshing access where the connected platform supports refresh. Social Fanout does not generate, schedule, or autonomously send comment or message replies; authenticated callers initiate those actions and supply the reply text.

For Pinterest specifically, Social Fanout does not request or retain API-derived profile metadata, token-response metadata, permission-scope copies, or a Board inventory. We store only the OAuth tokens needed to access the API plus locally generated connection and refresh-timing metadata. Board names and IDs are fetched with no-store caching only while you choose a destination; the selected Board ID is used for that immediate request and is not retained. The returned Pin ID is shown once in the publish response but is not stored in jobs, history, idempotency bodies, or outbound webhooks. Pinterest scheduling and replay are unavailable because they would require retaining the Board ID.

Connection security: For OAuth connections, we keep a private transaction containing your SocialFanout owner identifier, API-key record and fingerprint, selected provider, provider authorization URL without its original state, return path, reconnect context, and any PKCE verifier. The public connection link contains an opaque random state reference; the database stores only its SHA-256 hash. You sign in as the key owner and confirm the destination before continuing to the provider. Essential host-only __Host-sfoauth_ browser-binding and __Host-sfoauth_csrf_ confirmation cookies use Secure, HttpOnly, SameSite=Lax, and Path=/. They contain random values, not your API key or provider credentials. We store only the browser-binding value's hash in the transaction. These cookies protect connection ownership and are not advertising cookies.

Content you publish:

• Post text, captions, and media URLs you submit through POST /v1/publish.
• Job records (status, timestamps, provider response IDs, error messages), except Pinterest provider response IDs and raw provider error details, which are not retained.
• Webhook delivery logs.

Standalone Instagram Comments data: When an authenticated user explicitly enables the dedicated Instagram Comments app, Social Fanout stores only these normalized fields under a separate Comments connection:

• The Instagram comment and source identifiers needed to display and reply.
• The owning connection and hashed API-key association, plus provider, platform, and event type.
• The comment text.
• The author's identifier and display name when Instagram provides them.
• The received, reply-claim, replied, visibility-change, and reply-deletion timestamps when applicable; the local inbox status (new, replying, replied, or dismissed); and the last provider-confirmed hidden state.
• The provider reply identifier and reply text after an explicit reply. Confirmed deletion redacts both and retains only a minimal hash/timestamp tombstone.
• A moderation action ledger containing tenant, connection, and operation ownership; target/request hashes; the caller-supplied idempotency key; timestamps; and a non-secret result receipt. It does not duplicate raw provider target identifiers or contain provider tokens.

We do not retain the full raw signed webhook payload for this lane. Dismiss is local: it changes only the Social Fanout inbox status and makes no Instagram request. The dedicated feature can set upstream visibility on the owned inbound comment and can delete only a reply Social Fanout previously created and stored; it does not accept arbitrary provider identifiers or delete the inbound comment.

A valid Comments-app-signed data-deletion request removes only the dedicated Comments connection and records linked to that connection from Social Fanout. It does not remove sibling Instagram Publishing or Messages records, including Publishing job/post history, even when those apps authorize the same Professional account. That account-data callback is distinct from the explicit moderation controls and does not itself delete or hide provider content. Provider-side content remains subject to completed customer-requested actions and Instagram's own controls and retention.

Standalone Instagram Messages data: When an authenticated user explicitly enables the dedicated Instagram Messages app, Social Fanout stores only the normalized information needed to receive a customer-initiated message, display it to the owning account, enforce the standard reply window, and send a text reply after an explicit authenticated request:

• The inbound Instagram message identifier used for delivery deduplication, the receiving Professional account identifier, and the sender's Instagram-scoped identifier.
• The owning Messages connection and hashed API-key association, plus provider, platform, and event type.
• The normalized inbound text, provider-authored time when valid, Social Fanout receipt time, inbox state, and reply-claim/replied times.
• The caller-supplied reply text and a SHA-256 fingerprint of the outbound provider message receipt. We do not retain the raw outbound provider message identifier.
• A send ledger containing tenant, connection, and event ownership plus SHA-256 fingerprints for the recipient, dedicated Messages token, caller idempotency key, canonical request, and provider receipt. The ledger does not store those raw values. Each send action also stores its UUID, reply-window anchor and expiry, lifecycle status, provider HTTP status when present, a bounded safe error code, and lifecycle timestamps.
• Operation fences containing the connection, operation type and state, opaque ownership and reservation UUIDs, provider-unsubscribe recovery marker, lease expiry, and lifecycle timestamps. Subscription attempts contain the connection, hashed state and token fingerprints, attempt status, and lifecycle timestamps; they do not contain the raw token.

We do not retain the full raw signed Messages webhook payload. The recipient is derived only from the signed inbound event and is never accepted from the reply request. Social Fanout uses the earlier valid provider/receipt time to enforce the standard 24-hour reply window on the server. Social Fanout does not generate, schedule, or autonomously send Messages replies; it sends caller-supplied text only after an explicit authenticated request. It exposes no cold-DM, media-reply, recipient-override, or Human Agent workflow. Instagram message content is not used for advertising, profiling, or model training.

A valid Messages-app-signed data-deletion request removes only the dedicated Messages connection, credentials, normalized events, send actions, subscription attempts, and operation fences from Social Fanout. It does not remove sibling Instagram Publishing or Comments records solely because they reference the same Professional account. Ordinary Messages disconnect first requires Instagram to confirm that this dedicated app's webhook subscription was removed; if that provider step is unconfirmed, Social Fanout retains the connection behind a recovery fence and instructs the user to retry or revoke the app in Instagram. A verified privacy deletion still erases local data even if provider unsubscribe cannot be confirmed.

Operational data:

• Support email: we retain the full original email (MIME content, including headers and attachments) in private Cloudflare storage to recover delivery or parsing failures. Intake and dead-letter queues carry support intake records for reliable processing; these copies are not public.
• API request logs (endpoint, status code, latency, IP) for security and debugging.
• Aggregated usage metrics for billing and capacity planning.
• Headline experiment and signup events: the landing page sets a readable first-party cookie named sf_v. It contains only one version label (a, b, c, or d) and expires after 90 days. The landing page records a page view and clicks on signup links. The signup page records a page view and a checkout-button click. These events may include the version, page path, displayed headline or button label, selected plan, promotion code, and the allowlisted campaign attribution below. The browser events do not include your email, post content, platform tokens, or API key.
• Consent-gated Google Analytics: GA4 is available only on public marketing and signup pages and remains disabled unless you select Allow analytics. If allowed, Google receives a sanitized page location and referrer, page title, basic browser/device data, and Google Analytics identifiers, and may set first-party Google Analytics cookies. Only the allowlisted campaign parameters below are retained in the page location; email addresses, checkout session IDs, form values, API keys, dashboard activity, post/message content, and other customer content are excluded. Google Signals and every advertising-consent signal remain disabled. Your choice is stored in first-party local storage as socialfanout_public_analytics_consent_v1 and can be changed from Analytics settings.
• Campaign attribution: when you arrive through a tagged link, we may retain allowlisted campaign parameters and provider click references (such as UTM parameters, OpenAI oppref, Google gclid, or Meta fbclid) through signup or checkout so we can measure which campaigns produce trials and paid accounts. Unknown query parameters are discarded. We do not send these references to an advertising platform unless we first update this policy and configure the relevant measurement integration.
• Launch-update opt-ins: when you submit the separate updates form, we record your email address, site/topic preference, consent version, signup page, and timestamp to deliver Social Fanout product and provider updates. Account or API-key signup alone does not opt you in.

How We Use Data

• To run the service. Provider credentials authenticate to platforms; API keys authenticate you to us; jobs and logs power the dashboard.
• To maintain your connections. We refresh expiring tokens where the connected platform supports refresh.
• To bill correctly. Usage metrics drive Stripe invoices.
• To respond to platform requirements. If Meta, X, or another provider requests proof of authorized use during app review, we may share scope and usage records — never your post content.
• To debug and secure the service. Logs are retained as needed for support, abuse prevention, billing, and security investigations.
• To measure our own acquisition funnel. Allowlisted campaign parameters and the four named page-view and click events help us compare landing-page versions and connect a visit to a trial, checkout, or paid account without retaining arbitrary query-string data.
• To send product, provider, and launch updates when you opt in.

We do not sell your data. We do not use your posts, comments, or messages to train models. We do not analyze that content for advertising.

Sharing

Data is shared with:

• The platform you're publishing to (e.g. Meta, X) — that's the entire purpose of an API call.
• Stripe — for billing only.
• Muse Nexus's shared audience service (Supabase) — central consent storage and topic segmentation for Social Fanout updates.
• Google Analytics — only after explicit analytics consent and only for the sanitized public-page measurement described above. Advertising signals remain denied.
• Email delivery providers such as Resend or Klaviyo — delivery and unsubscribe processing when configured.
• A customer-configured webhook endpoint — only when that customer subscribes to selected signed outbound events such as publish.*, comment.received, or message.received. For the standalone Instagram Comments lane, comment.received contains only normalized source identifiers, author, text, and receipt time; it never contains provider tokens, Instagram signatures, or the raw provider payload. For the standalone Instagram Messages lane, message.received contains only the internal event ID, provider/platform/event type, inbound provider message ID (externalId), normalized text, provider-authored time when valid, and Social Fanout receipt time for the owning customer; it never contains a sender identifier, Messages token, Instagram signature, or raw payload.
• Our hosting and database providers (Railway, Supabase, Cloudflare) — under standard data-processing agreements.

We do not sell, rent, or share your data with advertisers, data brokers, or analytics resellers. We do not share posts, comments, or messages beyond the connected platform and any customer-configured webhook described above.

Platform-Specific Terms

Our use of data received from each connected platform complies with that platform's developer terms, including:

• Meta Platform Terms and Instagram API terms.
• X Developer Agreement & Policy.
• Pinterest Developer Terms.
• LinkedIn API Terms of Use.
• TikTok API Terms of Service.
• YouTube API Services Terms.

For Meta and Threads, a valid platform-signed deletion request immediately deletes the matching connection tokens, publishing job and post-history copies (including authored text and media references), and engagement data associated with the connection or its authorized Page/Instagram account IDs before we return a completion code. Our configured deauthorization paths use the same verified local purge implementation when a valid request reaches them; live provider delivery and response expectations are verified separately. Disconnecting a provider in the Social Fanout dashboard normally purges linked engagement data and hard-deletes that connection row and its provider credentials. For standalone Instagram Comments we also make a best-effort request for Instagram to remove the app webhook subscription; this provider-side unsubscribe behavior is not represented as guaranteed. If Instagram does not confirm that step, local deletion still completes and the dashboard tells you to revoke Social Fanout in Instagram settings. If you revoke only from a provider's own settings, the token becomes unusable but that provider may not notify us; disconnect in Social Fanout or email us to ensure the stored connection is removed. For standalone Instagram Messages, ordinary disconnect requires a confirmed provider unsubscribe before local purge; an unconfirmed response keeps the row for safe recovery. A valid signed Messages privacy request still completes local erasure.

YouTube API Services

When you connect a YouTube channel, Social Fanout uses YouTube API Services to publish videos to — and read the status of — the channel you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and our access, use, and handling of information from YouTube API Services is also governed by the Google Privacy Policy.

• What we access: we request only the youtube.upload and youtube.readonly scopes — enough to upload the videos you submit through our API to your own connected channel and to read that channel's identity and upload status. We never post to a channel you do not own or control.
• What we store: the OAuth access and refresh tokens Google issues for your channel, your channel ID, and the upload job records described above. Tokens are stored server-side and are never returned by our public API or dashboard.
• How we use it: only to carry out the explicit publish requests you (or your software) send through our API, and to refresh access. We do not use YouTube data for advertising, we do not sell it, and we do not use it to train models.
• How to revoke access: disconnect YouTube from your Social Fanout dashboard, or revoke Social Fanout's access at any time from Google's security settings page at security.google.com/settings/security/permissions. Because an external revocation may not deliver a deletion callback, also disconnect in Social Fanout or email us to ensure the stored row is removed. Dashboard disconnect immediately hard-deletes the stored connection and tokens.

Your Rights and Controls

• Disconnect any platform at any time from the dashboard or directly from that platform's app settings.
• Delete your account by emailing hello@socialfanout.com. Account-wide self-service deletion is not currently available in the dashboard. We delete tokens, content references, and personal data within 30 days of a verified request. Aggregated, non-identifying logs may be retained for security and accounting purposes.
• Export your data on request (jobs, connections, API key metadata, and normalized engagement events associated with your account).
• Correct or restrict processing of your data — email us.
• Control the headline cookie in your browser's cookie settings. You can view, block, or delete sf_v at any time. Clearing it removes the local version label and may cause a new version to be assigned on a later visit. You may also email us to ask for deletion or restriction of acquisition-event records. Because the public browser events do not contain an email address, we may not be able to link an anonymous event back to you.
• Control Google Analytics with the Analytics settings button on measured public pages. Choosing No thanks or withdrawing consent disables GA4; clearing socialfanout_public_analytics_consent_v1 asks you again on a later visit.
• If you're in the EU/UK, you have rights under GDPR. If you're in California, you have rights under CCPA/CPRA. Email us to exercise them.

Retention

• Provider credentials, including OAuth tokens, Bluesky App Passwords, and Discord webhook credentials: until the associated connection is successfully disconnected, a valid signed deletion/deauthorization request removes it, or your account is deleted.
• Post content metadata (job records): retained for publish history until you request account/content deletion or we remove it during operational cleanup. We do not currently claim a fixed automatic purge interval.
• Normalized engagement data, including comment and message data: retained until the associated connection is successfully disconnected, a valid signed deletion/deauthorization request removes it, your account is deleted, or a verified deletion request is completed. Dismiss does not delete comment data; Dismiss changes only local inbox state. We do not currently claim a fixed automatic purge interval.
• Instagram Messages operational records: active operation fences are retained until release; retryable recovery fences remain until they are resolved and released or the connection is deleted. Subscription attempts remain until connection deletion. Send actions remain until the linked event or connection is deleted, including by a valid signed deletion request.
• OAuth connection transactions are valid for ten minutes. A valid callback consumes the transaction and clears its private payload, including the PKCE verifier, before provider token exchange. Expired rows are deleted when a new connection starts; there is no fixed physical deletion guarantee if no new start occurs. Browser-binding and confirmation cookies have a ten-minute maximum age and are cleared when successfully consumed or confirmed, respectively.
• Request logs: retained as needed for support, abuse prevention, billing, and security investigations.
• Support-email recovery copies in private Cloudflare storage use a three-day lifecycle rule. Lifecycle deletion is asynchronous, not a guarantee of deletion at exactly 72 hours. The intake queue and dead-letter queue each use a 24-hour retention period from entry into that queue. These limits apply to recovery copies and queued records; support case records are retained as needed to handle the request and for support or security investigations.
• The sf_v headline cookie expires after 90 days. Acquisition experiment events are retained until we remove them during operational cleanup. We do not currently claim a fixed automatic purge interval for those events. Because public browser events do not contain an email address, we may not be able to locate an anonymous event for deletion or restriction.
• Consent-gated GA4 data is retained according to the active GA4 property settings. We do not currently claim a separate fixed automatic purge interval here.
• Launch-update opt-ins and their consent record: retained until you unsubscribe or request deletion. Unsubscribing from updates does not delete or change a Social Fanout account or API key.
• Billing records: as required by law (typically 7 years).

Security

Provider credentials are stored server-side and API keys are stored as one-way hashes. The hosted API uses HTTPS. Access uses the provider-specific credentials and permissions described above. We do our best, but no service is unbreakable — if you suspect a breach, email us at hello@socialfanout.com.

Children

This service is not intended for users under 16. We do not knowingly collect data from children.

Changes

If we change this policy materially, we'll update the date above and email active users at least 14 days before changes take effect. Continued use after a change means you accept the new terms.

Contact

Questions, deletions, complaints: hello@socialfanout.com

← Back to socialfanout.com