Privacy Policy
What this service collects, why it collects it, who else sees it, and how to make it stop.
In force since .
1. Who is responsible
This service is operated by Logical Software, of
Nandini Springfield
Manjari Bk, Hadapsar
Pune, Maharashtra 412308
India.
GSTIN: 27AVCPP5684N1ZS
Our role differs between the two kinds of data here, and the distinction decides what we may do with each.
For your own account — your name, your email address, your billing records and the logs of what you did in the product — we are the data controller. We decide why it is held and for how long, and this policy is that decision.
For the social accounts you connect — the access tokens, the posts you compose, and the audience and engagement figures we collect back from each network — we act as a data processor on your instructions. You decide what is published, to which accounts and when; this product carries it out. We do not use that data for our own purposes, and we do not combine it with other customers' to produce anything of our own.
For anything on this page — access, correction, deletion, or a complaint — write to info@sociomanager.com.
2. What this policy covers, and what it does not
It covers the hosted service at https://sociomanager.com, and the Socio Manager apps for Android and iOS, which are a way into that same service.
Socio Manager can also be self-hosted. If you are using a copy somebody else installed on their own server, this policy does not describe it: that operator holds the database, the media and the access tokens, and decides what happens to them. Ask them, not us.
For the hosted service, the position is this. We are responsible for the data that makes your account work — your name, your email address, your sign-in — and we hold it for our own purposes. The content you create and the social accounts you connect we hold on your instructions: we publish what you tell us to publish, to the accounts you chose, and we do not decide what goes out.
3. What is collected
Your account
Your name, your email address and a password hash. We never store the password itself. If you were invited to a workspace, whoever invited you supplied the address.
The social accounts you connect
When you connect an account on X, Facebook Pages, Instagram, Threads, LinkedIn, Mastodon, Bluesky or Pixelfed, the network sends us an access token. We store it encrypted, together with the profile name, username, identifier and picture that identify the account in your account list. The token is what lets this service post on that account's behalf; it is never shown to you or to anyone else, and it is not used for anything but the operations in §4.
What you create
Posts and their drafts, scheduled times, images and video you upload, tags, templates, hashtag groups and feeds you have asked to watch. This is the content of the product and it stays yours.
What the networks report back
After a post is published, the service retrieves the engagement and audience figures the network makes available — likes, comments, shares, reach, follower counts — so the analytics screens have something to show. These are the connected account's own numbers, not figures about other people.
If you write to us
The contact form records your name, your email address, the topic, your message and the IP address it came from. The IP is recorded because the form sends mail and is therefore abusable, and it is the only thing that makes abuse attributable.
Ordinary technical records
A session cookie so you stay signed in, and server logs that record requests and errors. The public pages also load Google Analytics, which sets two cookies of its own — one named _ga and one named after the measurement property — so that a return visit is counted as the same visit, and which tells us which pages were read and roughly where from.
There is no advertising pixel and nothing here is used to build an advertising profile of you — the tag is configured with Google's advertising and cross-device features switched off, and we ask it for the page you are on rather than the full address, so a link you were sent privately stays private. Nothing you write in the product, and no part of a connected social account, is ever sent to it.
| Cookie | What it does | Kept for |
|---|---|---|
| socio_manager_session | Keeps you signed in and remembers which workspace you are working in. | 2 hours |
| XSRF-TOKEN | Proves a form was submitted from this site and not from another one. | 2 hours |
| cookie_choice | Remembers the choice you made about the cookies below, so you are not asked again. | 180 days |
| _ga | Google Analytics. Counts a return visit as the same visit rather than a new one. Only set if you accept. | 2 years |
| _ga_NZ7DFRCMQ9 | Google Analytics. Holds the state of the current visit for this site specifically. Only set if you accept. | 2 years |
Your choice about analytics cookies
You have not answered yet, so analytics cookies are not stored. Google Analytics is told that a page was read, without anything that identifies your browser.
The Android and iOS apps
This part applies only if you use the Socio Manager app on a phone. The apps show this same service, so everything above applies to them too; what follows is what the apps add.
Notifications. If you allow notifications, your phone is given a notification address by Google's Firebase Cloud Messaging — on an iPhone, through Apple's push notification service — and we store it against your account so we can tell you when a post is published or fails. A notification names the account and what happened. It never contains the text of the post, because it can appear on a locked screen. The address is deleted when you sign out of the app.
How the app is used. The apps use Google Analytics for Firebase to count which screens are opened and which features are used, so we know what to improve. It records an identifier for the app installation, the device model and operating system, the app version, your approximate location as worked out from your network address, and — if you buy a plan in the app — which plan was bought and for how much. With these we send two facts about you: your plan and your role in the workspace. We do not send your name, your email address, any account or workspace identifier, anything you write, or anything about the social accounts you connect: the app sends only events and details on a fixed list, and drops anything else.
Crash reports. If the app crashes, Firebase Crashlytics receives what the app was doing at the time — the technical trace of the failure, the device model, operating system and app version, and an identifier for the installation — so we can fix it. A crash report does not contain your name, your email address or anything you wrote.
No tracking and no advertising. The apps do not collect your device's advertising identifier and do not track you across other companies' apps or websites, so they never ask for permission to. Nothing the apps collect is used for advertising, and none of it is sold.
4. What we ask Meta for, and why
Connecting a Facebook Page or an Instagram account sends you to Meta's consent screen, which lists a set of permissions. Every one this service requests is below, with what it is used for. This table is generated from the code that builds that consent screen, so it cannot describe a permission we no longer ask for, or omit one we do.
| Permission | What it is used for |
|---|---|
| business_management | Nothing is managed with this. Since the New Pages Experience, Meta withholds a Page that belongs to a Business Portfolio from the list above unless this is granted, so without it the account picker is empty for somebody who genuinely administers Pages. |
| instagram_basic | Read the connected Instagram account's profile — username, name and picture — so it can be identified in the account list. |
| instagram_content_publish | Publish the posts you schedule to the connected Instagram account. |
| instagram_manage_insights | Read that account's metrics for the analytics screens. |
| pages_manage_engagement | Act on that engagement where the product offers it — a follow-up comment on a post you published. |
| pages_manage_posts | Publish the posts you schedule to a connected Page, and delete one if you delete it here. |
| pages_read_engagement | Read the likes, comments and shares a published post received, which is what the analytics screens show. |
| pages_show_list | List the Pages you administer, so you can choose which to connect. It is also the only route to an Instagram account, which is discovered through the Page it is linked to. |
| read_insights | Read a Page's own metrics: reach, impressions and follower counts over time. |
We do not read your personal Facebook profile, your friends, your messages or any Page you have not connected. Meta grants permissions as a set: if one of them is unavailable, the whole request fails and nothing is connected — which is why the list is kept as short as the product can work with.
5. Who else sees it
We do not sell data, and we do not use it for advertising. It is shared in these situations and no others:
- The networks you connect. Publishing a post means sending it to the network you chose. What happens to it there is governed by that network's own terms.
- Anthropic, and only if you use the writing assistant. The text you submit to it is sent to Anthropic's API to generate a suggestion. If you never press that button, nothing is ever sent.
- The people in your workspace. A workspace is shared by design — members see its posts, its media and its connected accounts according to the role they were given.
- Google, as our processor: Firebase delivers the apps' notifications and receives their usage measurements and crash reports, as described in §3. Google Analytics also measures the public pages of this website.
- Apple, if you use the iPhone app: it delivers that app's notifications.
- The company that takes your payment. On the website that is Razorpay; if you buy a plan inside an app, it is Apple or Google, under their own terms. We learn which plan was bought and whether the payment succeeded — never your card or bank details.
- Our hosting and email providers, in the ordinary course of running a server and delivering mail.
We would also disclose data if the law required it, and would tell you unless we were forbidden from doing so.
6. How long it is kept
Your account and its content are kept while the account is open. Delete a post, a piece of media or a connected account and it goes from the live service; deleted posts are recoverable for a period, because the alternative is a mis-click that destroys work.
Disconnecting a social account deletes the stored token. Closing your account removes the account and its content — see deleting your data for how to ask and what the timescales are. Backups are kept for disaster recovery and age out on their own schedule, so a deletion is reflected in them only as they rotate.
For the apps: a phone's notification address is deleted when you sign out on it. Usage measurements are kept for two months and crash reports for 90 days, then expire; neither is linked to your account.
7. How it is protected
Traffic is served over HTTPS. Social access tokens are encrypted at rest with a key held in the server's environment and not in the database, so a copy of the database alone does not yield working tokens. Passwords are hashed, never stored or recoverable.
No service can promise it will never be breached, and this one does not. If a breach affected your data we would tell you.
8. What you can ask for
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to our holding it. Depending on where you live these may be legal rights; we do not propose to make you prove which, and will act on the request either way.
Much of it you can do yourself and immediately: disconnect an account, delete a post, delete media. For the rest, write to info@sociomanager.com — the deletion page says exactly what to send and what happens next.
You can also revoke our access from the network's own side, without asking us at all. On Facebook that is Settings & privacy → Settings → Business integrations. Doing so stops this service posting on that account immediately.
9. Children
This service is for people running social media accounts for an organisation or a business. It is not directed at children and we do not knowingly collect their data.
10. Changes to this policy
If this text changes materially we will say so on this page and move the date at the top of it. The date is the honest record of when the current version took effect; it is not regenerated on every visit.
The most recent material change added the Android and iOS apps: what they collect (§3), who processes it (§5) and how long it is kept (§6).
Questions about this page
Write to info@sociomanager.com. A person reads it.