kapa — Privacy Policy

Effective date: 4 September 2026 · Last updated: 4 September 2026

This Privacy Policy explains how kapa ("kapa", "we", "us") handles information when you use our application and its related services (the "Service"). The Service uses the official Meta Platforms APIs (Facebook Login, Facebook Graph API, Instagram Graph API and Threads API) to let you manage social media accounts and Pages that you own or are authorised to administer.

We keep this simple: we collect the minimum data needed to operate the Service, we do not sell your data, and we do not use it for advertising or profiling.

1. Who we are

kapa is an independent software project. Contact: starlightboys@proton.me. This page is the authoritative privacy policy for the kapa application registered on the Meta for Developers platform.

2. Information we collect

2.1 Information you provide through Meta Login

When you connect a Facebook, Instagram or Threads account, Meta asks for your consent and then gives us access only to the items you approved. Depending on the permissions you grant, this may include:

Data	Why we need it
Account identifier, name, profile picture, username	To show you which account is connected and to attribute actions to the right account.
List of Pages / Instagram professional accounts you administer	So you can choose which account a post or query applies to.
Access tokens issued by Meta	To call the Meta APIs on your behalf for the actions you request.
Content you create or schedule through the Service (text, images, video, captions)	To publish or schedule it to the account you selected.
Aggregate insights and metrics returned by Meta (impressions, reach, engagement counts)	To display performance statistics for your own content.

We request only the permissions the feature you are using actually requires, and you can review or withdraw them at any time in your Facebook settings under Settings & Privacy → Settings → Apps and Websites.

2.2 Information collected automatically

Technical logs — IP address, timestamp, requested endpoint, and error codes, recorded by our server so we can keep the Service running and investigate faults. Retained for at most 30 days.
Session cookies — used only to keep you signed in. We do not use advertising, tracking or third-party analytics cookies on this website.

2.3 Information we do not collect

We do not collect your Facebook password, your private messages, your friend list, payment card details, precise location, contact lists, or any special category data (health, biometric, religious or political data).

3. How we use information

To authenticate you and keep your session active.
To perform the actions you explicitly request — publishing, scheduling, editing or deleting your own content, and reading the statistics of that content.
To maintain the security, availability and integrity of the Service, and to detect abuse.
To comply with legal obligations and with the Meta Platform Terms and Developer Policies.

We do not use your data to build advertising profiles, we do not sell, rent or trade it, and we do not use it to train machine-learning models.

4. Legal basis (GDPR / UK GDPR)

Where the GDPR applies, we process personal data on the basis of (a) your consent, given when you authorise the app through Meta Login, (b) performance of a contract, to deliver the features you asked for, and (c) our legitimate interest in operating a secure and reliable service. You may withdraw consent at any time by disconnecting the app (see section 8).

5. Sharing and disclosure

We do not sell or share your personal data with third parties for their own purposes. Data is disclosed only:

To Meta Platforms — necessarily, because every action you request is executed through Meta's APIs.
To our hosting provider — the server infrastructure on which the Service runs, acting solely as a data processor under our instructions.
Where the law requires it — in response to a valid legal request, court order or to protect our rights, safety, or the safety of others.

6. Storage, retention and security

Data is stored on access-controlled servers. All traffic to and from the Service is encrypted in transit with TLS (HTTPS). Access tokens are stored encrypted at rest and are never exposed in client-side code or URLs.
Access tokens and account data are kept only while your account remains connected. When you disconnect the app, or after 90 days of inactivity, the tokens are deleted.
Content you create is retained until you delete it, or until you delete your kapa account.
Technical logs are retained for a maximum of 30 days and then rotated out.
No method of transmission or storage is perfectly secure; we cannot guarantee absolute security, but we apply industry-standard measures and will notify affected users and, where required, the competent supervisory authority of any breach involving personal data without undue delay.

7. International transfers

Our servers are located in the European Union. If you access the Service from another country, your data will be transferred to and processed there. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Your rights and choices

You may, at any time:

Access a copy of the personal data we hold about you.
Correct data that is inaccurate or incomplete.
Delete your data — see the Data Deletion Instructions.
Withdraw permissions — remove kapa in Facebook under Settings & Privacy → Settings → Apps and Websites, or in the Instagram / Threads app under Settings → Website permissions. Revoking access immediately stops all further API activity by kapa on that account.
Object to or restrict processing, and request portability of data you supplied to us.
Complain to your local data protection authority.

Send any request to starlightboys@proton.me. We respond within 30 days and do not charge for the first request.

9. Children

The Service is not directed to children. You must be at least 13 years old (or the minimum age required in your country) to use it. We do not knowingly collect personal data from children; if we learn that we have, we delete it.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top always reflects the current version, and material changes will be announced in the application before they take effect. Continuing to use the Service after a change means you accept the updated policy.

11. Contact

Questions, requests or complaints about this policy or about your data: starlightboys@proton.me.

隐私政策（中文）

kapa 隐私政策

生效日期：2026 年 9 月 4 日 · 最近更新：2026 年 9 月 4 日

本政策说明 kapa（以下称"我们"）在你使用本应用及相关服务（以下称"本服务"）时，如何处理你的信息。本服务通过 Meta 官方接口（Facebook 登录、Facebook Graph API、Instagram Graph API、Threads API）帮助你管理你本人拥有或获授权管理的社交账号与主页。

一句话原则：只收集运行服务所必需的最少数据，不出售你的数据，不用于广告或用户画像。

一、我们收集什么

你通过 Meta 授权登录时，Meta 会征得你的同意，并且只把你已勾选的权限范围内的数据交给我们，可能包括：账号 ID、昵称、头像、用户名；你管理的主页与 Instagram 专业账号列表；Meta 签发的访问令牌；你在本服务中创建或定时发布的内容（文字、图片、视频）；以及 Meta 返回的内容统计数据（曝光、互动数等）。

我们还会自动记录必要的技术日志（IP、时间、接口、错误码），最多保留 30 天；网站仅使用维持登录状态的会话 Cookie，不使用广告或第三方追踪 Cookie。

我们不收集：你的 Facebook 密码、私信内容、好友列表、支付信息、精确位置、通讯录，以及健康、生物识别、宗教、政治等敏感类别数据。

二、我们如何使用

仅用于：验证你的身份并维持登录；执行你明确发起的操作（发布、定时、编辑、删除你自己的内容，读取相应数据）；保障服务安全与可用性、发现滥用；以及履行法律义务和 Meta 平台条款。我们不会将其用于广告画像、不会出售或交易、不会用于训练机器学习模型。

三、对外提供

我们不会为第三方自身目的出售或共享你的个人数据。仅在以下情形披露：向 Meta 平台（因为你请求的每一个操作本身就是通过 Meta 接口执行的）；向为我们提供服务器基础设施的托管服务商（仅按我们的指示处理数据）；以及法律法规、司法机关的有效要求。

四、存储、保留与安全

数据存放在受访问控制的服务器上，全程 HTTPS/TLS 加密传输，访问令牌加密存储、绝不出现在前端代码或 URL 中。访问令牌与账号数据仅在你保持授权期间保留，解除授权后、或连续 90 天未使用即删除；你创建的内容保留至你自行删除或注销账号为止；技术日志最多保留 30 天。我们的服务器位于欧盟境内。任何系统都无法保证绝对安全，但我们会采取业界通行的防护措施，一旦发生涉及个人数据的安全事件，将在不当延迟的情况下通知受影响用户及（在法律要求时）监管机构。

五、你的权利

你随时可以：查询我们持有的关于你的数据；更正不准确的数据；删除你的数据；在 Facebook 的设置与隐私 → 设置 → 应用和网站中移除 kapa 授权（撤销后我们立即无法再对该账号发起任何接口调用）；以及反对、限制处理或要求数据可携。请发送邮件至 starlightboys@proton.me，我们会在 30 天内答复，首次请求不收费。

六、未成年人

本服务不面向儿童，使用者须年满 13 周岁（或所在国家/地区规定的最低年龄）。我们不会有意收集儿童的个人信息，一旦发现将立即删除。

七、政策变更

本政策可能不时更新，页首的"最近更新"日期始终代表当前版本；重大变更会在应用内提前告知。变更后继续使用本服务，即视为你接受更新后的政策。

八、联系我们

对本政策或你的数据有任何疑问、请求或投诉，请联系 starlightboys@proton.me。