Privacy Policy

Effective 18 September 2026. This Policy describes how FlySocial (“we”, “the Service”) processes personal data when you use this website and API. It is written to meet the transparency expected by TikTok for Developers, Meta (Instagram Login), Pinterest, and privacy laws such as Brazil’s LGPD and, where applicable, the GDPR.

1. Who we are

FlySocial is a publishing API operated by the organization that deployed this instance. If you were given a support email by that operator, use it. Otherwise contact the administrator who issued your API key. This website is the public face of the Service; Terms of Service are at /terms.

2. Data we collect

Account

Name, email address, hashed password, role, and optional default webhook URL. We store API keys only as SHA-256 hashes plus a visible prefix; the secret is shown once.

Connected social accounts

After you complete OAuth we store: platform name, destination user id, username and display name, avatar URL if the platform sends one, granted scopes, token expiry, and encrypted access/refresh tokens. We do not receive your destination-platform password.

Publishing requests

When you call the API we receive the caption, media URLs, and destination account ids for that request only. We fetch media bytes in memory as needed to upload them to TikTok or Pinterest; Instagram retrieves your public URL itself. We do not store posts, captions, or media in a database after the request finishes. A short-lived in-memory copy of an identical retry (x-request-id, about five minutes) may be kept so a network blip does not double-publish.

Technical data

IP address (for rate limiting and abuse prevention), timestamps, request ids you send (x-request-id), user agent on OAuth callbacks, and standard server logs. OAuth state values are stored briefly (about 10 minutes) to prevent CSRF, then deleted.

We do not sell data

We do not sell, rent, or share your personal data for advertising. We do not use connected-account data to train public AI models.

3. Why we process it (purposes and legal bases)

• Provide the Service — authenticate you, connect destinations, publish when you ask, send webhooks (contract / LGPD art. 7, II).
• Security — rate limits, token encryption, fraud and abuse detection (legitimate interest / legal obligation).
• Legal — respond to lawful requests and destination-platform enforcement.

Connecting a network is optional, but without it we cannot publish to that network.

4. Tokens and third parties

Encrypted tokens are used only to call the destination APIs you selected (refresh, creator info, upload, publish, list Pinterest boards). Recipients of data, depending on what you do:

• TikTok / ByteDance — Login Kit and Content Posting API, under TikTok’s terms and privacy policy;
• Meta Platforms — Instagram Login and content publishing, under Meta’s terms and privacy policy;
• Pinterest — OAuth and Pins API, under Pinterest’s terms and privacy policy;
• Your webhook endpoint, if you configure one;
• Infrastructure providers that host this instance (database, logs), bound to this operator’s configuration.

Those platforms are independent controllers of data you publish there. Read their policies before connecting.

5. Cookies and similar tech

This website does not use advertising cookies. Signing in at /demo sets a short-lived httpOnly session cookie (fly_session) so you can connect networks in the browser without pasting an API key. OAuth uses a one-time state parameter (and PKCE where the destination supports it), stored server-side, not as a tracking cookie. Programmatic API authentication uses the Authorization header.

6. Retention

Account records are kept while your account is open and for a reasonable period afterward for security. OAuth states expire in minutes. Disconnected social accounts have their tokens deleted. Publishing payloads are not archived. You may ask the operator to delete your account; we will delete or anonymize personal data unless we must keep a subset for legal claims or abuse prevention.

7. Your rights

Subject to law, you may access, correct, delete, or port your data, withdraw consent, and object to certain processing. Practically:

• disconnect a network with DELETE /v1/accounts/{id} (tokens removed);
• revoke API keys with DELETE /v1/keys/{id};
• revoke FlySocial inside TikTok, Instagram, or Pinterest settings;
• ask the instance operator to delete the FlySocial user record.

If GDPR applies, you may lodge a complaint with your supervisory authority. If LGPD applies, you may contact Brazil’s ANPD.

8. International transfers

Destinations (TikTok, Meta, Pinterest) process data in the countries they operate in. Your administrator may host FlySocial on servers outside your country. Tokens follow that hosting location.

9. Security

API keys are hashed. OAuth tokens are encrypted at rest (AES-256-GCM). Access is rate limited. No method is perfect; you must still protect keys and media URLs. Report suspected incidents to the instance operator.

10. Children

The Service is not directed at children under 18. We do not knowingly collect their data. Publishing content that sexualizes or exploits minors is forbidden and will be reported where required by law.

11. Automated decisions

We do not use your social graph for profiling or ads. Automated rate limits and idempotency checks may reject a request; you can retry with a new x-request-id or contact the operator.

12. Changes

We will update the effective date when this Policy changes. Material changes will be reflected on this page, which is linked in the site header and footer without requiring a menu.

13. Contact

Privacy requests: the operator of this FlySocial instance. Related documents: Terms of Service, About, API Docs.