Welcome to Nuggetfy ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy describes how Nuggetfy collects, uses, processes, and shares your information when you use our application, website, and services (collectively, the "Service").
Nuggetfy is a viral content creation and automation tool designed to help social media managers, creators, and entrepreneurs model, generate, and schedule posts for Instagram.
By accessing or using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.
Section 1
Definitions
- Service: Refers to the Nuggetfy web application and its features.
- Personal Data: Any information relating to an identified or identifiable natural person.
- Instagram Access Token: The secure credential obtained via Meta OAuth to interact with the Instagram Graph API on your behalf.
- Baserow: Our secure relational database provider used for backend storage.
- Cloudflare R2: Our secure cloud storage provider used for temporary media hosting.
Section 2
Data Collection and Processing
We collect and process only the data necessary to provide, manage, and optimize our Service.
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Email Address | User authentication, session verification, and account communication. | Contractual necessity and user consent. |
| Instagram Account Info (ID, Username, Name) | To identify and display your connected Instagram profile inside the Nuggetfy interface. | Contractual necessity (rendering the Service). |
| Instagram Access Token | Required to publish and schedule posts directly to your Instagram profile via the Meta API. | User consent and contractual necessity. |
| Scheduled Post Media & Caption | Text, images, and video prompts generated or provided by you to compose scheduled posts. | Contractual necessity (delivering scheduled posts). |
| Gemini API Key | Used to call Google Gemini API for post generation. Processed client-side, passed in headers, and never persisted on our servers. | User consent (local browser processing). |
Section 3
Storage and Security of Data
We implement robust technical and organizational security measures to protect your data from unauthorized access, alteration, disclosure, or destruction:
- Access Token Storage: When you publish a post immediately, the Instagram Access Token is processed temporarily in memory. When you schedule a post for a future date, the token is stored securely in our Baserow database, allowing our automated background scheduler to retrieve it and execute the publication at your chosen time.
- Encryption: All data transmitted between your browser, our servers, Baserow, and Meta APIs is encrypted using industry-standard Transport Layer Security (TLS/HTTPS).
- Media Hosting: Generated images or media files are hosted temporarily on Cloudflare R2 with random hash keys to prevent unauthorized access. These files are subject to periodic automated cleanups.
Section 4
Third-Party Services
To deliver our Service, we integrate with trusted third-party providers. Each of these services handles your data in accordance with their own privacy policies:
- Meta Graph API / Instagram Graph API: We use Meta's official APIs to retrieve status and publish posts. View Meta's Data Policy →
- Baserow: Used as our backend database to store user authentication status and scheduled posts data. View Baserow's Privacy Policy →
- Google Gemini API: Used to model and generate post frames, running with your own provided Gemini API Key.
- Cloudflare R2: Used for hosting generated images temporarily.
Section 5
Data Sharing
We do NOT sell, rent, or trade your Personal Data to third parties. We share your information only with the third-party processors listed in Section 4, solely to the extent necessary to provide the features of the Service. We may also disclose your data if required by law or to protect our legal rights.
Section 6
Data Retention Policy
We only retain your Personal Data for as long as is necessary for the purposes set out in this Privacy Policy:
- Active Sessions: User session details are kept while the account is active.
- Scheduled Posts: Details of scheduled posts are retained in Baserow until the post is successfully published, failed, or deleted by the user.
- Temporary Media: Media uploaded to Cloudflare R2 is automatically cleaned up and deleted periodically.
Section 7
Data Deletion and Revocation Protocol
In compliance with Meta Platform Terms and global privacy regulations (such as GDPR and LGPD), we provide users with full control over their data:
- Direct Data Deletion Request: You can request the complete deletion of your account and all associated data (including email, Baserow records, Instagram Access Tokens, and scheduled posts) at any time by emailing [email protected]. We will process and confirm your deletion request within 48 business hours.
- Revocation of Meta Permissions: You can revoke Nuggetfy's access to your Instagram account at any time by navigating to Facebook Account Settings → Apps and Websites → Nuggetfy → Remove.
Section 8
User Rights (GDPR & LGPD)
Depending on your jurisdiction, you have the following legal rights regarding your Personal Data:
Section 9
Minors' Privacy
Our Service is not directed to anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13. If we discover that a child under 13 has provided us with personal data, we will immediately delete it from our servers.
Section 10
International Data Transfers
Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.
Section 11
Changes to this Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. You are advised to review this Privacy Policy periodically for any changes.
Section 12
Contact Us and Data Protection Officer (DPO)
If you have any questions about this Privacy Policy, your rights, or wish to submit a data deletion request, please contact our Data Protection Officer:
PayPubli / Nuggetfy — We respond within 48 business hours.