This policy explains how Tebar (“we”) collects, uses, stores, and deletes personal data when you use the tebar.app website, the publish.tebar.app dashboard, the REST API, and the MCP server at api.tebar.app (together, the “Service”).
In short: we only take the data needed to post, schedule, and manage comments at your request. We do not sell data, do not use it for advertising, and do not share it with data brokers.
1. Data we collect
Data you give us directly
- Tebar account: email address, name (optional), and password. The password is only stored as a hash, never in plain text.
- Sign in with Google (optional): if you choose "Continue with Google", Google gives us your Google account ID, email address and its verification status, and name. We use them only to create your account and sign you in to Tebar. We do not ask for access to Gmail, Drive, contacts, or any other Google data, and do not store Google access tokens. You can unlink it any time in Settings.
- Content: post text, publishing times, per-platform options, the photos and videos you upload, and alt text.
- Preferences: email notification settings and the dashboard's usage mode.
- Profiles and integrations: the name and (optional) external ID of each profile, the name shown on connect link pages, connect link destination domains, and the webhook URLs and events you choose. Webhook secrets are stored encrypted.
- Payments: the plan and period you buy, amount, status, payment time, and the order number and reference from the payment provider. Your card, bank account, or e-wallet details are entered directly on Duitku's page and never reach us.
Data from Instagram and Threads
When you connect an account, you log in directly on Instagram or Threads through Meta's official login. We never see your social media passwords. We only ask for the following permissions, each for a feature you use:
| Permission | Data accessed | Used for |
|---|---|---|
instagram_business_basic | Account ID, username, name, profile picture, media list | Showing the connected account and its published posts |
instagram_business_content_publish | The right to create posts, carousels, Reels, and Stories | Publishing the content you create or schedule |
instagram_business_manage_comments | Comments on your posts: text, username, and time | The comment inbox, replying to and hiding comments |
threads_basic | Account ID, username, name, profile picture, post list | Showing the connected account and its published posts |
threads_content_publish | The right to create posts and threads | Publishing the content you create or schedule |
threads_read_replies | Replies to your posts: text, username, profile picture, time | The comment inbox |
threads_manage_replies | The right to reply to and hide replies | Replying to and hiding replies from Tebar |
threads_manage_insights | Account and post statistics (e.g. views, likes) | Showing post performance in the dashboard |
We also store an access token from Meta so we can post on your behalf, including scheduled posts while you are not using Tebar. This token is stored encrypted.
The comments we store are written by other people on your posts. That data (username, profile picture, and comment text) is only used to show you your inbox and for no other purpose.
Data from LinkedIn
When you connect a LinkedIn profile, you log in directly on LinkedIn. We ask for the following permissions:
| Permission | Data accessed | Used for |
|---|---|---|
openid, profile | Member ID, name, and profile picture | Showing the connected profile and publishing posts on your behalf |
email | The LinkedIn account's email address | Part of the LinkedIn login; we do not store it |
w_member_social | The right to create posts on your profile | Publishing the content you create or schedule |
LinkedIn access tokens are stored encrypted and last 60 days, after which the profile needs to be reconnected. We do not read your LinkedIn comments, connections, or statistics.
Data from X
When you connect an X account, you log in directly on X and authorize the Tebar app. We ask for the following permissions:
| Permission | Data accessed | Used for |
|---|---|---|
users.read, tweet.read | Your X account's ID, name, username, and profile picture | Showing the connected account. X requires tweet.read to read the profile; we do not read timelines or other people's posts |
tweet.write, media.write | The right to create posts and upload media | Publishing the content you create or schedule |
offline.access | A token to renew access | So scheduled posts go out without you logging in again (X access lasts 2 hours and is renewed automatically) |
X access tokens are stored encrypted. When you disconnect an X account, Tebar revokes its access on X. We do not read your X comments, messages, followers, or statistics.
Data from Pinterest
When you connect a Pinterest account, you log in directly on Pinterest and authorize the Tebar app through Pinterest's official OAuth. We never ask for your Pinterest password or cookies. We ask for the following permissions:
| Permission | Data accessed | Used for |
|---|---|---|
user_accounts:read | Your Pinterest account's ID, username, name, and profile picture | Showing the connected account |
boards:read | The list of your boards | Showing the boards you can choose for each Pin. The list is fetched from Pinterest whenever it is needed and is not stored |
pins:write | The right to create Pins on your boards | Publishing the Pins you create or schedule yourself |
Every Pin is created only because you chose it: you write or approve the Pin, pick its board, then publish or schedule it, in the dashboard or through an AI assistant you instruct in a chat. Tebar does not automatically create, save, or re-pin Pins, follow accounts, or comment on Pinterest. We only store the access token (encrypted), your account profile, the ID of the board you chose for each Pin, and the IDs and links of Pins created through Tebar. We do not read other Pinterest users' Pins, boards, or data, do not share or sell data from Pinterest, and do not use it to train AI models. Tebar is not affiliated with or endorsed by Pinterest.
Data from Telegram
Telegram is connected through Tebar's official bot, @TebarAppBot, which you add to a channel or group yourself. You do not log in to Telegram through Tebar, and we never receive your phone number, password, or access to your personal Telegram account.
| Data | Used for | Kept |
|---|---|---|
| The channel's or group's ID, name, and username | Showing the connected chat and sending posts to it | While the chat is connected |
| Your Telegram account ID when you press Start | Matching the chat you add to your Tebar account, and checking that you are an admin of that chat | 30 minutes (while the connection code is valid) |
| Notifications from Telegram about the bot (for example, the bot being added or removed) | Connecting the chat, and flagging the account if the bot is removed | Deleted automatically on a regular basis |
The bot does not read the conversations in channels or groups and posts nothing other than the content you create or schedule in Tebar. When you disconnect a chat from Tebar, the bot leaves it. You can also remove the bot at any time from the channel's or group's settings.
Data from Discord
Discord is connected through Discord's official authorization page. There you pick a server and channel, and Discord creates a webhook (Discord's built-in way to post messages to one channel) for Tebar. Tebar uses no bot, does not read messages in your server, and keeps no access to your Discord account.
| Data | Used for | Kept |
|---|---|---|
| Webhook ID and token, server and channel IDs | Sending posts to that channel and linking to published messages. The token is stored encrypted | While the channel is connected |
| Server name and icon | Showing the connected channel in the dashboard | While the channel is connected |
Your Discord login token (guilds permission) | Reading the server's name and icon once while connecting | Not kept: revoked right after use |
When you disconnect the channel from Tebar, we delete its webhook in Discord too. You can also delete it at any time from the channel settings (Integrations → Webhooks).
Data from YouTube
Tebar's YouTube features use YouTube API Services. By using them, you agree to be bound by the YouTube Terms of Service, and data processed by Google is subject to theGoogle Privacy Policy. When you connect a channel, you log in directly with Google. We ask for the following permissions:
| Permission | Data accessed | Used for |
|---|---|---|
youtube.readonly | Channel ID, name, handle, profile picture, video list | Showing the connected channel and its published videos |
youtube.upload | The right to upload videos to your channel | Uploading the videos you create or schedule, with the title, description, and settings you choose |
youtube.force-ssl | Comments on your videos: text, author name and picture, time | The comment inbox, replying to and hiding comments at your request |
yt-analytics.readonly | Channel and video statistics (e.g. views, watch time, likes) | Showing video performance in the dashboard |
Google access and refresh tokens are stored encrypted so scheduled videos can be published while you are not using Tebar. We never upload, reply to, or hide anything without your instruction or that of an app you have authorized. When you disconnect a channel from Tebar, we revoke its permission with Google and delete that channel's YouTube data right away. You can also revoke Tebar's access at any time from yourGoogle account security settings; YouTube data for a channel whose access can no longer be renewed is deleted within 30 days.
Data from TikTok
When you connect a TikTok account, you log in directly on TikTok, through the TikTok API for Business. We ask for the following permissions:
| Permission | Data accessed | Used for |
|---|---|---|
user.info.basic, user.info.username | Account ID, username, display name, and profile picture | Showing the connected account |
user.info.stats, user.insights | Follower count and the account's daily numbers (views, likes, comments, profile visits) | Showing account statistics in the dashboard |
video.list, video.insights | The list of published videos and photos and their numbers | Showing published posts and their performance |
comment.list, comment.list.manage | Comments on your posts: text, username, profile picture, time | The comment inbox, replying to and hiding comments at your request |
video.publish, video.upload | The right to publish videos and photos, or send them as drafts | Publishing the content you create or schedule |
TikTok access and refresh tokens are stored encrypted so scheduled posts can be published while you are not using Tebar. When you disconnect an account from Tebar, we revoke its permission on TikTok. You can also revoke Tebar's access from the TikTok app (Settings and privacy → Security → Manage app permissions).
Accounts connected through a connect link
A Tebar user can send you a connect link, for example an agency or an app provider that manages your social media. That page shows the name of the Tebar user who made the link. When you continue and grant permission on the platform:
- your social media account is connected to the link creator's Tebar account, not to a Tebar account of your own;
- we receive the same data listed above for that platform (profile, access token, posts, comments, and statistics, according to the permissions you grant);
- the link creator can post, read comments, and see statistics for that account through their dashboard, API, AI assistant, or webhooks, and receives the account ID and connection status in their app;
- we do not store your email address or password, and you do not need to create a Tebar account.
You can revoke this access at any time from the app settings on that platform, or by asking the link creator to disconnect your account. See also Our role.
Technical data
- Login sessions: session cookie, IP address, and browser type (user agent), to keep your account secure and show the devices you are logged in on.
- API keys and AI app access: key name, prefix, permissions, and last-used time. Keys and access tokens are only stored as a hash.
- Server logs: records of requests and errors to fix problems. Logs contain no passwords, tokens, or API keys.
- Browser storage: this site stores your theme choice (light/dark) in
localStorage. We do not use advertising cookies or third-party trackers.
2. What data is used for
- Creating your account, logging you in, and keeping it secure (email verification, password reset, notices when your password or email changes).
- Publishing and scheduling content to the accounts you connect, only at your instruction or that of an app you have authorized.
- Showing, replying to, and hiding comments on your posts.
- Showing post statistics.
- Sending transactional emails, for example when a post fails or an account needs reconnecting. Notification emails can be turned off in Settings.
- Preventing abuse (rate limits, spam detection) and meeting legal obligations.
We do not use data from Instagram, Threads, LinkedIn, YouTube, TikTok, X, Telegram, Discord, or Pinterest to train AI models, build advertising profiles, or for any purpose outside the list above.
3. AI apps, the API, and webhooks
You can connect Tebar to an AI assistant (for example Claude or ChatGPT) through MCP, to your own app through an API key, or send updates to your systems through webhooks. When you do:
- That app only gets the permissions you approve (for example read-only, or read and write), and can be limited to one profile. You can revoke its access at any time from the dashboard.
- Webhooks send the event data you choose (for example connected accounts, published posts, or the text and username of new comments) to the URL you register. We keep the delivery history for 30 days so you can check and resend it.
- Data the app asks for (for example a list of posts or comments) is sent to that app's provider. How they handle it is governed by that provider's privacy policy, not this one.
- Comments from other people are passed to the AI marked as untrusted, so the AI does not follow instructions hidden in a comment.
4. Who data is shared with
We only share data with the following parties, as far as needed:
- Meta Platforms (Instagram and Threads): the content you publish and your instructions to reply to or hide comments.
- LinkedIn: the content (text, photos, and videos) you publish to your LinkedIn profile.
- X: the content (text, photos with their alt text, and videos) you publish to your X account.
- Telegram: the content (text, photos, and videos) you publish to your Telegram channels or groups.
- Discord: the content (text, photos, and videos) you publish to your Discord channels.
- Pinterest: the Pins (image or video, title, description, and destination link) you publish to your boards.
- TikTok: the videos and photos you publish with their text and settings, and your replies and instructions to hide comments.
- Google (YouTube): the videos you upload with their title, description, and settings, and your replies and instructions to hide comments.
- Infrastructure providers that process data on our behalf: file storage (Cloudflare R2), networking and security (Cloudflare), server and database hosting, email delivery, and error monitoring (Sentry, servers in the European Union; only error messages and technical data, without post content, passwords, or tokens). Data is only provided as far as needed to run the Service.
- Duitku, a payment service provider licensed by Bank Indonesia: email address, name, amount, and order number when you create an invoice, to process the payment and send its confirmation to us.
- Apps and webhook URLs you connect yourself through MCP, API keys, or webhooks (see section 3).
- The Tebar user who made a connect link, for accounts you connect through that link (see section 1).
- Competent authorities, when required by applicable law.
Some infrastructure providers may store or process data outside Indonesia.
Our role
For Tebar account, payment, and security data, Tebar is the Personal Data Controller. For the content you publish and the personal data of followers, commenters, and owners of accounts you manage for others (for example through profiles and connect links), Tebar processes that data on your instructions as aPersonal Data Processor, and you are its Controller. This means you are responsible for having a lawful basis for processing, informing account owners, obtaining their consent where needed, and handling their requests, in line with Indonesia's Personal Data Protection Law and each platform's rules. We help with such requests as far as the Service allows.
5. How long data is kept
- Account and post data is kept while your account is active.
- Media (photos and videos) you keep in the media library is kept while your account is active. Media uploaded while creating a post and not kept in the library is deleted automatically 30 days after every post using it is finished, or 7 days after upload if no post uses it. Post history stays, without the media files.
- Data from Instagram/Threads/LinkedIn/TikTok/X/Telegram/Discord/Pinterest accounts (tokens, comments, statistics) is deleted or deactivated when you disconnect the account, or when you revoke Tebar's access in that platform's settings.
- Data from Pinterest (token, account profile, board IDs, and Pin IDs and links) is deleted within 30 days after you disconnect the account or revoke Tebar's access on Pinterest. Post history in Tebar stays, without the Pin IDs and links.
- Data from YouTube (tokens, channel profile, comments, statistics, video IDs and links) is deleted when you disconnect the channel, and within 30 days after access to the channel can no longer be renewed (for example because you revoked it from your Google account).
- Notification data from Instagram/Threads and one-time email links (verification, password reset) are deleted automatically on a regular basis.
- Connect links are valid for 30 minutes and their records are deleted 7 days after they expire. Webhook delivery history is deleted 30 days after delivery ends.
- Deleted profiles: their accounts are disconnected, then the profile's posts, media, comments, statistics, API keys, and AI connections are deleted.
- Backups may still hold deleted data for a while, until it is removed in the normal backup cycle.
6. Deleting data
You can delete data in several ways:
- Delete your Tebar account from the dashboard: Settings → Delete account. Access ends immediately (including API keys and AI apps), scheduled posts are canceled, then your files and all your account data are deleted. We send a confirmation email once the deletion is complete.
- Disconnect an account (Instagram, Threads, LinkedIn, TikTok, YouTube, X, Telegram, Discord, or Pinterest) from the Accounts page in the dashboard. For Pinterest, you can also revoke Tebar's access from the app settings in your Pinterest account.
- Revoke access from Instagram or Threads (Settings → Apps and websites). Removing Tebar from that list ends its access. If you also request data deletion there, Meta forwards it to us, and we delete that account's comments and statistics, clear its profile, and delete the platform post IDs and links. You can check the status of your request on theData deletion page with the confirmation code provided.
- Revoke Tebar's access from your Google account in theGoogle security settingsfor YouTube. We delete that channel's YouTube data within 30 days.
- Email [email protected] from your account's email address.
- Accounts you connected through a connect link: revoke Tebar's access in that platform's app settings, or ask the link creator to disconnect it. You can also contact us; because that data is managed by the link creator, we will forward your request to them and help as far as the Service allows.
Posts already published stay on Instagram, Threads, LinkedIn, TikTok, YouTube, X, Telegram, Discord, and Pinterest, because those posts are yours on those platforms. Delete them directly in the app if you no longer want them.
7. Security
- All connections use HTTPS.
- Access tokens from Instagram, Threads, LinkedIn, TikTok, YouTube, X, and Pinterest are stored encrypted. Passwords, API keys, and app access tokens are stored as a hash.
- Uploaded files are checked for type and size before they are stored.
- Access to production systems is limited to the people who need it.
No system is completely immune, but we take reasonable care to protect your data. If an incident affects your data, we will let you know.
8. Control over your data
You can:
- see and correct your account data in Settings;
- ask for a copy of the data we hold about you;
- disconnect social media accounts or revoke app access at any time;
- delete your account along with its data.
For requests you cannot handle yourself in the dashboard, contact[email protected]. We may ask you to verify that the request comes from the account owner.
9. Children
The Service is not intended for anyone under 18. If we learn that an account belongs to a child without the consent of a parent or guardian, we will delete it.
10. Changes to this policy
We may update this policy. The effective date above will change with it, and for important changes we will let you know by email or in the dashboard before they take effect.
11. Contact
Privacy questions or requests: [email protected]. See also the Terms of Service.