Privacy Policy

1. Introduction

Scrollix LLC ("we," "us," or "our") operates the Scrollix desktop application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. By using Scrollix, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 User Account Information

• Email address: Used for account identification and password reset
• Password: Stored as a hashed value using PBKDF2-SHA256 with salt
• Name fields: Optional first name and last name for personalization

2.2 Instagram Account Information

• Instagram username and user ID: Retrieved via Instagram API
• Profile information: Name and profile picture URL
• Business account status: Whether the connected account is a business account
• OAuth tokens: Access tokens and refresh tokens (encrypted at rest)

2.3 Content You Create

• Post content: Captions, hashtags, images, videos
• Scheduling information: Scheduled publication times, post status, metadata
• AI-generated content: Captions generated by Google Gemini AI (if used)

2.4 Password Reset Data

• Reset requests: Timestamp of password reset requests
• Reset tokens: SHA-256 hashed tokens with 1-hour expiration

2.5 Usage and Diagnostic Information

• App usage statistics: Features used, error logs, crash reports
• Device information: Operating system version, app version, device identifiers

3. How We Use Your Information

We use the collected information for the following purposes:

• Core Services: Authenticate users, manage Instagram connections, schedule and publish posts
• App Improvement: Analyze usage patterns, fix bugs, improve features
• Security and Compliance: Prevent fraud, enforce terms of service, comply with legal obligations
• Communication: Send password reset emails, service announcements (via Brevo email service)

4. Third-Party Integrations

4.1 Meta/Instagram

We use the Instagram Graph API to authenticate your Instagram Business account and publish posts on your behalf. Your Instagram OAuth tokens are encrypted and stored locally on your device.

4.2 Google Gemini AI

If you use the AI caption generation feature, your uploaded images are sent to Google Gemini for analysis. Google's use of this data is governed by their privacy policy.

4.3 Google Cloud Storage (GCS)

If you provide your own GCS bucket credentials during onboarding, uploaded media files are temporarily stored in YOUR GCS bucket (not ours) before publishing to Instagram. You control this bucket and its data retention policies.

4.4 Brevo Email Service

We use Brevo to send transactional emails (password reset emails). Brevo's use of your email address is governed by their privacy policy.

5. Data Storage and Security

5.1 Local Storage

All user data (account info, Instagram tokens, posts, schedules) is stored locally on your device in a SQLite database. We do NOT store your data on our servers.

5.2 Temporary Files

Uploaded media files are temporarily stored on your device during processing and deleted after successful upload to Instagram.

5.3 Security Measures

• Encryption: Instagram OAuth tokens are encrypted at rest using Fernet encryption
• Password hashing: User passwords are hashed using PBKDF2-SHA256 with salt
• Secure communication: All API requests use HTTPS
• File permissions: Local database and files are protected by OS-level permissions

6. Your Rights

You have the following rights regarding your data:

• Access: View all data stored in the app via the app interface
• Deletion: Delete individual posts, schedules, or your entire account
• Account Removal: Uninstall the app to permanently remove all local data
• Instagram Revocation: Revoke Scrollix's access to your Instagram account at any time via Instagram settings

7. Data Sharing and Disclosure

We do NOT sell, trade, or rent your personal information to third parties. We only share data with third-party services (Meta/Instagram, Google Gemini, Brevo) as necessary to provide the App's core functionality, as described in Section 4.

8. Children's Privacy

Scrollix is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us at support@scrollix.app.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.