Post Planner Privacy Policy
Last updated: October 26, 2026
1. Who we are
Post Planner (postplanner.groupapp.co.il, the "Service") is operated by GroupApp Ltd., company number 517076345, 2 HaBanai Street, Sha'ar Binyamin, Israel ("we", "us"). Contact: [email protected].
This policy explains what information the Service collects, how it is used, how long it is kept and how to have it deleted.
2. What the Service does
A user signs in with a username and password we issue, connects their own Instagram professional account (Business or Creator) through Instagram's official login, sees and downloads that account's posts, reels and stories, and schedules posts, reels and stories to be published on that account.
3. Information we collect
(a) User account: the username, a one-way hash of the password, and when the account was created.
(b) From Instagram, after the account owner approves it on Instagram's permission screen:
- the account ID, username and account type;
- the account's posts, reels and live stories: ID, type, caption, time, link to the post and to its file, and the number of likes and comments. These are read from Instagram when the user opens the Service and are shown to that user; they are not stored;
- an access token, which we store encrypted.
(c) Scheduled posts: the file the user uploads, the caption, the format, the scheduled time, the publishing state and the link to the published post.
(d) Technical information: IP address and request logs, used for security and rate limiting.
We do not read Instagram messages, comment text or follower lists.
4. How we use it
Only to provide the Service: to show the user their own content and let them download it, to publish the posts the user scheduled at the time they chose, to keep the connection working (refreshing the access token), and to secure the Service.
We publish only what the user scheduled, only to the Instagram account that user connected. We never comment, like, follow or send messages on the user's behalf.
We do not sell this information, do not use it for advertising or marketing, and do not use it to train artificial intelligence models. Content the user downloads is theirs to use as they choose.
5. Sharing
We do not share this information with others, except with service providers that host and store the Service for us (cloud hosting, database and file storage) under confidentiality obligations, with Meta as part of using the Instagram API, or when the law requires it. Use of information received from Instagram is also subject to the Meta Platform Terms.
6. Retention
(a) The access token: until the account is disconnected, when it is deleted at once.
(b) The Instagram account ID, username and account type: while the account is connected, and after that until a deletion request.
(c) Scheduled posts: the uploaded file is deleted one day after the post is published, fails or is cancelled; the record is kept until a deletion request.
(d) The user account: until it is closed by us or at the user's request.
7. Disconnecting and deletion
The user can disconnect Instagram at any time with "Disconnect" in the Service, or by removing the app in Instagram's settings under "Apps and websites". Either way the access token is deleted at once and pending scheduled posts are cancelled.
The account owner can ask for deletion of the information received from Instagram through Instagram or by email to [email protected]. When the request comes from Meta, we delete the access token, the account ID and username, and the account's scheduled posts and their files, and return a confirmation code with a link to a page showing that the request was handled.
8. Security
Access tokens are encrypted at rest and never written to logs. Passwords are stored only as a one-way hash. Access to the Service requires a signed session, and sign-in attempts are rate limited.
9. Changes and contact
We may update this policy; the date at the top shows the latest version. Questions and requests: [email protected], or GroupApp Ltd., 2 HaBanai Street, Sha'ar Binyamin, Israel.