Privacy Policy

Last updated: July 18, 2026

Social Fanout ("we," "us") provides an API and dashboard for publishing content and managing explicitly authorized social interactions on behalf of authenticated users. This policy explains what data we collect, how we use it, and the choices you have.

Data We Collect

Account data:

• Your email address and account identifier when you sign up.
• Hashed API keys you generate. We never store API keys in plaintext.
• Billing identifiers from Stripe (we do not see or store card numbers).

OAuth credentials from connected platforms: When you connect a social account (Meta, X, Pinterest, LinkedIn, TikTok, YouTube, Bluesky, etc.), we receive and store:

• Access tokens and refresh tokens issued by that platform.
• Provider-dependent profile metadata needed to identify a publishing destination (for example, account ID, username, display name, or Page ID).
• Permission scopes you granted.

Tokens are stored server-side in Supabase and are not returned by public API or dashboard responses. They are used only for the capability you authorize: publishing submitted content; subscribing to and receiving authorized comments or customer-initiated messages; sending a public comment reply, setting comment visibility, deleting a stored app-created comment reply, or sending a standard-window private text reply when you explicitly request that action; and refreshing access where the connected platform supports refresh. Social Fanout does not generate, schedule, or autonomously send comment or message replies; authenticated callers initiate those actions and supply the reply text.

For Pinterest specifically, Social Fanout does not request or retain API-derived profile metadata, token-response metadata, permission-scope copies, or a Board inventory. We store only the OAuth tokens needed to access the API plus locally generated connection and refresh-timing metadata. Board names and IDs are fetched with no-store caching only while you choose a destination; the selected Board ID is used for that immediate request and is not retained. The returned Pin ID is shown once in the publish response but is not stored in jobs, history, idempotency bodies, or outbound webhooks. Pinterest scheduling and replay are unavailable because they would require retaining the Board ID.

Content you publish:

• Post text, captions, and media URLs you submit through POST /v1/publish.
• Job records (status, timestamps, provider response IDs, error messages), except Pinterest provider response IDs and raw provider error details, which are not retained.
• Webhook delivery logs.

Standalone Instagram Comments data: When an authenticated user explicitly enables the dedicated Instagram Comments app, Social Fanout stores only these normalized fields under a separate Comments connection:

• The Instagram comment and source identifiers needed to display and reply.
• The owning connection and hashed API-key association, plus provider, platform, and event type.
• The comment text.
• The author's identifier and display name when Instagram provides them.
• The received, reply-claim, replied, visibility-change, and reply-deletion timestamps when applicable; the local inbox status (new, replying, replied, or dismissed); and the last provider-confirmed hidden state.
• The provider reply identifier and reply text after an explicit reply. Confirmed deletion redacts both and retains only a minimal hash/timestamp tombstone.
• A moderation action ledger containing tenant, connection, and operation ownership; target/request hashes; the caller-supplied idempotency key; timestamps; and a non-secret result receipt. It does not duplicate raw provider target identifiers or contain provider tokens.

We do not retain the full raw signed webhook payload for this lane. Dismiss is local: it changes only the Social Fanout inbox status and makes no Instagram request. The dedicated feature can set upstream visibility on the owned inbound comment and can delete only a reply Social Fanout previously created and stored; it does not accept arbitrary provider identifiers or delete the inbound comment.

A valid Comments-app-signed data-deletion request removes only the dedicated Comments connection and records linked to that connection from Social Fanout. It does not remove sibling Instagram Publishing or Messages records, including Publishing job/post history, even when those apps authorize the same Professional account. That account-data callback is distinct from the explicit moderation controls and does not itself delete or hide provider content. Provider-side content remains subject to completed customer-requested actions and Instagram's own controls and retention.

Standalone Instagram Messages data: When an authenticated user explicitly enables the dedicated Instagram Messages app, Social Fanout stores only the normalized information needed to receive a customer-initiated message, display it to the owning account, enforce the standard reply window, and send a text reply after an explicit authenticated request:

• The inbound Instagram message identifier used for delivery deduplication, the receiving Professional account identifier, and the sender's Instagram-scoped identifier.
• The owning Messages connection and hashed API-key association, plus provider, platform, and event type.
• The normalized inbound text, provider-authored time when valid, Social Fanout receipt time, inbox state, and reply-claim/replied times.
• The caller-supplied reply text and a SHA-256 fingerprint of the outbound provider message receipt. We do not retain the raw outbound provider message identifier.
• A send ledger containing tenant, connection, and event ownership plus SHA-256 fingerprints for the recipient, dedicated Messages token, caller idempotency key, canonical request, and provider receipt. The ledger does not store those raw values. Each send action also stores its UUID, reply-window anchor and expiry, lifecycle status, provider HTTP status when present, a bounded safe error code, and lifecycle timestamps.
• Operation fences containing the connection, operation type and state, opaque ownership and reservation UUIDs, provider-unsubscribe recovery marker, lease expiry, and lifecycle timestamps. Subscription attempts contain the connection, hashed state and token fingerprints, attempt status, and lifecycle timestamps; they do not contain the raw token.

We do not retain the full raw signed Messages webhook payload. The recipient is derived only from the signed inbound event and is never accepted from the reply request. Social Fanout uses the earlier valid provider/receipt time to enforce the standard 24-hour reply window on the server. Social Fanout does not generate, schedule, or autonomously send Messages replies; it sends caller-supplied text only after an explicit authenticated request. It exposes no cold-DM, media-reply, recipient-override, or Human Agent workflow. Instagram message content is not used for advertising, profiling, or model training.

A valid Messages-app-signed data-deletion request removes only the dedicated Messages connection, credentials, normalized events, send actions, subscription attempts, and operation fences from Social Fanout. It does not remove sibling Instagram Publishing or Comments records solely because they reference the same Professional account. Ordinary Messages disconnect first requires Instagram to confirm that this dedicated app's webhook subscription was removed; if that provider step is unconfirmed, Social Fanout retains the connection behind a recovery fence and instructs the user to retry or revoke the app in Instagram. A verified privacy deletion still erases local data even if provider unsubscribe cannot be confirmed.

Operational data:

• API request logs (endpoint, status code, latency, IP) for security and debugging.
• Aggregated usage metrics for billing and capacity planning.
• Launch-update opt-ins: when you submit the separate updates form, we record your email address, site/topic preference, consent version, signup page, and timestamp to deliver Social Fanout product and provider updates. Account or API-key signup alone does not opt you in.

How We Use Data

• To run the service. Tokens authenticate to platforms; API keys authenticate you to us; jobs and logs power the dashboard.
• To maintain your connections. We refresh expiring tokens where the connected platform supports refresh.
• To bill correctly. Usage metrics drive Stripe invoices.
• To respond to platform requirements. If Meta, X, or another provider requests proof of authorized use during app review, we may share scope and usage records — never your post content.
• To debug and secure the service. Logs are retained as needed for support, abuse prevention, billing, and security investigations.
• To send product, provider, and launch updates when you opt in.

We do not sell your data. We do not use your posts, comments, or messages to train models. We do not analyze that content for advertising.

Sharing

Data is shared with:

• The platform you're publishing to (e.g. Meta, X) — that's the entire purpose of an API call.
• Stripe — for billing only.
• Muse Nexus's shared audience service (Supabase) — central consent storage and topic segmentation for Social Fanout updates.
• Email delivery providers such as Resend or Klaviyo — delivery and unsubscribe processing when configured.
• A customer-configured webhook endpoint — only when that customer subscribes to selected signed outbound events such as publish.*, comment.received, or message.received. For the standalone Instagram Comments lane, comment.received contains only normalized source identifiers, author, text, and receipt time; it never contains provider tokens, Instagram signatures, or the raw provider payload. For the standalone Instagram Messages lane, message.received contains only the internal event ID, provider/platform/event type, inbound provider message ID (externalId), normalized text, provider-authored time when valid, and Social Fanout receipt time for the owning customer; it never contains a sender identifier, Messages token, Instagram signature, or raw payload.
• Our hosting and database providers (Railway, Supabase, Cloudflare) — under standard data-processing agreements.

We do not sell, rent, or share your data with advertisers, data brokers, or analytics resellers. We do not share posts, comments, or messages beyond the connected platform and any customer-configured webhook described above.

Platform-Specific Terms

Our use of data received from each connected platform complies with that platform's developer terms, including:

• Meta Platform Terms and Instagram API terms.
• X Developer Agreement & Policy.
• Pinterest Developer Terms.
• LinkedIn API Terms of Use.
• TikTok API Terms of Service.
• YouTube API Services Terms.

For Meta and Threads, a valid platform-signed deletion request immediately deletes the matching connection tokens, publishing job and post-history copies (including authored text and media references), and engagement data associated with the connection or its authorized Page/Instagram account IDs before we return a completion code. Our configured deauthorization paths use the same verified local purge implementation when a valid request reaches them; live provider delivery and response expectations are verified separately. Disconnecting a provider in the Social Fanout dashboard normally purges linked engagement data and hard-deletes that connection row and its OAuth credentials. For standalone Instagram Comments we also make a best-effort request for Instagram to remove the app webhook subscription; this provider-side unsubscribe behavior is not represented as guaranteed. If Instagram does not confirm that step, local deletion still completes and the dashboard tells you to revoke Social Fanout in Instagram settings. If you revoke only from a provider's own settings, the token becomes unusable but that provider may not notify us; disconnect in Social Fanout or email us to ensure the stored connection is removed. For standalone Instagram Messages, ordinary disconnect requires a confirmed provider unsubscribe before local purge; an unconfirmed response keeps the row for safe recovery. A valid signed Messages privacy request still completes local erasure.

YouTube API Services

When you connect a YouTube channel, Social Fanout uses YouTube API Services to publish videos to — and read the status of — the channel you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and our access, use, and handling of information from YouTube API Services is also governed by the Google Privacy Policy.

• What we access: we request only the youtube.upload and youtube.readonly scopes — enough to upload the videos you submit through our API to your own connected channel and to read that channel's identity and upload status. We never post to a channel you do not own or control.
• What we store: the OAuth access and refresh tokens Google issues for your channel, your channel ID, and the upload job records described above. Tokens are stored server-side and are never returned by our public API or dashboard.
• How we use it: only to carry out the explicit publish requests you (or your software) send through our API, and to refresh access. We do not use YouTube data for advertising, we do not sell it, and we do not use it to train models.
• How to revoke access: disconnect YouTube from your Social Fanout dashboard, or revoke Social Fanout's access at any time from Google's security settings page at security.google.com/settings/security/permissions. Because an external revocation may not deliver a deletion callback, also disconnect in Social Fanout or email us to ensure the stored row is removed. Dashboard disconnect immediately hard-deletes the stored connection and tokens.

Your Rights and Controls

• Disconnect any platform at any time from the dashboard or directly from that platform's app settings.
• Delete your account by emailing hello@socialfanout.com. Account-wide self-service deletion is not currently available in the dashboard. We delete tokens, content references, and personal data within 30 days of a verified request. Aggregated, non-identifying logs may be retained for security and accounting purposes.
• Export your data on request (jobs, connections, API key metadata, and normalized engagement events associated with your account).
• Correct or restrict processing of your data — email us.
• If you're in the EU/UK, you have rights under GDPR. If you're in California, you have rights under CCPA/CPRA. Email us to exercise them.

Retention

• OAuth tokens: until the associated connection is successfully disconnected, a valid signed deletion/deauthorization request removes it, or your account is deleted.
• Post content metadata (job records): retained for publish history until you request account/content deletion or we remove it during operational cleanup. We do not currently claim a fixed automatic purge interval.
• Normalized engagement data, including comment and message data: retained until the associated connection is successfully disconnected, a valid signed deletion/deauthorization request removes it, your account is deleted, or a verified deletion request is completed. Dismiss does not delete comment data; Dismiss changes only local inbox state. We do not currently claim a fixed automatic purge interval.
• Instagram Messages operational records: active operation fences are retained until release; retryable recovery fences remain until they are resolved and released or the connection is deleted. Subscription attempts remain until connection deletion. Send actions remain until the linked event or connection is deleted, including by a valid signed deletion request.
• Request logs: retained as needed for support, abuse prevention, billing, and security investigations.
• Launch-update opt-ins and their consent record: retained until you unsubscribe or request deletion. Unsubscribing from updates does not delete or change a Social Fanout account or API key.
• Billing records: as required by law (typically 7 years).

Security

OAuth tokens are stored server-side and API keys are stored as one-way hashes. All traffic is TLS-encrypted. We use scoped, least-privilege credentials for every third-party integration. We do our best, but no service is unbreakable — if you suspect a breach, email us at hello@socialfanout.com.

Children

This service is not intended for users under 16. We do not knowingly collect data from children.

Changes

If we change this policy materially, we'll update the date above and email active users at least 14 days before changes take effect. Continued use after a change means you accept the new terms.

Contact

Questions, deletions, complaints: hello@socialfanout.com

← Back to socialfanout.com