Privacy Policy

Information we handle

• Account and connection information: Our sign-in provider manages account authentication. Row Posts uses your authenticated user identifier and session to keep workspaces separate. When you connect a social account, we store its account identifier, display name or username, connection settings, and authorization tokens.
• Content you provide: Drafts, captions, images, videos, audio, brand guides, logos, and other files or instructions you add to the desk or share through an authorized agent.
• Publishing and insights data: Scheduled times, publishing status and destination links, plus recent Facebook and Instagram posts and available engagement metrics when you connect and sync those accounts. For TikTok, the current connection requests basic profile information and permission to publish videos you direct us to send.
• Facebook comment replies: When a Page owner connects Comment Links, we receive signed Facebook Page events and check comments for the owner's chosen keyword on a selected post. We keep matching comment identifiers, post identifiers, timestamps, and a keyed author hash scoped to that workspace and post. We also keep the owner's reply text, delivery status, and Facebook's delivery identifier. We do not retain commenter names or full comment text in Comment Links.
• Technical information: Session and connection cookies, upload and security request information such as IP addresses, and service logs needed to operate and protect the site. The desk also stores some interface preferences in your browser's local storage.

How we use information

We use this information to authenticate you; keep your workspace and connected accounts available; prepare, render, schedule, and publish posts you direct us to create; show post history and insights; support the agents you authorize; troubleshoot failures; and protect the service. We do not use connected TikTok data to target advertising or sell it.

Comment Links uses matching comment identifiers to send the Page owner's requested private download-link reply and its author hash to prevent repeat replies to the same person on the same post. A controlled test sends only to one specifically authorized comment. Comment Links does not read Messenger conversations or send follow-up conversations.

When information goes to others

• Connected social platforms: We send content and required settings to a platform when you direct Row Posts to publish there. A public post is then subject to that platform's privacy settings and policies.
• Facebook private replies: We send the matching comment identifier and saved reply text to Meta for private delivery. An optional public acknowledgement is sent only after Meta confirms the private reply. Commenter data from Comment Links is not sent to AI providers.
• AI agents you authorize: An agent with access to your workspace can read or change the data allowed by the permissions you grant. The agent's provider may process information it receives under its own policy.
• Service providers: We use infrastructure providers to host the service and manage sign-in. If transcription is configured, a compressed audio track from a Reel is sent to OpenAI to create a transcript. If caption scoring or audience analysis is configured and used, draft or historical caption text and relevant brand context may be sent through Vercel AI Gateway to the scoring model. Those optional features are unavailable when their server keys are not configured.

The public website also loads fonts from Google Fonts and a visual effect script from Cloudflare's CDN; those providers receive normal browser requests when the landing page loads.

Contacts and automated messages

When you enable Facebook or Instagram messaging, Row Posts stores contact identifiers and profile details, incoming and outgoing message content, selected comment and post identifiers, tags, custom fields, automation settings, and delivery records in your private workspace. Signed platform events connect those records to the account you authorized. We use this information to match your comment keywords, send your configured private reply, continue a conversation after the recipient interacts, and prevent duplicate sends. Imported contacts do not grant permission to message them.

If you enable public comment replies or Facebook comment likes in an automation, we send the comment identifier and, for a reply, your selected reply text to Meta. Public comment actions and private messages have separate delivery records and can succeed or fail independently. Delivery checks read the connected account’s event subscription and recent comments to help troubleshoot a saved automation; they do not send messages or replay comments.

Meta receives the recipient or comment identifier and message text, links, buttons, and card fields needed for delivery. Generating a preview from a website link requests that public website to read its title, description, and image metadata. Contact and messaging data is not sent to an AI provider by these messaging features. You can delete contacts and conversations or request removal using the contact below. Delivery and routing records may remain for duplicate prevention and troubleshooting until removal is requested; backup copies may persist.

Storage, security, and retention

Each signed-in user has a separate workspace. Connected account tokens are encrypted in storage; agent keys are stored as hashes. We use access controls and short-lived signed media links for provider uploads. No online service can guarantee absolute security.

We keep drafts, media, brand guides, and account history while needed for your workspace, unless you delete them or request removal. Original raw Reel uploads and previews are removed 30 days after their post publishes or 45 days after the Reel was last changed; finished renders may remain. Disconnecting a social account removes its locally stored connection tokens. Published copies remain subject to the social platform's policies, and backup copies may persist until overwritten.

Comment Links test candidates expire after six days and are removed during subsequent webhook receipt or dashboard refresh. Delivery records and author hashes remain with the workspace until removal is requested; they are not automatically erased when a reply expires or a rule is paused. You can request deletion of your comment-reply data using the contact below. Backups may contain earlier records until overwritten.

Your choices and requests

You can disconnect a social account, revoke or delete an agent, and delete supported drafts and media in the desk. You can also revoke Row Posts' access in the connected platform. To request access to or deletion of your Row Posts workspace data, email support@dailymahj.app. We may need to verify your identity before acting on a request. Disconnecting a platform does not automatically erase drafts, history, or posts already published there.

Changes and contact

We may update this policy as the service changes. The date above shows the latest version. Privacy questions or requests can be sent to support@dailymahj.app.