PostEngage asks for three Instagram permissions. This page says what each one is for, in the same order Meta's consent screen shows them, and what breaks if you decline it.
You grant them in Instagram's own dialog when you connect an account, and you can withdraw them at any time from Instagram or from us. We ask for nothing beyond these three, and we read nothing the three do not cover.
We use the official Instagram Graph API. We are not affiliated with, endorsed by, or acting on behalf of Meta Platforms, Inc.
The three permissions
| Permission | What we do with it | The feature that needs it | Without it |
|---|---|---|---|
instagram_business_basic | Read the connected account's id, username, account type and profile picture, once at connect and on request afterwards. We check the account is a Business or Creator account, because the messaging and comment endpoints do not exist on personal accounts | Connecting an account at all, and showing you which account is connected | Nothing works. The connection cannot be established |
instagram_business_manage_messages | Receive direct messages sent to the connected account by webhook, read their content, and send messages — both direct replies inside Instagram's 24-hour messaging window and private replies to a comment inside its 7-day window | DM automations, the private reply that follows a comment, and the unified inbox where you answer by hand | DMs are neither received nor sent. Comment automations that answer privately cannot deliver. The inbox is empty |
instagram_business_manage_comments | Receive comments on the connected account's media by webhook, read their text and author, and post public replies to them | Comment automations, the public reply, and the activity view that shows what was answered and what was held | Comments are never seen and no public reply can be posted |
What we deliberately do not ask for
- Publishing. We never create a post, a reel or a story.
- Insights and analytics. We do not read reach, impressions or audience data.
- Ads. No ads permission, no ad account access, no audiences built from anyone.
- Hiding or deleting comments. We post replies. We do not moderate, delete, or hide anyone's comment.
- Followers and following. We do not read your follower list, and we cannot follow or unfollow on your behalf.
- Other accounts. We only ever touch accounts a creator has explicitly connected.
How the data arrives, and what we do with it
We do not poll Instagram. Every comment and message reaches us as a webhook, which is both what Meta prefers and the only workable approach — the Graph API budget for a small account is derived from its impressions and a timer would exhaust it before a single reply went out.
When something arrives:
- It is stored against the connected account, with the sender's Instagram id, username and profile picture.
- An automation you configured decides whether it warrants a reply.
- If the reply is AI-written, it is drafted from a voice profile built from replies you wrote yourself, then checked for grounding, prompt injection, repetitiveness and shape.
- Ten policy checks run before anything sends, in a fixed order, and the first failure stops the send: kill switch, connection health, whether you are already in the conversation, Instagram's reply window, duplicate detection, per-recipient cooldown, your quiet hours, rate budget, credits, content safety.
- Whatever happened is recorded with a reason you can read — including, and especially, when nothing was sent.
Access tokens
The long-lived token Instagram issues is encrypted at rest with AES-256-GCM under a versioned key. It never appears in a log line, an API response or an error message. It is refreshed ahead of expiry, and we warn you seven days before a connection lapses instead of letting it fail silently.
Retention
Messages, comments, automation runs and the actions they produced are kept for 396 days and then dropped by the database itself. Raw webhook deliveries and policy decisions are kept 30 days. The full schedule is in the privacy notice.
Turning it off
Three ways, all of which work immediately:
- In PostEngage — Settings → Connections → Disconnect. We revoke the token with Meta and unsubscribe the webhook.
- In Instagram — Settings → Website permissions → Apps and websites → remove PostEngage. Meta calls our deauthorize endpoint, we verify the signed request, and we mark the connection revoked and stop.
- Delete everything — see data deletion.
Callbacks Meta requires, and where they are
| Callback | Endpoint | Behaviour |
|---|---|---|
| Deauthorize | POST https://api.postengage.ai/meta/deauthorize | Signature verified, connection marked revoked, processing stops, the workspace owner is notified. Nothing is deleted, because removing access is not the same request as forgetting |
| Data deletion request | POST https://api.postengage.ai/meta/data-deletion | Signature verified, request recorded, a confirmation code and status URL returned synchronously, erasure processed asynchronously |
| Deletion status | GET https://api.postengage.ai/meta/data-deletion/status/<code> | Public and readable by a human. Shows status and dates only — no identifiers |
Signature verification is HMAC-SHA256 with our app secret, compared in constant time, and it is mandatory on both callbacks. An unverified callback is an unauthenticated instruction to delete a customer's data, so we refuse it.
For app reviewers
The pages Meta review usually asks for:
- Privacy notice — what is collected and shared, and the retention schedule.
- Terms of service — including the acceptable-use rules that keep automated messaging inside Meta's platform terms.
- Data deletion — both the in-app path and the callback, with the confirmation-code status URL.
- Security — token encryption, session handling, support access.
If anything on this page is unclear during review, write to support@postengage.ai and you will get a person.