Postbooster Privacy Policy
Last updated: 2026-09-17

Postbooster ("we", "the app") connects to Instagram professional accounts via
Meta's Instagram API to monitor comments on posts and, where a keyword rule
matches, send an automated private reply or direct message on the account
owner's behalf.

Data we collect and store
- The connected Instagram professional account's ID, username, and profile
  type.
- OAuth access tokens for the connected account, encrypted at rest.
- Comments on monitored posts: the comment text, the commenting user's
  Instagram ID and username, and timestamps.
- Direct messages exchanged as part of automated outreach.
- Configuration you create: keyword rules, message templates, and an
  opt-out list.

Why we collect it
- To detect comments matching your configured keywords.
- To send the private replies or direct messages you configure.
- To authenticate API requests to Instagram on your behalf.

How we use Meta/Instagram data
Data obtained through the Instagram API is used only to provide the
features described above. We do not sell this data or share it with third
parties for advertising or unrelated purposes.

Data retention and deletion
You can disconnect an Instagram account at any time from Settings, which
revokes stored tokens. If you (or Instagram, via its own deauthorization or
data-deletion flow) remove the app's access, we erase the account's stored
data once no other authorized user remains connected to it. You can also
request deletion directly through Instagram's Apps and Websites settings,
which triggers our data deletion callback automatically.

Security
Access tokens are encrypted before being stored. Access to the application
and its data is restricted to authorized administrators.

Contact
Questions about this policy or your data: leon@lemon.earth