Privacy Policy
SocialtreeBot (“the app”, “we”) is operated by Iberrtech. This policy explains what the app collects, why, how long it keeps it, and what it will never do. It covers the app itself and every social account you choose to connect to it.
1. What we collect
Your account
- Your name and email address, so you can sign in and be contacted.
- A password, if you set one. It is stored only as a hash, never as readable text, so nobody — including us — can read it back.
- If you sign in with Google: your Google account's name, email address and profile picture URL, used only to create and identify your account.
Connected social accounts
When you connect a network, that network gives the app an access token. We store the token, an optional refresh token, its expiry, the permissions it carries, and public details of the account it belongs to — its name, username or id, and avatar URL. We never see or store your password for any network.
Your content
The posts you write, the images and video you upload, the networks you selected, and the result of each publishing attempt, including any error the network returned.
Technical records
Sign-in attempts with the IP address they came from, used to rate-limit brute-force attempts, and an application log of errors and publishing events. Access tokens, secrets and passwords are stripped from log messages before they are written.
2. Why we use it
Only to run the service you asked for: to sign you in, to show you your accounts and posts, to publish what you tell it to publish at the time you tell it to, to report what happened, and to keep the service secure. There is no other purpose.
We do not sell, rent or trade your data. We do not use it for advertising, for building profiles, or to train machine-learning or artificial intelligence models. We do not share it with data brokers.
3. Google user data
Permissions requested
| Permission | What it is used for |
|---|---|
| openid, email, profile | Sign-in only: to identify your account and show your name, email and picture. |
| youtube.upload | To upload the video you chose to your channel, with the title, description, tags and privacy setting you entered — at the moment you press Publish, or at the time you scheduled. Nothing is uploaded on its own. |
| youtube.readonly | To read your channel's name, id and thumbnail, so the app can show you which channel a post will go to. |
| youtube.force-ssl | To delete a video the app uploaded, when you ask it to — and only then. The Data API offers no narrower permission for deleting, so this is the smallest scope that allows it. The app never deletes anything on its own. |
We do not read your comments, subscribers, watch history or analytics, and the only video the app ever deletes is one it uploaded, at your request.
Limited Use disclosure
SocialtreeBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
YouTube API Services
The app uses YouTube API Services. By using its YouTube features you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can review and revoke the app's access to your Google account at any time at myaccount.google.com/permissions.
4. Meta Platform Data (Facebook and Instagram)
Permissions requested
| Permission | What it is used for |
|---|---|
| pages_show_list | To list the Facebook Pages you manage, so you can choose which Page a post goes to. We read nothing beyond each Page's name, id and picture. |
| pages_read_engagement | To read the Page's own details and confirm you hold a publishing role on it before a post is sent. |
| pages_manage_posts | To publish the post you composed to the Page you selected — at the moment you press Publish, or at the time you scheduled. Nothing is posted on its own. |
| instagram_basic | To read the username, id and profile picture of the Instagram Business or Creator account you sign in with, so the app can show you where a post will go. |
| instagram_content_publish | To publish the image or video and caption you prepared to that Instagram account, at the moment you choose. |
| business_management | To resolve which Business account a Page and its Instagram account belong to, so the right access token is used when publishing. |
We do not read your personal Facebook profile, friends, messages, comments, followers, insights or ad accounts, and we request no permission that would let us. We never post to your personal Facebook profile — the API does not allow it, and the app does not try.
Signing in to Instagram
Instagram is connected with Instagram Login: you sign in to Instagram itself, and the app receives a token for that one account. It is not connected through a Facebook Page, and the Instagram permissions above give no access to any Facebook Page or profile.
Publishing to Instagram
Instagram's Content Publishing API requires that media be fetched by Instagram from a public HTTPS address. While a post is being published, the image or video you selected is therefore reachable at an unguessable link on this site for as long as the upload takes. We do not index these links or share them.
Meta Platform Terms
SocialtreeBot's use of information received from Meta's APIs follows the Meta Platform Terms and Developer Policies. Meta's own handling of your data is described in the Meta Privacy Policy. You can review and revoke this app's access at any time from Facebook Settings → Business Integrations, and you can ask us to erase everything we hold on our data deletion page.
5. How it is protected
- Access tokens and refresh tokens are encrypted with AES-256-GCM before they are written to the database, and are never sent to your browser.
- Passwords are stored only as hashes.
- Uploaded media is stored outside the web root and served through signed, expiring URLs.
- Every database query is parameterised, and all output is escaped.
- No credential, token or secret is ever written to a log file; log messages are redacted before they are stored.
No system is perfectly secure, and we do not claim otherwise. If you believe your account has been compromised, write to support@iberr.in.
6. Who else sees it
The networks you choose to publish to, and only what you asked to publish there. Each network then handles that content under its own terms. Beyond that, your data is disclosed only where the law requires it.
7. How long it is kept
- Your account and content: until you delete them, or until you ask us to close your account.
- A connected account's tokens: until you disconnect it, which deletes them, or until the network expires them.
- Sign-in attempt records and application logs: a short rolling window, then deleted.
Deleting your account removes your posts, your connected accounts and your uploaded media from our systems. It cannot remove anything already published on a social network — delete those on the network itself.
8. Your choices
- Disconnect any social account at any time, from Connected Accounts.
- Revoke the app's Google access at any time from your Google account permissions page.
- Delete any post or uploaded file you no longer want stored.
- Ask for a copy of your data, or for your account to be deleted, by writing to support@iberr.in.
Deleting your data sets out each of these in full, including what a deletion removes and what it cannot.
9. Children
The app is not intended for anyone under 16, and we do not knowingly collect their data.
10. Changes
If this policy changes in a way that affects you, the date at the top changes and, where the change is significant, we will tell you by email.
11. Contact
Iberrtech —
support@iberr.in
https://iberr.in/