Privacy policy

This policy applies to Toolbloom at toolbloom.in and explains how we process information when you register, connect Instagram, upload media or schedule Reels. Contact privacy@toolbloom.in for privacy questions.

Information we collect

We process your name, email, user identifier, Free/Premium status, manually assigned Premium expiry, credit balance, credit history, notifications and account ban records. Supabase Auth handles passwords; Toolbloom does not store plaintext passwords.

For connected Instagram accounts we process the account ID, username, authorization token and its expiry. We also process the Instagram profile picture URL when supplied, to display your connected account photo. Account photos load from the Meta-provided image host, which can receive your IP address. We process uploaded videos, optional cover images, captions, schedule and batch settings, publishing results and error records.

When you use a signed-in workspace, we update your latest activity time, latest IP address and approximate city, region and country supplied by Cloudflare. This is an IP-based estimate, not GPS tracking. The superadmin can view it for access management and security. We keep the latest activity record, not a location history.

Purposes and Instagram permissions

We use account information to authenticate you and manage access. Instagram basic permission identifies connected professional accounts; content publishing permission creates and publishes the Reels you schedule. We do not request your Instagram password, read direct messages or manage comments as part of the current scheduler.

Service providers and sharing

Supabase provides authentication, database and media storage. Cloudflare hosts the site and scheduler. Meta receives authorized publishing requests including captions, media URLs and the relevant account authorization. These providers may process data in multiple countries according to their own terms and safeguards. We do not sell your personal information or use your uploaded media for advertising.

Media URL access

Instagram needs to retrieve uploaded media from a publicly accessible URL. Toolbloom uses randomized storage paths, but anyone who obtains a URL can access that media until it is removed. Upload only material suitable for this publishing workflow.

Security and access

We use HTTPS, database access controls and encrypted Instagram tokens. Administration requires a server-verified admin role. Users cannot access other users' credit, notification or admin activity records. No internet service can guarantee absolute security.

Credits, notifications and administration

We record credit reservations, charges, releases, Premium expiry and admin grants to maintain your balance. In-app notifications cover signup, Premium, credit updates and admin messages. We retain admin action records, ban reasons and blocked IPs for service management. IP bans affect Toolbloom application requests; network addresses can be shared.

Retention and deletion

We keep account and scheduling data while it is needed to operate your workspace. Media used only by published or cancelled Reels is eligible for automatic deletion seven days after the last such terminal event. Cleanup runs in small batches and retries storage errors; it can occur later than seven days. Pending, held, processing, failed and uncertain jobs preserve their referenced files. Filenames and publishing/credit records remain available as history. Your latest activity record stays until your Toolbloom account is deleted or replaced by newer activity.

Disconnecting Instagram removes its stored connection and associated publishing records. A verified Meta data deletion callback also removes media associated only with that connection. Media still used by another authorized connected account is retained for that account's scheduled work. Temporary deletion retry records are cleared of account IDs and paths after completion. A random confirmation code and completion time remain as a deletion receipt. Aggregate publication events keep a random post key and timestamp without account IDs, captions or media, to count historical successful publications after disconnection.

For full Toolbloom account deletion, email us from your registered address. We may verify ownership and aim to respond and process requests within 30 days, except where lawful retention is required. Provider backups may persist until their normal expiry. Posts already published on Instagram must be managed in Instagram.

Your choices

You may edit your name, change your password, disconnect Instagram or request access, correction or deletion. You may revoke authorization in Instagram's connected apps settings. See our data deletion instructions.

Updates

Changes to this policy will appear here with an updated date. Contact privacy@toolbloom.in if you have questions about a change.