OPEN SOCIAL INFORMATION

Privacy policy

Effective date: October 19, 2026

Open Social is a private, single-owner social automation application operated by Gravitas AI LLC and administered by Christopher Graves. This policy covers the installation at https://social.gravitasai.xyz and information it receives when people interact with social accounts connected to that installation. It does not cover other independently hosted copies of the software.

Open Social uses official platform APIs to match comments or incoming messages against rules set by the account owner and send configured replies. Instagram is the first connected platform. Additional platform connections would be covered only when enabled and disclosed in an updated policy.

Information we process

For a connected Instagram account, we process its account identifier, username, authorization status, access token and expiration information. We receive comment or message text, platform identifiers for the author and interaction, available usernames, associated post identifiers, and timestamps. We also store configured automation rules and reply text, links included in replies, queued and completed response records, delivery errors, and opt-out records.

Data may be recorded even when an incoming interaction does not match an automation. Although Instagram's basic permission is described as profile and media access, the current integration does not create a general archive of photos or videos. Text and identifiers are the interaction data used by the automation engine.

The private dashboard uses owner authentication, session cookies, and temporary authorization records. Cloudflare also processes technical request and sign-in information to provide hosting, authentication, and security. Open Social does not ask for or store your Instagram password; you authorize the connection through Instagram.

How we use information

We use this information to connect the account, receive permitted interactions, match keywords, prepare and send replies, investigate delivery failures, prevent duplicate replies, respect opt-outs, and protect and recover the workspace. The operator can review stored activity in the private dashboard.

We do not sell personal information or use interaction data for targeted advertising. The current application does not send interaction content to AI model services. The application does not include advertising trackers or an analytics SDK.

Cloudflare provides the hosted application, private database, access controls, and related infrastructure. Meta provides Instagram authorization, interaction events, and message or comment delivery. Replies and the identifiers needed to deliver them are sent to Meta through its APIs; public replies can be seen by people who can view the relevant Instagram content.

The operator and authorized infrastructure administrators can access data as needed to operate, secure, or maintain the service. Information may also be disclosed when required by applicable law or necessary to address fraud, abuse, or security incidents.

Cloudflare and Meta operate international infrastructure, so information may be processed outside your country. Their own services are also subject to their respective privacy policies: Cloudflare and Meta.

Links supplied in replies may lead to separately operated websites. Those sites' privacy practices apply when you visit them.

Storage and retention

The hosted workspace stores information in a private Cloudflare database. Account tokens and developer app secrets are encrypted by the application before database storage. Dashboard access is restricted to the owner. These protections do not make message or comment content inaccessible to the authorized operator.

Activity history, response records, account metadata, and opt-out records currently remain until manually deleted; there is no automatic history expiration schedule. Disconnecting an account clears its stored access tokens and pauses its automations, but does not automatically erase earlier activity or response history. Removing the app through Instagram revokes platform access and does not by itself delete previously stored workspace data.

The operator may create passphrase-encrypted backups. Deleting a record from the active workspace does not rewrite existing backup files. Deletion requests must also be considered when retaining backups or restoring a workspace. Copies already delivered to Instagram are managed separately by Meta.

Your choices and data deletion

You can revoke the connection through Instagram's Apps and websites settings. You can send STOP as a direct message to a connected account to stop this application's automated replies for that account. An opt-out suppresses future automated replies; it does not delete earlier records or prevent the connected account from receiving messages.

To request access, correction, or deletion of information held by this Open Social installation, email chris@gravitasai.xyz with the subject Open Social privacy request. Include your Instagram username, the connected account you interacted with, and enough context to locate the relevant records. Do not send passwords, access tokens, verification codes, or unnecessary private message content.

We may ask for reasonable confirmation that the request concerns your information. Requests are handled manually. A verified deletion request covers relevant records in the active workspace and review of retained backups; records required for applicable legal obligations, security, or honoring an opt-out may need to be retained. We will explain any such limitation when responding. Deleting Open Social records does not remove messages or comments already held by Instagram or other recipients.

Changes and contact

We will update this policy when the application's data practices change and show the effective date on the published version. For questions about this installation or this policy, contact chris@gravitasai.xyz.