Privacy Policy

AutoPoster is a tool for scheduling and publishing social posts. It is run by Zawaaj, a sole proprietorship of Ajmal Aksar, Kozhikode, Kerala, India (“we”, “us”). AutoPoster began as Zawaaj's in-house posting tool and is now its own product, run by Zawaaj. Contact: hello@zawaaj.in. Privacy questions: privacy@zawaaj.in.

You connect your Instagram, Threads or LinkedIn accounts. You and your team write posts, an admin approves them, and AutoPosterpublishes them at the time you chose. Nothing is published without an admin’s approval.

Work happens in a workspace. Everyone gets a personal workspace. You can also create an organization and invite people. Everyone in a workspace can see its posts, ideas, connected accounts (not their passwords or tokens), results and activity log. Admins can approve, publish, delete and disconnect; members can draft.

• Your sign-in. Name, email address, user ID, and the organizations you belong to with your role. Clerk holds these for us.
• Connected accounts.For each account: the platform’s user ID, your username (on LinkedIn, your display name), an access token, when it expires, the permissions you granted, and the last error the platform returned. Tokens are encrypted before we store them. We never see or store your passwords. The permissions we ask for:
  • Instagram: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights.
  • Threads: threads_basic, threads_content_publish, threads_manage_insights.
  • LinkedIn: openid, profile, w_member_social. Once LinkedIn approves us for it, also r_member_postAnalytics for post results.
• What you create. Captions, hashtags, images and videos (with their file names and sizes), alt text, schedules, ideas and notes, brand kits, guidelines, posting times and publishing rules.
• Results from the platforms.Totals, not people. Instagram: reach, views, profile views, accounts engaged, interactions, link taps, follower and following counts, and the hours your followers are online; per post: reach, likes, comments, saves, shares and views (stories: replies and taps). Threads, per post: views, likes, replies, reposts, quotes and shares. LinkedIn, only with the analytics permission: impressions, members reached, reactions, comments, reshares, saves and followers gained. If you import your history, we also store your past posts’ captions, dates and links (Instagram: up to 2,000).
• The activity log.Who did what in a workspace: your user ID, name or email, the action (for example “approved a post”), where it came from (app, AI assistant, API) and a short summary. Every member of the workspace can read it.
• Devices for notifications.If you turn on notifications: your browser’s push address and keys, and a short description of the browser.

We do not collect payment details. We do not collect information about your individual followers. We don’t run analytics or advertising trackers. Our hosting providers keep their own short-lived request logs (such as IP address and browser), under their own policies.

• To sign you in and keep each workspace private to its members.
• To publish what you approve, to the accounts you connected, when you asked.
• To show you how your posts did, and plan around real numbers.
• To check drafts against your brand kit before they reach review.
• To record who approved or changed what, so a team can trust the queue.
• To notify you about posts waiting for review, failures and expiring access.
• To keep the service working and secure, and to meet the law.

We don’t sell your data. We don’t use it for advertising or to build profiles of you.

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP”) we are the Data Fiduciary. We rely on your consent: you give it when you sign up and each time you connect an account. You can withdraw it as easily as you gave it. Disconnect an account and we delete its token and stop publishing to it. Delete your data and we erase it (see Data Deletion). Some processing, like security, relies on legitimate use.

These companies process data for us, only to run the service:

• Clerk — sign-in and organizations.
• Convex — our database and the jobs that publish and fetch results.
• Vercel — hosts the web app.
• Cloudflare R2 — stores your images and videos.
• OpenAI— only when you press “Draft with AI” or ask for a brand kit to be generated. For a draft we send your topic and the workspace’s brand kit. For a brand kit we send the writing samples you paste, or up to 15 of the workspace’s published captions. We never send images, tokens or results.
• Browser push services (Google, Mozilla or Apple, depending on your browser) — deliver notifications you turned on: a title, a line of text and a link.

Meta (Instagram, Threads) and LinkedIn receive what you publish, because publishing is the point. They also return the results listed above. If you turn on Hijri dates in the calendar, your browser asks Aladhan(api.aladhan.com) for the month’s dates; it sends only the month and year.

Some of these providers store data outside India. DPDP allows this, except to countries the Government restricts, and we will follow any such restriction.

Instagram and LinkedIn publish an image by fetching it from a public web address. So every file you upload gets one. The address is long and random, so nobody can guess it, but anyone who has it can open the file. Don’t upload anything you wouldn’t publish.

• Posts, ideas, brand kits, results and other workspace content: until you delete them or delete your data.
• Media files: while a post uses them, published or not. When no post has used a file for 7 days we delete it, and an admin can delete one sooner in Settings → Storage. Files uploaded before this was in place are kept until you delete your data.
• Access tokens: while the account stays connected. They are deleted when you disconnect, delete your data, or remove AutoPoster in Instagram or Threads.
• Activity log: 90 days, then deleted automatically.
• Notification devices: until you turn notifications off, delete your data, or the browser stops accepting them.
• Your sign-in: until you ask us to close it.

When you delete your data we keep one line saying that a deletion happened, with no name or email, for 90 days, as proof we did it.

Everything travels over HTTPS. Access tokens are encrypted at rest (AES-256-GCM). Every request is checked against your workspace and role, so one workspace can’t read another’s data. Keys and secrets live in our providers’ settings, never in code. No system is perfectly secure, but we take reasonable care.

If there is a personal-data breach, we will tell affected users and the Data Protection Board of India without undue delay, and file the report the DPDP Rules, 2025 require.

Under DPDP you can:

• get a summary of your personal data and how we use it;
• have it corrected, completed, updated or erased;
• withdraw consent;
• have a grievance heard;
• name someone to act for you if you die or can’t act yourself.

To erase your data, use Settings → Delete my data. For anything else, email privacy@zawaaj.in. We may check it’s really you. We confirm we got it within 24 hours and act on it within 15 days. Data Deletion has the details.

AutoPosteris for adults aged 18 and over. We don’t knowingly collect children’s data. If we learn we have, we delete it.

Clerk sets cookies that keep you signed in. Your browser stores whether you want Hijri dates on the calendar, and caches those dates. If you turn on notifications, a small background script (a service worker) receives them. That is all. No advertising or analytics cookies.

• We use it only to publish for you and show you your own results.
• We don’t sell it, give it to data brokers, or use it for ads or surveillance.
• Tokens are encrypted and used only for the permissions you granted.
• When you disconnect an account we delete its token. Its user ID, username, posts and results stay in the workspace, so its history is kept if you connect it again.
• We delete it when you delete your data, remove AutoPoster in Instagram or Threads, if we stop operating, or if the platform asks us to.

If we change this policy we update the date at the top. If a change matters, we tell you in the app or by email first.

General: hello@zawaaj.in · Privacy and grievances: privacy@zawaaj.in