Privacy policy

Effective October 27, 2026. SocialCli is operated by Florentino.pro at socialcli.app and its pilot subdomain. Contact: admin@socialcli.app.

For Facebook and Instagram, see the data we use and how to disconnect or request data deletion.

Your account and sign-in

We use your email address for account verification, recovery and service messages. Our self-hosted Supabase Auth service verifies your chosen sign-in method and stores password hashes when you set a password; SocialCli does not store plaintext passwords. Google and Apple sign-in, when enabled, share identity identifiers and email details with this service. Apple relay addresses are treated as account email addresses. Account sign-in is separate from authorizing a YouTube connection. Recovery links and password setup are completed in your browser. Our SMTP service delivers verification, recovery and service notices; trial reminders can be sent when enabled (they are currently disabled in the pilot); email delivery providers may process recipients, message content and delivery metadata. Browser sessions use secure, HttpOnly cookies and encrypted access and refresh tokens. Sessions last at most 12 hours; identity checks may be cached for up to 45 seconds. Cookies are used for sign-in, CSRF protection and account connection, not advertising.

Social accounts and assistants

Before enabling account features, we ask the account owner to accept this privacy policy and record its version and acceptance time. Linking an assistant also requires a separate acknowledgment describing the data and permissions it receives. Agents must hand these decisions to the owner; they cannot accept on your behalf.

We process the brand label, account identifiers and names, granted permissions, authorization codes, provider tokens and assistant installation credentials needed for your requested operations. Credentials are encrypted at rest with authenticated encryption. Your chosen assistant receives scoped SocialCli connection capabilities and may retrieve provider access tokens. Provider permissions can cover more than a single action. Your passwords stay on provider sign-in pages. Connecting, paying or linking an assistant does not approve a publication.

Local creator workspaces, content, metrics and operation records remain on the computer or runner you choose. Your assistant provider handles information you share with it under its own policies. SocialCli does not contain a built-in AI model, sell account data, use it for advertising or use it to train models.

Facebook and Instagram data

SocialCli uses Facebook Login for Business and Meta APIs to connect Facebook Pages and linked Instagram professional accounts that you are authorized to manage. Depending on the permissions you grant and the features you request, SocialCli and your chosen assistant process:

Publishing, replies, moderation and Page-setting changes require your approval of the proposed action. We use Meta data for these requested account-management features, not for sale, advertising or model training. Requests and approved content are sent to Meta; your chosen assistant receives the information needed to perform and explain the requested operations. Hosted connection records, local workspaces, assistant-provider handling, temporary Instagram files and encrypted backups follow the storage and retention arrangements described in this policy. Meta handles data on its platforms under its own policies. Our use of Meta APIs is subject to the Meta Platform Terms.

Temporary Instagram files

When your SaaS Instagram connection needs a public media URL, SocialCli uploads your supplied JPEG, MP4 or MOV file to temporary storage on our florentino.pro server. Instagram retrieves it using an unguessable HTTPS link. Anyone with that link may retrieve the file while it is valid, so do not share it. The link expires 15 minutes after reservation, including upload time. The client requests deletion when its operation ends; automatic cleanup removes expired and interrupted files. Cleanup also runs on service startup and through an independent server timer. During an infrastructure outage, physical deletion resumes when the server runs again. Files are excluded from application backups. This service is not permanent storage: keep your originals. Files published on a social platform follow that platform’s retention policy.

Subscriptions and payment records

Stripe handles Checkout, payment methods, invoices and the billing portal under Stripe’s privacy policy. We store customer, subscription and invoice-event identifiers, payment status and access dates to provide and reconcile your USD 10 monthly subscription. We do not receive full card details. Billing uses Stripe Live mode.

Service administration and owner dashboard

Florentino.pro uses a private owner dashboard to administer SocialCli subscriptions, reconcile payments, support accounts and understand use of the hosted service. It combines account identifiers and email addresses, brands, access and trial dates, connection and assistant-installation status, and Stripe subscription, payment, refund, dispute, fee and payout records. Payment reports distinguish verified product revenue from unmatched or account-wide amounts. Product reports exclude designated internal accounts where applicable. Reports do not collect full card details, social passwords, post or comment text, or an assistant's private conversations.

Authorized owner accounts can view these reports after a recent browser sign-in and export account or revenue records as CSV. Access and export actions are audited. Reporting uses separate encrypted storage and read-only payment access; reporting access does not grant permission to publish content or change customer billing. Separately authorized owners with a recent browser sign-in can create accounts without choosing a customer password or sending an invitation, edit display names, manage complimentary access, suspend or reactivate accounts, and request deletion. Sign-in email is immutable in these administrative controls. Complimentary access creates no payment, charge or subscription and preserves trial history. Deletion may cancel future subscription billing through verified cleanup; published content remains on its networks. Encrypted operation previews and receipts record the actor, target, reason, revisions and outcome for up to 180 days after completion; unresolved operations remain until reconciled. Verified legacy manual grants may be replaced only at their exact original expiry, retaining encrypted prior evidence. Erasure minimizes personal details in retained operational evidence while retaining required financial and anti-abuse records. An exported file is a separate operator-held copy and must be protected and removed when no longer needed for its stated purpose.

When enabled, hosted-service activity records cover connection and assistant-link events, successful requests for connection access tokens, and the time they occurred. Coverage starts when collection is enabled; these reports do not track actions performed solely on an independent assistant's computer. This operational reporting is separate from optional public-website Google Analytics. Account-linked activity is retained for up to 90 days and owner access audit records for up to 180 days. Anonymous daily totals, where generated without person, payment or social identifiers, may be retained for up to 24 months. Missing history is not reconstructed as measured activity.

Current account-linked reporting snapshots are refreshed from their sources; superseded snapshots are removed after short-lived report and export pins expire, normally within 15 minutes, and abandoned collection snapshots within one day. Reporting removes account-linked details when deletion is detected against the current account source. Reporting backups follow the six days retention described below. Restored reporting remains blocked until current membership and deletion checks run, and old snapshots remain unavailable until refreshed. Required financial records held by Stripe are governed separately as described above.

Retention and deletion

Account data is kept while needed to provide your account. Sign-in and social authorization attempts expire after ten minutes; assistant pairing follows the expiry shown on its link. Browser sessions expire within 12 hours. Assistant installations expire after 90 days unless explicitly renewed; social connection grants expire after 90 days of inactivity. Provider token lifetimes are separate. Expired records and rate-limit counters are periodically pruned. Rate keys use hashes rather than raw IP addresses or emails.

Disconnect blocks the relevant service connection immediately. For Google, we also request programmatic revocation and retry failed requests using an encrypted, restricted revocation credential until completion. Reconnecting that Google account is blocked while revocation is pending. Removing only an assistant does not disconnect the entire Google grant. Revoke an assistant or request account deletion at Account. Deletion immediately blocks local service access and queues cancellation of billing and removal of the identity account, retrying if a provider is unavailable. It does not delete published posts. Previously issued provider tokens may remain valid until provider expiry or successful revocation; you can also revoke access directly in provider settings. Minimal deletion identifiers remain for 30 days to prevent a backup restore from reactivating deleted access.

To prevent repeated free trials, we retain a keyed HMAC eligibility marker derived from your normalized email, with the original trial dates, for 365 days from trial activation, including after account deletion. This marker is pseudonymous, not anonymous; it contains no plain-text email. Renaming your brand or reconnecting does not reset trial eligibility.

Full signed billing webhook payloads are kept for at most seven days and removed earlier after processing; minimal event hashes, IDs and reconciliation status are retained for audit and duplicate detection. Necessary payment records remain with Stripe under its retention rules. Encrypted operational backups are copied to an operator-controlled Google Drive destination; this does not access your personal Drive or require your Drive permissions. Snapshots older than six days are removed by the backup worker and an independent retention job scheduled every six hours. The Drive mirror removes expired repository objects without retaining them in Drive Trash. Cleanup resumes after an infrastructure outage. Restores must apply current deletion records and invalidate restored sessions and assistant credentials before enabling service; a restore without current deletion information remains blocked. Temporary media is not included. Logs exclude credentials and are size-limited. No service can guarantee absolute security.

Facebook and Instagram: disconnect and data deletion

These options are available to all SocialCli users. You can also request access, correction or deletion of Meta data relating to you by email, even if you do not have a SocialCli account.

  1. Disconnect a social account: sign in to SocialCli Account, find Connected accounts and choose Disconnect Facebook or Disconnect Instagram. Disconnect each connection you want to remove. This removes the stored connection credentials and blocks further access through that SocialCli connection. Previously delivered Meta tokens may remain usable until they expire or are revoked in Meta's settings.
  2. Remove Meta authorization: in the Facebook settings of the person who authorized SocialCli, find Business integrations and remove SocialCli. Review Meta's confirmation before proceeding: this can affect the Pages and linked Instagram accounts covered by that authorization. Removing authorization does not itself erase data already obtained by SocialCli or your assistant.
  3. Delete your SocialCli account: in Account, choose Delete my account, review the explanation, type DELETE and confirm. This blocks SocialCli access, removes saved social credentials and starts the account and billing cleanup described under Retention and deletion.
  4. Request data deletion or correction by email: write to admin@socialcli.app with the subject Meta data deletion request or Meta data correction request. Identify the relevant account, Page, Instagram profile or comment and the data concerned. Do not send passwords, tokens or keys. We may verify your identity or authority and ask for the minimum information needed to locate the data. You can use this route if you cannot sign in or want to request deletion without deleting your entire SocialCli account.

Disconnecting or deleting a SocialCli account does not delete posts or comments already published on Facebook or Instagram. Manage those in the relevant platform. Remove local SocialCli credentials, exports and reports from each computer or runner, and request removal of separate assistant chat histories or copies from their holder. SocialCli cannot remotely erase those independent copies. Our retained records, encrypted backup expiry and restore protections follow Retention and deletion; temporary Instagram files follow Temporary Instagram files above.

Google and YouTube data

SocialCli uses YouTube API Services. Depending on the permissions you approve, your assistant can access channel identity, video metadata, comments and analytics, and perform supported uploads or management actions. SocialCli uses this information to provide the features you request. It does not sell Google user data, use it for advertising or use it to train a general-purpose AI model. Your chosen assistant may receive command output and credentials needed for approved operations. Before linking it, confirm that its account settings and contractual terms allow this use: no advertising, sale or general-purpose model training with Google data, and no unrelated transfer or human access. Do not connect an assistant if you cannot satisfy those requirements. Listing a compatible agent on our website does not certify every plan or configuration of that provider. SocialCli’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

See Google’s privacy policy and the Google API Services User Data Policy. You can revoke Google access at Google account permissions, separately from requesting deletion of SocialCli account data. Local reports or files already held by your assistant must be removed from that runner separately.

The client expires managed YouTube API caches after six days and purges them when it observes disconnection, account deletion or revoked authorization. Install the daily cleanup service on each macOS or Linux runner through socialcli data-cleanup-install. Cleanup cannot execute while its runner is offline or stopped; it resumes with the client or service. Request immediate local cleanup with socialcli data-cleanup --brand YOUR_BRAND --root YOUR_WORKSPACE --purge-youtube. Failed cleanup blocks use of affected managed data. User-supplied originals and independently imported YouTube Studio files are preserved. Arbitrary exports, third-party chat histories and independent copies require separate removal from their holder. Expired historical snapshots cannot supply a weekly comparison; missing comparisons are reported as unavailable.

Other services and your choices

Authorized requests send required data to Google/YouTube, Meta/Facebook/Instagram or TikTok. Independent application credentials and self-hosted deployments follow the storage choices and operator policies you select. Source code is maintained in a private GitHub repository; never send credentials or private social content in a support report. The public website loads Google Analytics 4 only after you choose “Accept analytics.” Until then, we do not load Google’s tag, send analytics events or set analytics cookies. “Reject analytics” is equally available. You can change your choice using “Privacy settings” on every public page. Your choice is stored locally for 180 days without automatic renewal; missing, invalid or expired choices leave analytics off. If browser storage is unavailable, an explicit choice applies to the current page only. This includes recording when a visitor successfully copies the homepage installation prompt. The event contains the page placement only; it does not include the prompt text, email address, account ID, or social content. Google may receive page and referrer URLs, browser and device information, approximate location, and online identifiers, including through cookies or similar technologies. Google processes this information under its Privacy Policy. SocialCli does not use website analytics data for advertising. Acceptance permits visit measurement and the _ga and _ga_* identifier cookies, not advertising. Withdrawing consent stops new tracking, clears this website’s Google Analytics cookies and reloads the page. It does not recall requests already sent or delete information already held by Google. Essential sign-in and account-connection cookies on pilot.socialcli.app are separate and remain unchanged. You can also block or clear cookies in your browser. Hosting infrastructure also processes technical requests needed to serve the site.

Contact

To request access, correction or deletion, or ask about retention, email admin@socialcli.app. Do not include tokens, passwords or keys. We may verify ownership before acting on an account request. We will update the effective date when this policy changes.