Privacy Policy

Last updated: May 14, 2026

1. Overview

HUAYU Instagram Publisher ("we", "our", or "the Service") is a tool that allows users to publish content to their Instagram Business or Creator accounts via the Instagram Graph API. This Privacy Policy describes what data we collect, how we use it, and your rights.

2. Information We Collect

Account information: Email address, display name, and hashed password when you register.
Instagram account data: Via Meta's OAuth, we receive and store your Instagram user ID, username, display name, and profile picture URL. We also store your long-lived access token to perform publishing on your behalf.
Media files: Photos and videos you upload for publishing. These are stored temporarily on our servers and deleted after successful publishing or after 48 hours.
Publishing history: Records of your publish jobs including captions, status, and timestamps.

3. How We Use Your Information

To authenticate you and maintain your session.
To publish photos and videos to your Instagram account on your behalf using the Instagram Graph API.
To send you email notifications about publish job outcomes (success or failure).
To provide customer support and respond to data deletion requests.

4. Instagram API Data

We use the following Instagram Graph API permissions:

instagram_business_basic — to read your Instagram account information (username, profile picture).
instagram_business_content_publish — to publish photos and videos to your Instagram account on your behalf.

We do not sell, share, or use your Instagram data for any purpose other than providing the publishing service described above.

5. Data Retention

Media files are automatically deleted after successful publishing or within 48 hours.
Account data and publish history are retained until you request deletion.
Instagram access tokens are stored securely and used only for publishing on your behalf.

6. Data Sharing

We do not sell or share your personal data with third parties, except as required by law or to provide the service (e.g., sending emails via our SMTP provider, publishing via Meta's API).

7. Security

Passwords are hashed using bcrypt. Sessions use HMAC-SHA256 signed cookies. Access tokens are stored in an encrypted database. All connections are served over HTTPS.

8. Your Rights & Data Deletion

You may request deletion of your account and all associated data at any time by visiting our Data Deletion page. We will process your request within 30 days. You can also revoke our app's access via your Facebook App Settings.

9. Contact

For privacy inquiries, contact us at: privacy@huayu.ltd