Privacy Policy
Last updated 2026-08-21
Draft. The operator of this service is not yet registered, so this document does not name a legal entity, a postal address or a governing jurisdiction. Everything it says about how the software handles data is accurate and derived from the running system.
Fovee is a tool for managing Instagram professional accounts: publishing posts, replying to comments and messages, and seeing how content performs. It works through Instagram's official API, using only the permissions you grant.
This page describes what the software actually stores. It is generated from the same definitions the running system uses, so it cannot describe a retention period the service does not enforce.
What is stored
Your Fovee account
Provided by you.
- your email address
- a hash of your password — never the password itself
- sign-in sessions
To let you sign in and to keep your data separate from every other user.
Connected Instagram accounts
Retrieved from Instagram with your permission.
- your Instagram user ID, username, account type and profile picture URL
- your follower count at the time it was last read
- the permissions you granted
- the access token Instagram issued, encrypted at rest
To act on your behalf on Instagram — reading your posts, publishing, replying — for exactly the permissions you granted and no others.
Media you upload
Provided by you.
- the image or video file itself
- its filename, type, size, dimensions and a checksum
To publish it to Instagram. Instagram downloads the file from a temporary public link, which is why the file must be reachable until the post is published.
Posts you publish
Provided by you.
- captions
- the first comment you want posted under a post, and whether it went out
- scheduling times
- the Instagram post ID once published
- errors
To publish and schedule posts, and to show you what happened to each one.
What happened to each post
Produced by Fovee while running.
- each time Fovee tried to publish a post, and how long it took
- the result of each try, and any error Instagram returned
- each change of state, and whether you, a worker or the system caused it
To explain why a post is where it is — published, waiting, failed or cancelled — rather than only showing you the outcome. Deleted with the post it describes.
What you have already seen
Provided by you.
- the moment you last marked your activity feed as read
To show you what has happened since you last looked. Kept per person rather than per workspace, so a colleague opening the feed does not clear it for you.
Comments
Retrieved from Instagram with your permission.
- the text of comments on your posts
- the Instagram ID and username of whoever wrote them
- whether a comment is hidden or was deleted
To show you your comments and let you reply, hide or delete them. This includes comments written by other people on your posts — Instagram provides them, and there is no way to moderate a comment without holding it.
Direct messages
Retrieved from Instagram with your permission.
- the text of messages sent to and from your account
- the Instagram ID and username of the other person
- attachments as Instagram describes them, reactions, and read receipts
To show you your inbox and let you reply. Instagram only permits replying within 24 hours of the other person's last message, which is why the time of that message is stored.
Statistics
Retrieved from Instagram with your permission.
- daily counts for your account: reach, views, likes, comments, saves, shares and similar
- the same kind of counts per post, recorded once a day
- a record of which days have been collected
To show you how your account performs over time. Instagram deletes these after 90 days, so Fovee stores them as they are published — that longer history is the feature. They are counts about your own account and contain no information about individual people.
Notifications from Instagram
Retrieved from Instagram with your permission.
- the raw notification Instagram sends when a comment or message arrives
- which can include message text and usernames
To receive comments and messages as they happen rather than by polling. Once processed, the content lives as comments and messages, and the raw record is deleted on the schedule below.
How you organise your accounts
Provided by you.
- the names and colours you give your groups
- which of your Instagram accounts belong to which group
To let you work on several accounts at once — filtering, bulk actions, and shared settings. You choose the names, so a group may be named after a client or a person; Fovee treats it as a label and never derives anything from it.
Assistant settings
Provided by you.
- which groups, accounts and conversations use the assistant, and in which mode
- the model and preset you chose, by their identifiers at your provider
- your provider licence key, encrypted at rest and never shown back to you
- the list of models and presets your provider last offered
- the replies it drafted, whether you sent or declined them, and who decided
To let you decide where an assistant may draft or send replies, and with which settings. The licence is stored so Fovee can call your provider on your behalf; it is kept in a separate table from the settings and is never returned by any page or API response.
Operational records
Produced by Fovee while running.
- background jobs, what they were carrying, and how they ended
- webhook notifications Instagram sent us, as received
- audit records of security-relevant actions such as signing in, connecting an account, or deleting data
- server logs, from which access tokens and passwords are removed before writing
To run the service reliably and to be able to investigate a problem or a security incident after the fact.
Other people's data
Comments and direct messages necessarily contain information about the people who wrote them — their Instagram username and what they said. Fovee holds this only so you can read and reply to it, and only for accounts you have connected. It is never used to build profiles, never sold, and never shared with anyone other than Instagram itself when you act on it.
Fovee cannot start a conversation with anyone. Instagram only allows replying to someone who messaged your account first, and only within 24 hours of their last message. This is a limitation of the platform, and Fovee does not work around it.
How long it is kept
| Data | Kept for | Why |
|---|---|---|
| Instagram account profile, access tokens, and connection status | Until deleted | Needed for as long as the account is connected. Removed when it is disconnected or deleted. |
| Media you upload, and the posts published from them | Until deleted | Your own content. Kept until you delete it or your account. |
| Comments and direct messages retrieved from Instagram | Until deleted | They are the inbox. Removed when the Instagram account is disconnected or your account is deleted. |
| Statistics about your account and posts (insights) | Until deleted | Instagram keeps these for 90 days and then deletes them permanently. Fovee stores them as they are published so a longer history exists at all — that is the point of the feature, and it is why they are kept until you delete your account. |
| Raw notifications received from Instagram (webhooks) | 30 days | Their content is already stored as comments and messages. What is left is a technical record kept briefly for diagnosing problems. |
| Finished background jobs | 30 days | Operational records, kept to investigate a failure after the fact. |
| Background jobs that failed permanently | 90 days | Failed work that may still need to be replayed. Deleting it early would erase the only record that something never happened. |
| Sign-in sessions | 7 days | Expire on their own and are swept afterwards. |
| Audit records of security-relevant actions | Until deleted | Kept without your identity once your account is deleted — they are how a deletion can be shown to have happened. |
| Data deletion requests | Until deleted | Kept as proof the deletion took place. They hold no identifier — only an irreversible hash of the one the request named — and no other information about you. |
Who else receives it
- Meta Platforms (Instagram) — Everything you ask Fovee to do on Instagram — publishing, replying, reading statistics. Fovee is a client for the official Instagram API. There is no way to use it without Instagram receiving those requests.
Fovee runs no advertising, no analytics and no third-party tracking. Nothing is sold, and nothing is shared with anyone not listed above.
Deleting your data
There are three ways data is removed, and all three run the same deletion:
- Disconnecting an Instagram account removes that account's posts, comments, messages and statistics, along with its access token. Media you uploaded stays, because it belongs to you rather than to one account.
- Deleting your Fovee account removes everything: your account, every connected Instagram account, all content, all statistics, all uploaded files, and any queued work.
- Asking through Instagram — if you remove Fovee from your Instagram settings, Instagram notifies us and the same deletion runs automatically. You are given a confirmation code and a page showing what was removed.
Two things deliberately survive a deletion, and neither identifies you: a record that the deletion happened, and an audit entry with your identity removed. They exist so a deletion can be shown to have taken place.
Security
- Instagram access tokens are encrypted before being stored, and are never sent to your browser.
- Passwords are stored as Argon2 hashes and cannot be recovered.
- Tokens and passwords are removed from server logs before they are written, rather than relied upon not to appear.
- Every stored record belongs to exactly one Fovee user, and every query is restricted to that user. Another user's data reads as not existing.
Your rights
You can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Deletion is available immediately from your account and through Instagram; for the others, contact us.
Contact
Contact details will be published here once the operating entity is registered. See the contact page.