postSOMA
Before connecting each network, postSOMA asks you to accept this authorization for that network. Your acceptance is recorded with the network, the version of this document, the date, the time, the IP, and the platform.
1. What you authorize
By tapping "Connect" ("Conectar") and approving access on the network's official screen, you authorize DIGITAI SOMA, through postSOMA, to act on your behalf only within the permissions you approve, in order to:
- read the basic data of the account, Page, or channel (identifier, name, @username, profile photo, and account type), to show it in the app;
- publish, on the day and time you choose, the content that you or your team schedule;
- check the result of posts (whether they went live, the link, and the identifier on the network);
- when the network allows it and you create automations, read the comments and messages received by the account and send the replies you configured;
- store the access authorization (token) encrypted, to do these actions without asking you to log in each time.
postSOMA never: asks for your password; publishes anything you did not schedule; follows, likes, or unfollows profiles; deletes or edits old posts; changes your profile; or uses the network's data for advertising, sale, or building profiles.
You declare that the account is yours or that you have authorization from its owner, and that you will disconnect it when you lose that authorization. See also the Terms of Use, sections 8 to 10.
2. How the connection works
- In postSOMA, tap the network's button, which carries its official logo.
- Read and accept this authorization for that network.
- The network's official page opens (or the network's app, when it offers that option). Sign in to your account and review the permissions requested.
- If you approve, the network gives postSOMA an authorization (token), which we store encrypted.
- The account appears in postSOMA with a switch: green when it is active and red when it is paused.
Pausing stops the posts and automations of that account, without disconnecting. Disconnecting deletes the authorization and is a separate action, with confirmation.
3. Available networks
3.1 Instagram
- Account type: professional (Business or Creator), through Instagram login.
- Permissions requested: basic account data (instagram_business_basic); publish content (instagram_business_content_publish); read and reply to comments (instagram_business_manage_comments); send and receive direct messages (instagram_business_manage_messages).
- What postSOMA does: publishes the photos, videos, carousels, and Reels you schedule; when you create automations, it replies to comments and sends Direct messages according to your rules, within Meta's windows and limits.
- What we store: the account's identifier, @username, name, photo, and type; the encrypted token; the identifier and link of posts; and, for automations, the comments and messages handled and the replies sent.
- Revoke on the network: in Instagram, go to Settings, look for "Website permissions" > "Apps and websites", and remove postSOMA. In the browser: instagram.com/accounts/manage_access.
- Rules: Instagram Terms of Use · Privacy Policy.
3.2 Facebook (Pages)
- Account type: only Pages that you manage. postSOMA never publishes on your personal profile.
- Permissions requested: list your Pages (pages_show_list); read the Page's data and engagement (pages_read_engagement); publish on the Page (pages_manage_posts); publish videos (publish_video).
- What postSOMA does: publishes on the chosen Page what you schedule.
- What we store: your Facebook identifier; the identifier and name of the chosen Pages; encrypted tokens; the identifier and link of posts.
- Revoke on the network: in Facebook, under Settings & privacy > Settings, look for "Apps and websites" or "Business integrations" and remove postSOMA. In the browser: facebook.com/settings?tab=applications.
- Rules: Facebook Terms · Meta Privacy Policy.
3.3 TikTok
- Permissions requested today: basic profile data (user.info.basic) and sending videos to your account as drafts (video.upload).
- What postSOMA does today: publishing is assisted. At the scheduled time, postSOMA sends the video to your TikTok inbox (or notifies you), you open TikTok, review and finish the post, and then you confirm it in postSOMA.
- Automatic publishing: when TikTok approves postSOMA to publish through the official API, we will ask for the publishing permission. Before each upload, you will see the preview, choose the post's privacy setting and the allowed interactions, say whether it is branded content, and confirm TikTok's music usage rules. Until approval, TikTok may keep posts made by apps as private.
- What we store: the profile's identifier, display name, and photo; the encrypted token; the identifier and link of posts, when there are any.
- Revoke on the network: in the TikTok app, under Settings and privacy, look for "Security & permissions" > "Apps and services" and remove postSOMA.
- Rules: TikTok Terms of Service · Privacy Policy.
3.4 YouTube (including Shorts)
- Permissions requested: upload videos (youtube.upload) and read channel data (youtube.readonly).
- What postSOMA does: uploads to your channel the videos and Shorts you schedule, with the title, description, and privacy setting you choose. postSOMA does not delete or edit videos that are already on the channel.
- What we store: the channel's identifier, name, @, and thumbnail; encrypted tokens; the identifier and link of uploaded videos. Channel data is refreshed or deleted every 30 days at most.
- YouTube API Services: postSOMA uses YouTube API Services. By connecting and using YouTube through postSOMA, you agree to the YouTube Terms of Service. Google processes data under the Google Privacy Policy.
- Revoke on the network: at security.google.com/settings/security/permissions, choose postSOMA and remove access.
- Deletion deadlines: if you disconnect YouTube or delete your account in postSOMA, we delete the YouTube data within 7 days. If you revoke through Google, we delete it within 30 days.
4. Planned networks (coming soon)
These networks appear in postSOMA as "coming soon" and cannot be connected until they are released. When each one is released, the network's official screen will show the exact permissions, this document will be updated and, if anything important changes, we will ask for new acceptance.
| Network | What postSOMA will request | Notes |
|---|---|---|
| Threads | Basic profile data and publish content | Revoke: in Threads, under Settings > Account > Website permissions. Threads Terms |
| X | Read your profile and posts, publish posts with media and keep access without logging in again (tweet.read, tweet.write, users.read, media.write, offline.access) | X requires you to see and approve what will be published and prohibits publishing identical content on several accounts. Revoke: x.com/settings/connected_apps. X Terms |
| Basic identification (name, e-mail and photo) and publish on your personal profile; after LinkedIn's approval, also on company Pages you manage | Company Pages only after LinkedIn's approval. Revoke: in LinkedIn, under Settings > Data privacy > Permitted services. User Agreement | |
| Account data, read and create boards and Pins | Each Pin is chosen by you. Revoke: in Pinterest, under Settings > Security and access > Apps. Pinterest Terms | |
| Bluesky | Read your profile and publish posts. Bluesky still grants a broad permission (atproto transition:generic), which postSOMA uses only for this | Posts on Bluesky are public and copied across the open network (AT protocol); deleting later may not remove third-party copies. Bluesky Terms |
| Google Business Profile | Manage the business profile (business.manage), used only to read your listings and publish updates on them | Same Google rules described in item 3.4. Revoke: security.google.com/settings/security/permissions. Google Terms |
5. What we store and for how long
| Data | Deadline |
|---|---|
| Access token (encrypted) | Until you disconnect the network or delete the account. Deleted immediately |
| Account name, @, photo, and identifiers | While connected. Deleted within 7 days after disconnection |
| YouTube data | Refreshed or deleted every 30 days; deleted within 7 days after disconnection or within 30 days after revocation through Google |
| Comments and messages handled by automations | As long as the automation and the account exist; deleted within 30 days after you disconnect the account |
| Record of your acceptance of this authorization | While the account exists and for 6 more months after deletion |
Disconnecting does not delete what has already been published on the networks. To delete a post, use the network itself.
6. How to pause, disconnect, or revoke
In postSOMA:
- Pause: tap the switch next to the account. Red = paused. That account's posts are marked as paused and do not disappear.
- Disconnect: on iPhone and iPad, under Profiles ("Perfis"), choose the account and tap "Disconnect" ("Desconectar"); on Mac, in the list of profiles; in the web app, under Accounts ("Contas"). The token is deleted immediately and we ask the network to revoke the authorization, when it offers that feature.
On the network itself: use each network's paths in sections 3 and 4. The networks' menus change often; if you cannot find it, look for "apps and websites", "connected apps", or "permissions" in the network's settings.
If you revoke access through the network, the connection stops working in postSOMA and we delete that account's data when the network notifies us or when we notice that access was revoked.
7. Meta data deletion request
If you remove postSOMA in the Facebook, Instagram, or Threads settings, Meta sends us a deletion request. We delete the data from that account and generate a confirmation code so you can follow the request. Other ways to ask are in Account and Data Deletion.
↑ Back to top