Legal · Draft

Privacy policy

Draft 0.1 · Oct 9, 2026 · not yet in force

1Who is responsible§

[SMMist operating entity, to be confirmed] is the controller for account and billing data. For the posts, media and records in your workspace we act as your processor: you decide what is in them. Contact: hello@smmist.com.

2What we collect, and why§

Email, display name: To sign you in by magic link and tell you about your workspace.
Session: IP address, user agent, times: To keep you signed in, show your active sessions and let you revoke them.
Posts, media, schedules, labels: To validate and publish them. This is your content.
Agent metadata (agent name, model, run id): Supplied by your agents so the record shows who drafted what.
Connected account ids, handles, profile name and picture: To show which account a post goes to.
Platform tokens and app keys: To publish on your behalf. Encrypted with envelope encryption; the master key is held outside the database.
API keys: We store only a sha256 of each key and its prefix; the key is shown to you once.
Audit events: The hash-chained record of every step, including actor and content hash.
Request logs and metrics: To run, debug and secure the service. No content in logs; secrets are redacted.
Billing details: Handled by our payment processor when paid plans open; we keep the plan and invoice records.

Data	Why
Email, display name	To sign you in by magic link and tell you about your workspace.
Session: IP address, user agent, times	To keep you signed in, show your active sessions and let you revoke them.
Posts, media, schedules, labels	To validate and publish them. This is your content.
Agent metadata (agent name, model, run id)	Supplied by your agents so the record shows who drafted what.
Connected account ids, handles, profile name and picture	To show which account a post goes to.
Platform tokens and app keys	To publish on your behalf. Encrypted with envelope encryption; the master key is held outside the database.
API keys	We store only a sha256 of each key and its prefix; the key is shown to you once.
Audit events	The hash-chained record of every step, including actor and content hash.
Request logs and metrics	To run, debug and secure the service. No content in logs; secrets are redacted.
Billing details	Handled by our payment processor when paid plans open; we keep the plan and invoice records.

3Data from X and Instagram§

From X we receive your account id and handle, and the ids of posts we publish. From Instagram (through Meta) we receive your professional account id, username, profile name and picture, the permissions you granted, and access tokens. We use this only to publish what you schedule and to report the result. We do not read your followers, messages or insights.

4How long we keep it§

Sign-in links: 15 minutes, single use, stored hashed
Sessions: 30 days, or until you sign out or revoke them
Uploaded media: 30 days after the post publishes, then deleted from storage
Posts and audit events: For the life of the workspace; the chain is append-only
Platform tokens: Until you disconnect the account, Meta tells us to delete them, or the workspace closes
Everything in a closed workspace: 90 days for export, then deleted

Data	Kept for
Sign-in links	15 minutes, single use, stored hashed
Sessions	30 days, or until you sign out or revoke them
Uploaded media	30 days after the post publishes, then deleted from storage
Posts and audit events	For the life of the workspace; the chain is append-only
Platform tokens	Until you disconnect the account, Meta tells us to delete them, or the workspace closes
Everything in a closed workspace	90 days for export, then deleted

5Who processes it for us§

our cloud hosting and object-storage provider, for the database and media;
a transactional email provider, to send sign-in links;
a payment processor, once paid plans open;
X and Meta, who receive the posts you publish to them, under their own policies.

The named list of subprocessors will be published here before general availability.

6Cookies and storage§

smm_session: Signs you in to the dashboard. HttpOnly, Secure, 30 days.
smm_csrf: Protects dashboard actions against cross-site requests.
smm_org: Remembers which workspace you were looking at.
smm-theme: Local storage: light, dark or system. Never sent to us.

Name	Purpose
smm_session	Signs you in to the dashboard. HttpOnly, Secure, 30 days.
smm_csrf	Protects dashboard actions against cross-site requests.
smm_org	Remembers which workspace you were looking at.
smm-theme	Local storage: light, dark or system. Never sent to us.

No advertising or cross-site tracking cookies are used.

7Deleting your data§

You can disconnect any account from the dashboard, which deletes its tokens at once and cancels its future posts. Owners can close a workspace, or write to us to have it deleted.

Instagram users: removing SMMist under Instagram’s Settings → Apps and websites sends Meta’s data deletion request to our callback at https://api.smmist.com/hooks/meta/data-deletion. We delete the tokens and profile data for that account immediately and return a confirmation code you can check at https://api.smmist.com/hooks/meta/data-deletion/{code}. Step-by-step instructions are on the data deletion page.

8Your rights§

Depending on where you live, you may ask to access, correct, export or delete your personal data, or object to how we use it. Write to hello@smmist.com; we answer within 30 days. You can also complain to your data protection authority.

9Security§

Credentials are encrypted at rest with per-record data keys; keys and tokens are never logged; media imports refuse private network addresses; and the audit chain makes any tampering with the record detectable.