Privacy Policy

1. Account information and Meta permissions

When Samson authorizes the app through Meta, it may receive basic account information, such as a name and account ID; information about Facebook Pages he manages, including Page names and IDs; and details of the connected Instagram professional account, such as its username and account ID. Depending on the permissions granted and features used, it may also access profile details, published content, media information, and engagement or publishing status information.

Permissions are used to identify and select the connected accounts, read information needed to manage them, and create and publish posts on the authorized Facebook Page and Instagram account. Access depends on what Meta makes available and what Samson grants during authorization. The app does not request or store Facebook or Instagram passwords.

2. Authentication tokens and content

Meta provides authentication tokens that allow Postiz to act on the authorized accounts. These tokens are stored by the self-hosted Postiz installation and used to authenticate API requests, maintain the connection, and publish content without requiring a new login for each post.

Postiz processes post text, captions, images, videos, drafts, scheduling details, and related publishing records that Samson adds or retrieves for this purpose. Connected-account data is used to operate this personal scheduling and publishing workflow.

3. Scheduling and publishing through Postiz

Samson uses his self-hosted Postiz installation to prepare drafts, choose accounts, schedule posts, and publish immediately or at scheduled times. When a post is published, Postiz sends the content and the necessary authorization information to Meta’s APIs. Meta then processes and displays that content under the applicable Facebook or Instagram settings and policies.

4. Third-party services and data sharing

The integration relies on Meta’s Facebook and Instagram services and the self-hosted Postiz software. Infrastructure providers supporting the installation, such as hosting, storage, and backup providers, may process data as necessary to operate that installation. Self-hosting does not eliminate the processing required by Meta or those infrastructure providers.

Data is shared as necessary to authenticate connected accounts, store and schedule content, publish posts, maintain the service, or comply with applicable legal obligations. Published content is visible to the audience selected on the relevant platform. Meta’s own handling of data is governed by its Privacy Policy and Instagram Privacy Policy.

Connected-account data is not sold or rented and is not shared with advertisers or data brokers.

5. Data retention and security

Account information and tokens are retained while needed to maintain the authorized connection. Drafts, scheduled content, and publishing records are retained while needed for Samson’s content workflow, troubleshooting, and recordkeeping. Data that is no longer needed is deleted, subject to any necessary legal retention. Copies in backups may remain until those backups are rotated or expire.

Access to the self-hosted installation and its stored credentials is restricted to the owner and any infrastructure access necessary to operate it. Authentication tokens are sensitive credentials and must be protected from unauthorized access. No method of storage or transmission is completely secure, and absolute security cannot be guaranteed.

6. Disconnecting accounts and requesting deletion

Samson can disconnect a Facebook or Instagram account in Postiz’s connected-account settings. He can also revoke the app’s access in Facebook’s Settings under Business Integrations or Apps and Websites, or in the applicable Instagram app and website permissions settings. The available labels may vary by account and Meta interface.

Revoking access prevents further authorized access through that connection; it does not automatically delete previously stored drafts, records, or published posts. Stored account information, tokens, and associated content can be removed from the self-hosted installation. Posts already published on Facebook or Instagram must be managed or deleted on those platforms, which may retain data under their own policies.

Anyone with a question or a request to delete data associated with this app can email securitywithsam@gmail.com with the subject “Security With Sam - Postiz data deletion” and identify the relevant account and data. Do not send passwords or authentication tokens. Samson may request information needed to verify the request, then delete the applicable data under his control and confirm the outcome, subject to necessary legal retention and backup expiration.

7. Contact and policy updates

Owner: Samson Schmidt / Security With Sam
Contact: securitywithsam@gmail.com

Updates to this policy are published on this page with a revised effective date.