Privacy policy

Social AutoPoster is a social media marketing service for artists, operated by Art Storefronts. If you have a question about anything on this page, write to privacy@artstorefronts.com.

Three kinds of information, and nothing else:

• Your account. Your name and email address, so you can sign in and so we can write to you about your posts. Sign-in is handled by Clerk; we never see or store your password.
• Your work and your posts. The artwork you import or upload, its titles and descriptions, the posts you write and the ones we draft for you, when they are scheduled, and whether they went out.
• Your connected social accounts. Covered in detail in the next section, because it is the part people most want a straight answer about.

When you connect a Facebook Page, you are sent to Facebook to sign in and choose which Page we may use. We never see your Facebook password. Facebook then gives us access to that Page, and we store:

• The Page's ID and name.
• The ID and username of the Instagram professional account linked to that Page, if there is one.
• An access token that lets us publish to that Page and that Instagram account.
• The ID Facebook uses to identify you to this app specifically. It is not your Facebook profile ID, and it cannot be used to find you on Facebook.
• The list of permissions Facebook actually granted, so we can warn you before a post fails.

The access token is encrypted before it is written down (AES-256-GCM) and is only ever decrypted inside our servers at the moment a post is published. It is never sent to your browser, never written to a log, and never shared.

We ask Facebook for the narrowest set of permissions that lets the product work: to see which Pages you manage, to read a Page’s basic details and the link to a post once it is published, to publish posts to that Page, and to publish posts to the linked Instagram account.

We use this only to publish the posts you have approved, and to show you that they went out. We do not read your messages, your comments, your followers, or your private information. We do not read your Facebook profile or your friends. We do not use any of it for advertising, we do not sell it, and we do not share it with anyone else.

Where you connect other accounts — such as Bluesky or LinkedIn — the same rule applies: we store the minimum needed to publish on your behalf, we encrypt it, and we use it for nothing but posting the work you approved.

We draft posts for you using the artwork and details you provide. That text is sent to our AI provider to generate the draft. Your access tokens are never included. Nothing you write is used to train anyone’s model.

Your posts and artwork stay for as long as your account is open, because they are the record of what you have published. Access tokens are kept only while the connection is live — the moment you disconnect an account, or Facebook tells us you removed our app, the token is erased.

You can disconnect any account at any time from the Channels page. Disconnecting erases the stored access token immediately, and we can no longer post anywhere on your behalf.

You can also remove Social AutoPoster from inside Facebook, under Settings and privacy → Settings → Apps and Websites. Facebook tells us when you do, and we erase the token without you needing to do anything else.

To have everything removed, see deleting your data, which explains both routes and what each one covers.

If what we collect changes, this page changes with it, and the date at the top moves. We will not quietly start using your accounts for something this page does not describe.