Last updated 22 October 2026
Broadcast Desk lets you write a post once and publish it to the social accounts you connect. This policy explains what we collect, why, how long we keep it, and how to get it deleted.
When you connect Facebook or Instagram, we request only the permissions needed to list the Pages you manage and publish the posts you create: pages_show_list, pages_read_engagement, pages_manage_posts, business_management, and — for Instagram — instagram_basic and instagram_content_publish.
We use that data solely to show you your connected accounts and to publish content at your instruction. We do not transfer Meta Platform Data to any third party, and we retain it only while your account is connected.
Access and refresh tokens are encrypted at rest with a dedicated encryption key held separately from the database, and are never exposed in the interface, in logs, or in API responses. Each workspace's data is isolated so no customer can read another's accounts, tokens or posts.
Instagram requires that we host your images and video at a publicly reachable URL so its servers can fetch them during publishing. Files are stored at unguessable addresses and deleted when the associated post or your account is deleted.
You can disconnect any social account at any time from the Accounts screen — this revokes our access at the platform and removes the stored credentials. Deleting your account from Settings removes your workspaces, connected accounts, posts and uploaded media, and revokes the tokens we hold.
You can also request deletion directly from Facebook by removing the app in your Facebook settings, or by following the steps on our data deletion page.
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, by writing to [email protected]. We respond within 30 days.
If we change this policy materially, we will update the date above and notify you in the app before the change takes effect.