Privacy policy: Postkon

Last updated 13 November 2026.

What this is

Postkon (postkon.app, built on the Meta app "Opefyre Social Publisher") is operated by Abolfazl Shirkavand, a sole trader registered in Portugal (Lisbon). It lets businesses publish and schedule posts on the social accounts they connect, read those accounts' statistics, and answer their comments and direct messages, including WhatsApp Business messages, with replies only within 24 hours of the customer's last message. Accounts are connected only by their owners, and access is limited to people the operator invites. Contact: opefyre@gmail.com.

Data it handles

• For each connected account: its Instagram id, username, name, account type, the permissions granted, and an access token, stored encrypted (AES-256-GCM).
• For a connected WhatsApp Business number: the WhatsApp Business account id, phone number id, display number and name, and an access token, stored encrypted; the messages customers send to that number and the replies sent, kept like other direct messages.
• Posts made through it: captions, options and the media files. Media files are deleted after publication.
• Statistics for the accounts and their posts (views, reach, likes, comments, shares, saves and similar counts).
• Comments on the accounts’ posts and direct messages sent to or from the accounts: the text, the time, the sender’s Instagram-scoped id and username, and attachments’ links as Instagram provides them. These are used only to show them to the account owner’s own tools and to reply.
• For each person who signs in to Postkon: their email, the name and picture they choose (or the ones Google or GitHub share when they sign in that way), the id and email of a linked Google or GitHub account, a password only as a salted one-way hash (PBKDF2), their language, and their sign-in sessions (when they started and were last used, and the browser’s name).

What it does not do

It sets only the cookies needed to sign in (a session cookie, and a short-lived one while signing in with Google or GitHub), and runs no analytics or advertising. It does not sell, rent or share data with anyone, does not build profiles of the people who comment or write, and does not use the data to train models. Data stays in the owner’s Cloudflare account (database and private storage).

How long data is kept

• Comments and messages: 180 days, then deleted.
• The record of events (new comments, messages, publications): 90 days.
• Media files: deleted after the post is published, or after 7 days if never used.
• Account data and tokens: until the account is disconnected. Disconnecting deletes the token and the account’s stored comments and messages.
• Sign-in sessions: 14 days without use, and 30 days at most. Sign-in and password links: one day.

Your choices

If you commented on or messaged one of these accounts and want your data removed, write to opefyre@gmail.com with your Instagram username; it is deleted within 7 days. See also data deletion.

Account owners can remove the app at any time in Instagram: Settings, Apps and websites.

People who sign in to Postkon can download their own data and delete their account themselves (Settings, Profile). Deleting it removes them from every workspace, deletes any workspace where they are the only member with everything in it, and deletes their profile, picture, password, linked Google or GitHub accounts, sessions and language at once. A workspace they own together with other people must be handed over first. What they did inside workspaces that remain (such as who approved a post) stays in those workspaces’ records, and one line that the account was deleted stays in the service’s audit log.

Platforms

Data from Instagram is used under Meta’s Platform Terms and Developer Policies.

Changes

Changes to this policy are posted on this page with a new date.