Privacy Policy

# Privacy Policy — Maestro Threads Bot **Last updated:** 2026-10-18 **Operator:** [REPLACE WITH YOUR LEGAL NAME / COMPANY] **Contact:** [REPLACE WITH EMAIL] This policy describes how Maestro Threads Bot (“the App”) processes data when you connect a Threads account. ## 1. Who the App is for The App is a private administration tool. It is not a consumer social network. Access is limited to operators you authorize. ## 2. Data we collect When you connect Threads via OAuth we may store: - Threads user ID and username - Access token (stored only in server environment / `.env`, never shown in the UI) - Content you create in the App (drafts, scheduled posts, validation notes) - Public post text, usernames, permalinks and timestamps returned by the official Threads API for keyword search, profile monitoring, mentions and replies under your posts - Engagement metrics for your own published posts (views, likes, replies, reposts, quotes) - Automation / action logs (without secrets) We do **not** intentionally collect precise location, government IDs, or payment card data. ## 3. How we use data Threads data is used **only** to operate the private admin panel for the connected account: - Operate publishing and drafting workflows for your connected account - Surface relevant public conversations and mentions for manual review (features approved by Meta) - Compute internal analytics for your own posts - Maintain security limits (rate limits, duplicate reply prevention) Public Threads content returned by Meta’s APIs is used only for these in-panel workflows and is not sold or shown to anonymous visitors. ## 4. What we do not do - We do not sell personal data or Threads public content to other users or third parties - We do not transfer access tokens, app secrets, or OAuth codes to third parties (tokens are used only to call Meta/Threads APIs from the operator’s server) - We do not run mass unsolicited messaging or auto-replies without an explicit human confirmation step for each send - We do not scrape Threads via unofficial APIs ## 5. Legal bases / consent You grant permissions through Meta’s OAuth consent screen. You may disconnect the App in Threads settings and revoke access. ## 6. Retention Drafts, logs and cached public post copies are kept while the operator maintains the instance, or until deletion is requested (see Data Deletion instructions). ## 7. Security Secrets are kept in server configuration, not in the admin HTML. Access to the admin should be restricted (network controls / auth) by the operator when exposing a public domain. ## 8. Children The App is not directed to children under 13 (or higher age required in your jurisdiction). ## 9. Changes We may update this policy; the “Last updated” date will change. Material changes should be communicated to operators. ## 10. Contact For privacy requests email [REPLACE WITH EMAIL].