Data Deletion

1. What we hold

Repostly stores a limited set of information, and it is worth knowing what it is before asking for it to be removed:

• Account details. Your name, email address, and a bcrypt hash of your password — never the password itself.
• Facebook identity. Your Facebook user ID and name, received through Facebook Login.
• Facebook access tokens. The long-lived user token and the Page access tokens for Pages you connected, all encrypted at rest with AES-256-GCM.
• Connected Pages. The ID, name and category of each Facebook Page you authorised.
• Publishing records. Source video URLs, originating creator handles, technical media metadata, the resulting Facebook post IDs, and any errors.
• Audit log. A record of significant actions in your account, such as approvals and publishes.
• Operational logs. Short-lived server logs containing IP addresses and request details.

2. Option one — disconnect Facebook only

If you want us to stop having any access to your Facebook account but wish to keep your account with us, you do not need to contact anyone.

Sign in, open your Facebook Pages screen, and choose Disconnect on the account you want to remove. We revoke our access with Facebook and delete the stored access tokens immediately, and publishing stops straight away.

Your Page records and their publishing history are kept, so that reconnecting the same Facebook account later restores them along with anything you had scheduled. If you would rather we deleted those too, choose “Remove data” instead — that permanently deletes the Page records and any scheduled posts on them.

You can also revoke access from Facebook directly: Settings → Security and Login → Business Integrations, then select our app and remove it. Revoking on Facebook’s side invalidates the tokens instantly; our stored copies become useless at that moment and are removed on our next token health check.

3. Option two — delete everything

To have your account and all associated data deleted, email workforkhauf@gmail.com from the address registered on the account, with the subject line “Data deletion request”. Include the email address on the account and, if you have it to hand, your Facebook user ID.

We will confirm receipt, verify that the request genuinely comes from the account holder, and then delete the data. If we cannot verify the request from the email address alone we may ask one additional question — this is to stop somebody else deleting your data.

4. What happens, and when

We acknowledge every request within 72 hours and complete deletion within 30 days, which is the maximum period Meta and most data protection regimes allow. In practice it is usually done within a few working days.

• Deleted immediately: Facebook access tokens, connected Page records, and any media still held in temporary storage.
• Deleted with the account: your name, email address, password hash, session records, publishing history and audit entries.
• Retained only where the law requires: records we are legally obliged to keep, such as invoices and tax records, for the statutory period and nothing more.
• Not affected: posts already published to your Facebook Page. Those live on Facebook and belong to your Page.

5. A note about published posts

It is worth being explicit, because this catches people out: deleting your data here does not remove content that has already been published to your Facebook Pages. Those posts exist on Meta’s systems under your Page.

If you want them removed as well, do that before requesting deletion of your account — either from Facebook directly, or by asking us to remove specific posts while your account is still active and connected.

6. If something goes wrong

If you do not receive an acknowledgement within 72 hours, please write again to workforkhauf@gmail.com — occasionally mail filters get in the way. You also have the right to complain to your local data protection authority if you are unhappy with how we handled your request.