Privacy Policy

Who we are

Simple Socials is operated by GAU Web Solutions LLC ("we", "us"). Our postal address is nick@gauwebsolutions.com. You can reach us about anything in this policy at nick@gauwebsolutions.com.

Simple Socials (simplesocials.dev) is an API that lets our customers ("Workspaces") publish posts to Facebook Pages and Instagram professional accounts that the account owner has connected. This policy explains what data we handle, why, how long we keep it, and how to have it deleted.

Data we receive from Facebook and Instagram

When you connect an account through a Simple Socials Connect Link, you sign in with Facebook and choose which Facebook Pages or Instagram accounts (from your business portfolio) to share. We then receive and store:

• Account identifiers and profile details: the app-scoped user ID (for Instagram, the ID of your business's system user for Simple Socials), the ID, name and username of each Facebook Page or Instagram account you choose to connect, and its profile picture URL.
• Access tokens for those accounts, with their expiry time and the permissions you granted (for example pages_show_list, pages_manage_posts, instagram_basic, instagram_content_publish). Tokens are encrypted at rest with AES-256-GCM and are never shown to the Workspace or written to logs.
• Publishing results: the IDs and links of posts we publish on your behalf, and any error Facebook or Instagram returns.

We do not read your messages, followers, insights or other content, and we do not request permissions beyond those needed to list your Pages and accounts and publish to them.

Data we receive from Workspaces

• The Workspace name and its API Keys (stored only as one-way hashes).
• Post content: text, scheduled times, and images or videos uploaded or linked for publishing.
• Webhook endpoint URLs and their signing secrets (encrypted at rest).
• Operational logs: request method, path, status and timing, with request IDs. Logs never contain tokens, secrets, API Keys or request bodies.

Data in access applications

When you apply for access at /apply we store your name, email address, company or project, what you plan to use Simple Socials for, the platforms you chose and how many accounts you expect to connect. We use it only to review your application and contact you about it. Tell us at nick@gauwebsolutions.com if you'd like an application deleted.

How we use it

We use this data only to provide the service: to list the accounts you can connect, publish the content a Workspace asks us to publish to the accounts you connected, report results to the Workspace, and keep the service secure and running. We do not sell data, use it for advertising, or build profiles.

Who we share it with

• Meta Platforms (Facebook and Instagram) receives the content we publish and the API calls needed to publish it.
• Cloudflare R2 stores media files (served from media.simplesocials.dev so Meta can fetch them) and encrypted database backups.
• The Workspace that sent you the Connect Link sees the connected account's name, username, picture, status and publishing results, but never its access token.

We may disclose data if required by law.

Retention

• Media (images and videos) is deleted 7 days after every post that uses it has finished publishing. Uploaded media that is never used is deleted after a short grace period.
• Access tokens are deleted as soon as the account is disconnected, the app is removed, or a deletion request is received.
• Account details and post records are kept while the connection or Workspace exists, and deleted on request as described below.
• Backups of the database are encrypted where they hold tokens and are overwritten on a rolling basis, so deleted data leaves backups shortly after deletion.

Data deletion

You can have your Facebook or Instagram data deleted from Simple Socials at any time, in any of these ways:

1. From Facebook: go to Settings & Privacy → Settings → Apps and Websites, remove Simple Socials, then under "Removed" open it and choose Send Request. Facebook notifies us, we delete your data, and you receive a confirmation code with a link to a status page.
2. For Instagram accounts: remove Simple Socials from your business portfolio (Meta Business Settings → Integrations → Connected apps). That stops all publishing at once: the next post fails and the account is flagged for reconnection. To have its data deleted as well, email us as described below.
3. By email: write to nick@gauwebsolutions.com from the address associated with your account, or with your Page or Instagram username, and we will delete your data within 30 days and confirm by email.
4. Through the Workspace: the Workspace that connected your account can disconnect it, which destroys its tokens immediately.

Deletion removes your tokens, account details and post records from Simple Socials. It does not delete posts already published on Facebook or Instagram; you can delete those there.

Security

All traffic uses HTTPS. Tokens and webhook secrets are encrypted with a key held outside the database, API Keys are stored only as hashes, and access to the servers is restricted to GAU Web Solutions LLC.

Changes and contact

We will post any changes to this policy on this page and update the date above. Questions: nick@gauwebsolutions.com. See also our Terms of Service.