Privacy Policy

Social Planner · last updated 9 November 2026

In short: Social Planner is a private, in-house tool that the operator of this service uses to plan social media posts on a calendar and publish them to its own Facebook Pages and Instagram accounts. It is not a public service and has no public sign-up. We do not collect personal data about the people who view, follow, like or comment on those Pages, we do not sell data, and everything can be deleted on request.

1. Who we are and what this service is

Social Planner (the “service”) is operated by the operator of this service. It lets a small, invited team write captions, upload images and videos, schedule them on a calendar, and publish them automatically to Facebook Pages and Instagram professional accounts that the team already manages, using Meta’s official APIs. It is used for our own content automation. Only people we invite have an account.

2. Information we handle

What	Details	Why
Team accounts	Name, email address and a password. Passwords are stored only as a salted hash and can’t be read back.	To sign people in and keep each person’s calendar separate.
Content	Captions, hashtags, scheduled dates, the platforms chosen, and the images and videos uploaded.	To plan and publish the posts you create.
Facebook / Instagram connection	The Page’s ID and name, the Instagram account’s ID and username, and the Page access token you provide. The token is stored encrypted.	Only to publish the content you scheduled to that Page or account, and to check or remove it afterwards.
API keys	Optional keys that let a script upload content. Only a one-way hash is stored.	To let your own tools upload to your calendar.
Sign-in and technical data	A session cookie, failed sign-in attempts (email and time, deleted after 24 hours), and standard server logs such as request address, time and status, kept by our hosting provider for about a week.	To keep the service secure and to fix problems.

We do not use advertising or analytics trackers, and we do not build profiles of anyone.

3. Facebook and Instagram data (Meta Platform)

The service connects to Meta’s Graph API using an access token for a Page or Instagram professional account that the account owner has authorised. It acts only on that Page or account, and only when someone on our team schedules or publishes a post.

What we use the connection for

Publishing videos and Reels to the connected Page, and to the connected Instagram account if there is one (permissions such as pages_show_list, pages_read_engagement, pages_manage_posts, and for Instagram instagram_basic and instagram_content_publish).
Scheduling a video on the Page and removing a scheduled video again if the post is changed or deleted.
Checking that a video we published or scheduled was published, and reading the Page’s and account’s name and ID to show which one is connected.

What we do not do

We do not collect, store or analyse personal information about the people who view, follow, like, comment on or message those Pages or accounts.
We do not read private messages or comments, and we do not use Meta data for advertising.
We do not sell, rent, or transfer Meta data to anyone, and we use it only to provide this service.

We follow Meta’s Platform Terms and Developer Policies. The token is removed when the Page is disconnected (see section 7).

We don’t sell or share information for advertising. We rely on a few providers to run the service, who process information only on our behalf:

Cloudflare: hosts the service and stores the database, the uploaded media and the server logs.
Meta (Facebook and Instagram): receives the captions and videos we publish, through its APIs.
Google Sheets (optional): if the operator switches this on, post text, hashtags, dates and the owner’s name and email are copied to a spreadsheet controlled by the operator. An AI assistant used by the operator may read it to suggest better hashtags.

We may also disclose information if the law requires it.

5. Security and retention

All traffic uses HTTPS. Passwords are hashed, Meta access tokens are encrypted at rest, and API keys are stored only as hashes.
Each person sees only their own calendar and media. Administrators can see all of them.
Posts and media are kept until they are deleted. After a post is published, its files can be deleted while the caption and dates are kept.
Server logs are kept by Cloudflare for a limited time (about a week). Failed sign-in records are deleted after 24 hours.

No online service is perfectly secure, but we take reasonable steps to protect the information we hold.

6. Cookies

We use one essential cookie to keep you signed in. It is not used for tracking or advertising. There are no analytics or advertising cookies.

7. Deleting your data

You can have your data removed at any time. Use whichever applies:

Delete content yourself: in the app, delete any post (this also removes its media) or delete only the media of a published post.
Disconnect Facebook / Instagram: in the app, open Connect and choose Disconnect. This deletes the stored access token and takes back any video still scheduled on Facebook.
Remove the app’s access on Facebook: on Facebook go to Settings & privacy → Settings → Business integrations (or Apps and websites), find this app and choose Remove. Its access token stops working immediately.
Delete your account and all your data: email the contact email shown on the Facebook app page for this service from the address you signed up with and ask us to delete it. We will delete your account, posts, media and connection details, and reply to confirm, within 30 days.

Because we hold no data about Facebook or Instagram users other than the account operator’s own connection details, deleting your content and disconnecting the account removes everything we hold from Meta.

8. Children

The service is for business use by adults and is not directed at children. We do not knowingly collect information from children.

9. Changes to this policy

If we change how the service handles information, we will update this page and the “last updated” date above.

10. Terms of use (summary)

The service is a private tool provided to invited team members. By using it you agree to use it only for lawful content that you have the right to publish, to follow the rules of Facebook, Instagram and any other platform you publish to, to keep your sign-in details secret, and not to try to access anyone else’s content. We may suspend an account that breaks these rules. The service is provided “as is”, without any guarantee that it will always be available or error-free, and posts are published on a best-effort basis.

11. Contact

Questions about this policy, or requests to access or delete your data: the contact email shown on the Facebook app page for this service.

Service operator: the operator of this service.