What we access and store from Meta
We request least-privilege Meta permissions, store comments and their author display names in an append-only ledger, encrypt access tokens at rest, and delete data on disconnect or on a verified Meta data-deletion request. We cannot post to your Page, touch your ad accounts, or read anything outside the specific comment and message permissions listed below.
This page is written for a procurement or security reviewer. Every claim maps to the product’s actual behavior. Where a fact is not yet confirmed, it is marked with an explicit TODO rather than softened.
The short version
Section titled “The short version”- We connect to Meta through OAuth. You approve a fixed set of permissions (“scopes”).
- We store comment text and the comment author’s display name and avatar URL, plus the raw provider payload, in an append-only ledger called interactions.
- Access tokens are encrypted at rest (AES-256-GCM).
- We do not request any advertising permissions, and we cannot create, edit, or delete your Page posts.
- Disconnecting an account, or a verified Meta data-deletion request, deletes the stored comment data.
Meta permissions we request
Section titled “Meta permissions we request”There are two ways to connect a Meta account, and they request different permissions.
Facebook Login (Facebook Pages + linked Instagram)
Section titled “Facebook Login (Facebook Pages + linked Instagram)”| Permission (scope) | Why we request it | What it grants |
|---|---|---|
email | Identify the connected account | Read the connected account’s email |
pages_show_list | Let you pick which Page to monitor | List your Facebook Pages |
pages_read_engagement | Read the comments to moderate | Read Page posts and comments |
pages_read_user_content | See comments left by other people | Read comments authored by other users |
pages_manage_engagement | Run the Flag / Allow / Reply actions | Reply to, hide, and unhide comments |
pages_manage_metadata | Real-time comment delivery | Subscribe the Page to webhooks |
pages_messaging | Read and reply to DMs on the Page | Read/reply Messenger conversations |
instagram_basic | Read the linked Instagram account | Read the IG account linked to the Page |
instagram_manage_comments | Moderate Instagram comments | Read and hide/reply IG comments |
instagram_manage_messages | Read and reply to Instagram DMs | Read/reply IG direct messages |
We deliberately do not request pages_manage_posts (which would let us create or edit Page posts) or any advertising scope (ads_read, ads_management, pages_manage_ads). This least-privilege set is pinned by an automated test against our Meta App Review submission, so it cannot drift silently.
Instagram Login (standalone Instagram)
Section titled “Instagram Login (standalone Instagram)”If you connect a standalone Instagram Business or Creator account instead of going through a Facebook Page, we request only:
| Permission (scope) | Why we request it | What it grants |
|---|---|---|
instagram_business_basic | Read the account and its media | Read profile and media |
instagram_business_manage_comments | Moderate comments | Read and hide/reply comments |
Standalone Instagram Login does not request a DM permission. Direct-message reading and replying on Instagram is only available when the Instagram account is connected through a Facebook Page (the instagram_manage_messages scope above).
What the product can never do
Section titled “What the product can never do”Based on the scopes above:
- It cannot post, edit, or delete your Page posts. We do not request
pages_manage_posts. We can reply to comments and send DMs, but we cannot publish or change posts on your timeline. - It cannot read or manage your ad accounts or ad spend. We request no advertising scopes at all.
- It cannot delete comments on Facebook or Instagram. The Delete action is unsupported on Meta — on a Facebook or Instagram comment it is a no-op and nothing is removed on-platform. (Deleting is only supported on other platforms.)
What we store versus discard
Section titled “What we store versus discard”When a comment (or DM) is ingested, it is written to an append-only interactions ledger. We store, rather than discard, the following:
| Data element | Stored? | Notes |
|---|---|---|
| Comment text | Stored | The full comment body |
| Author display name | Stored | The commenter’s public display name |
| Author avatar URL | Stored | Link to the commenter’s public avatar |
| Platform comment ID | Stored | Meta’s identifier for the comment |
| Posted-at timestamp | Stored | When the comment was posted |
| Media attachments | Stored | Attachment metadata (JSON) |
| Computed sentiment + confidence | Stored | Derived by us from the comment text |
| Source type | Stored | organic or ad |
| Raw provider payload | Stored | The verbatim Meta webhook/API envelope, retained for audit and replay |
Be precise about this with reviewers: the ledger is append-only and retains the full Meta payload in a raw_payload field, which can include author identifiers beyond the display name. We do not have a documented “process-and-discard” path where comment or author data is used transiently and then thrown away — ingested data is stored.
How long we keep it
Section titled “How long we keep it”- Active (non-deleted) comments are retained until the account or Page is deleted. No time-based purge of live interaction data was found in the product.
- Deleted data is purged 30 days after deletion. When a row is soft-deleted (
deleted_atset), a cleanup job hard-deletes it once it is older than the retention window — 30 days by default. This applies to interactions, audit logs, Workflows, webhooks, Pages, and accounts.
How deletion works
Section titled “How deletion works”There are three ways stored data is removed.
Disconnecting an account
Section titled “Disconnecting an account”A hard disconnect deletes, in a single transaction, all interactions for that account’s Pages, the Page records, and the account itself. A soft disconnect instead marks the account deleted and disables its Workflows; the cleanup job then purges it after the 30-day retention window.
Meta data-deletion request
Section titled “Meta data-deletion request”Meta requires a data-deletion callback. When Meta sends a signed deletion request, we verify its signature and then perform a synchronous hard delete in one transaction: audit logs, interactions (including system lifecycle rows), Pages, and accounts are deleted, and associated Workflows are deactivated. We record a completed data-deletion request with a 32-character confirmation code and send a best-effort confirmation email. You can check status at the /data-deletion/status/{code} page.
While an account is disconnected
Section titled “While an account is disconnected”If a token expires or an account becomes invalid, ingestion for that Page pauses — it does not silently drop comments. The poll cursor is not advanced while paused, so on reconnect the backlog is re-fetched and processed, bounded by whatever Meta’s API still returns. Comments that fall outside Meta’s retrievable window before you reconnect can be permanently missed. For the full behavior, see the connection pages below.