Privacy Policy

1. Introduction

This Privacy Policy describes how BorstPhoto, LLC (“we,” “us,” or “our”) collects, uses, and protects your information when you use the PostPilot mobile application (the “App”). PostPilot helps you schedule and publish content to your own Facebook Pages and Instagram professional accounts, and view engagement for the content you publish. By using the App, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

• Account information: Your name and email address, collected during account creation via Apple Sign-In.
• Facebook and Instagram connection data: When you connect an account through Facebook Login, we receive and store the list of Facebook Pages you manage, their Page IDs and names, any linked Instagram professional account IDs and usernames, and the access tokens needed to publish on your behalf. We request only the permissions required for this functionality (“pages_show_list,” “pages_manage_posts,” and “pages_read_engagement”). We never receive or store your Facebook password.
• Content you create: The posts, captions, scheduled publish times, and any photos or videos you upload to publish through the App.
• Engagement data: For posts you publish, we read public engagement metrics from Meta — such as likes, comments, shares, reactions, and your Page’s follower count — so we can show you how your content performed.
• Device information: Device type and operating system version, collected automatically for compatibility purposes.

3. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and manage your account
• Display the list of Facebook Pages and Instagram accounts you manage so you can select where to publish
• Publish, schedule, edit, and delete posts to your connected Pages and accounts at your direction
• Show you engagement metrics for the content you publish
• Store the media you upload so it can be attached to your posts
• Maintain and improve the App’s functionality

4. Data Storage and Security

Your account data, connection data, posts, and access tokens are stored in a secure cloud database powered by Supabase. All data transmitted to and from our servers is encrypted in transit using TLS and encrypted at rest. Access tokens and account records are protected by row-level security so that you can only access your own data.

Photos and videos you upload are stored in Supabase Storage and accessed through secure, authenticated connections. All communication with the Meta (Facebook and Instagram) Graph API occurs over encrypted HTTPS connections.

5. Third-Party Services

The App integrates with the following third-party services, each governed by their own privacy policies:

• Apple Sign-In: For authentication. We receive only your name, email, and a unique identifier.
• Meta (Facebook & Instagram): For connecting your Pages and accounts, publishing content, and reading engagement on the content you publish. Your use of Facebook and Instagram is also governed by Meta’s Privacy Policy.
• Supabase: For secure database hosting and media storage. This includes your access tokens, Page IDs, and account metadata. Data is encrypted in transit and at rest.

6. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your data is shared only in the following circumstances:

• With Meta, solely to publish the content you choose to publish and to retrieve engagement for that content
• With the third-party services listed above, solely to provide App functionality
• When required by law, regulation, or legal process

7. Your Rights and Choices

You have the following rights regarding your data:

• Access: You can view your connected accounts and published content within the App.
• Disconnect: You can disconnect any Facebook Page or Instagram account at any time from the App’s Connected Accounts screen. Disconnecting revokes the App’s access token for that account and removes the stored connection.
• Deletion: You can delete your account and all associated data at any time. See our Data Deletion page for instructions.
• Withdraw consent: You may stop using the App at any time. You can also remove PostPilot’s access from your Facebook account settings under Business Integrations.

8. Children’s Privacy

The App is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

9. Data Retention

We retain your data for as long as your account is active. When you disconnect an account, the associated access token and connection data are removed promptly. If you delete your account, all associated data — including access tokens, Page IDs, account metadata, posts, and uploaded media — is permanently removed within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be effective upon posting to this page with an updated “Last updated” date. Your continued use of the App after any changes constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at: