Privacy Policy
Last updated: September 23, 2026 • Effective Date: January 1, 2025
01.Overview & Agreement
InstaFlow ("we", "us", or "our") is committed to transparent and secure data handling. This Privacy Policy details our practices regarding data collection, processing, storage, and deletion when you interact with our platform, website, and publishing automation APIs.
By creating an account, connecting third-party platforms, or uploading content, you acknowledge and agree to the practices outlined in this policy. Additionally:
- By connecting your YouTube channel, you agree to be bound by the Google Privacy Policy.
- By connecting your Instagram account, you acknowledge Meta's Platform Terms and Data Policy.
- By connecting your TikTok account, you acknowledge TikTok's Developer and Privacy Policies.
02. Information We Collect
We restrict data collection to the minimum required to execute video uploads and scheduled publishing:
Account & Profile Data
Your authenticated email address, unique user ID, and avatar name provided via Google Firebase Authentication or Discord OAuth.
Social Platform Identifiers & Tokens
Instagram Business account IDs, connected Facebook Page IDs, YouTube channel IDs, and corresponding OAuth 2.0 access and refresh tokens. All tokens are encrypted at rest using server-side AES-GCM.
Uploaded Media & Captions
Video binaries, reel covers, audio references, titles, scheduled dispatch timestamps, and captions configured for distribution.
Operational Diagnostics
Publishing job error logs, container status codes, execution timestamps, and API response headers from upstream endpoints to verify successful delivery.
03. Cookies and Local Storage
InstaFlow utilizes essential browser cookies and Web Storage strictly for operational security:
- Session Authentication: Cryptographic session tokens managed via Firebase Authentication to verify identity across dashboard requests.
- OAuth State Verification: Nonce and CSRF verification cookies used during social OAuth redirection flows to prevent cross-site replay attacks.
- User Interface Preferences: Local storage flags for sidebar expansion and UI view configurations.
We do not employ third-party advertising cookies or cross-site tracking scripts.
04. YouTube API Services Compliance
InstaFlow integrates directly with YouTube API Services.
In strict adherence to Google Developer Policies:
- We do not store or cache authorized YouTube metadata (views, metrics, comments) for longer than 30 consecutive calendar days.
- Stale metric caches are automatically purged on continuous background cron schedules.
- You can inspect or revoke InstaFlow's access to your Google/YouTube account at any time via the Google Security Permissions Console.
05.Data Security & Token Isolation
All account records are isolated within Google Firebase and Cloudflare D1 SQL environments. OAuth secrets and access tokens are never transmitted to client-side browser contexts or mobile bundles. In transit, all communications are enforced over TLS 1.3.
06.Account Deletion & Data Purging
You retain complete ownership and sovereignty over your data. You may disconnect social channels instantly via your dashboard settings or request complete account erasure.
To delete your account and all associated tokens, uploaded media, and historical job logs, please review our Data Deletion Instructions or contact our privacy team directly at viralytics@insta-flow.online.
Contact Privacy Governance
If you have questions regarding this Privacy Policy or wish to exercise data subject rights (GDPR / CCPA), contact us at: