Privacy Policy

October 16, 2026

Who We Are

Gridley is developed and maintained by individual developer Nikita Marchenko.

If you have any questions about this Privacy Policy, please contact us at hello@gridley.app.

Scope of This Policy

This policy applies to the Gridley iOS and iPad app, its connected publishing services, and the Gridley website. The information involved depends on the features you use. Local planning does not require a connected social account.

What Data We Collect

We do not ask for or store your Instagram or TikTok password. A connected account is authorized through the relevant platform.

Depending on the features you use, Gridley processes:

Gridley account, device, and connected account identifiers needed for sessions, synchronization, and enabled notifications.
User-created captions, images, videos, thumbnails, drafts, scheduled posts, publishing times and settings, and Account Groups with selected destinations.
Destination-specific publication status, provider operation or post identifiers, retries, failures, notification records, and operational logs.
Connected account access tokens and, for TikTok, refresh tokens; app usage analytics and diagnostics; and consent-based website analytics.

Instagram and Meta Platform Data

When you choose to connect your Instagram Professional account through Meta, Gridley accesses only the Platform Data that you explicitly authorize through Meta Login and the Instagram Graph API.

The app requests Instagram business basic access, comment management, content publishing, and insights permissions. Features that need a permission may be unavailable if it is not granted.

Depending on the permissions you grant, this Platform Data may include:

Instagram User ID.
Username.
Display name.
Profile picture URL.
Account type.
Followers count.
Following count.
Media count.
Media metadata required to provide the Services.
Access tokens required to authenticate your connected Instagram account.

TikTok Platform Data

When you connect TikTok through TikTok Login, Gridley requests permissions for basic profile information, profile details, statistics, the list of your public videos, video upload, and video publishing. Gridley currently publishes TikTok videos through the backend’s PULL_FROM_URL flow. The permissions you grant determine what TikTok makes available. Gridley does not access private TikTok videos.

Depending on authorization, Gridley may process your TikTok Open ID, username, display name, biography, avatar URL, follower and following counts, video count, and authorized public video metadata. The latter may include a video ID, title or description, cover URL, public link, creation time, duration, dimensions, and view count. Gridley also checks creator information and available privacy options for publishing.

Tokens and Credentials

Gridley uses account tokens to authenticate authorized requests, refresh connections where supported, and publish content you select. Instagram access tokens and TikTok access and refresh tokens held by the backend are encrypted before storage. Where the iOS connection flow requires local credentials, they are stored in the device Keychain. The Instagram iOS flow exchanges credentials directly with Meta before an account may be synchronized with the Gridley backend.

How We Use Meta Platform Data

Gridley uses Meta Platform Data to provide the features you request.

This includes authenticating the connected Instagram account; displaying account information inside the app; content planning; scheduling and publishing content explicitly authorized by the user; providing analytics and account insights; and maintaining the connection between the user’s Instagram account and Gridley.

Gridley only accesses Platform Data belonging to the authenticated user who connected their own Instagram account.

We do not use Meta Platform Data for advertising profiling or sell, rent, license, or otherwise monetize it. We share it only with providers needed to operate the Services, subject to applicable platform requirements.

How We Use This Data

We use information to display connected profiles and authorized public content, plan and synchronize drafts, maintain Account Groups, deliver requested publishing, show outcomes, send enabled notifications, support subscriptions, secure the service, and diagnose failures.

Meta Platform Data is accessed through Meta Login and the Instagram Graph API only as needed for user-authorized features, including Instagram insights.

Publishing and Media Delivery

You can prepare a Manual Post or enable scheduled Auto Post for eligible connected accounts. Account Groups can select multiple Instagram and TikTok destinations. Each destination is processed independently, so one may succeed while another remains pending or fails.

Media needed for publishing may be uploaded to Cloudflare R2. Instagram/Meta receives URLs to fetch media. For TikTok video publishing, Gridley provides an HTTPS media URL through TikTok’s PULL_FROM_URL flow. These URLs are publicly accessible while a platform needs to retrieve the media; they are not private links or permanently encrypted media. Depending on the publishing path, a URL may refer to a temporary upload or a stored copy that remains available while publication is pending or has failed.

Gridley sends the media, caption or title, and selected privacy, interaction, and commercial settings supported for the destination. Each platform applies its own publishing and visibility rules.

Status, Retries, and Notifications

We record status, attempts, provider identifiers, and failures for each destination. Scheduled publishing may be retried or reconciled when a provider response is delayed or uncertain. We may send in-app or push reminders and result notifications when the service and your settings permit. Limited operational logs help diagnose errors.

Third-Party Services

The following services may process data according to their own privacy policies:

Cloudflare — hosting, backend infrastructure, database, and R2 media storage and delivery.
Meta/Instagram and TikTok — authorization, account information, and requested publishing.
Firebase — app analytics; Google Analytics via Firebase — consent-based website usage measurement.
AppHud and Apple — in-app purchases, subscriptions, and App Store functions.

Data Processors

Gridley uses Cloudflare, Inc. as a cloud infrastructure provider and data processor.

Cloudflare processes and stores Gridley account and publishing data, including media in R2, to operate the Services. Public media URLs are used when Meta or TikTok needs to retrieve content for publishing.

Data Storage & Security

We aim to process only information needed for the features you use. We use HTTPS/TLS in transit, encrypt backend social account tokens before storage, and use iOS Keychain for applicable local credentials. Access is limited by operational need. No internet service can guarantee absolute security.

Analytics are processed by the relevant providers under their own policies and consent choices where applicable.
Access to Platform Data is restricted according to operational need.

Data Retention

Drafts, scheduled content, settings, and connected account information remain while needed for requested features or until deleted or disconnected. For a post sent to multiple destinations, automatic post and associated media cleanup occurs only after every selected destination has successfully published and completion processing has finished. Failed R2 object deletion may be retried.

A post or its media may remain when any destination is pending or has failed, so you can review, retry, change, or delete it. Staged uploads have separate cleanup. Some temporary local uploads are removed after a manual publishing attempt. Limited logs, backups, or records may remain for security, troubleshooting, legal obligations, or disputes under applicable retention practices; removal from these systems may take time.

Data Deletion

You can delete your Gridley account in the app or contact hello@gridley.app with a privacy request.

Open Gridley → Settings → Delete Account, then confirm.

Deletion removes active account records and associated content from the primary service. Media object removal is performed on a best-effort basis; backups, logs, and legally required records may remain for a limited period. Some analytics records may not be individually identifiable.

You can disconnect an Instagram or TikTok account in Gridley or revoke its permissions with Meta or TikTok. A connected account cannot be removed during active publishing; try again after it completes. Revocation may stop future access but does not itself delete your Gridley account.

Deleting Gridley data or disconnecting an account does not remove content already published to Instagram or TikTok. Manage published posts on those platforms. See the Data Deletion page for the in-app steps.

Children's Privacy

Gridley is not directed at children under 13 years old and does not knowingly collect data from them.

Gridley and its providers may process information in countries other than your own. Applicable privacy protections and lawful transfer requirements vary by location.

Depending on where you live, including the EU/EEA, UK, or California, you may have rights to access, correct, delete, or receive a copy of personal data, restrict or object to certain processing, or appeal a decision. Rights and exceptions depend on applicable law. Contact hello@gridley.app; we may need to verify your identity.

API Integrations

Gridley uses Meta Login and the Instagram Graph API for user-authorized Instagram Professional accounts and TikTok Login and TikTok APIs for user-authorized TikTok accounts.

Meta and TikTok independently process data under their own privacy policies. Platform permissions and features can change with their APIs or policies.

Compliance with Meta Platform Terms

Gridley processes Meta Platform Data for authorized functionality in accordance with Meta Platform Terms, Meta Developer Policies, and applicable privacy laws.

We collect only the Platform Data necessary to provide the Services requested by users. We apply data minimization principles and process Platform Data only for the purposes explicitly authorized by users.

User Control

You choose whether to connect an account, which destinations to include in an Account Group, and whether to use Manual Post or Auto Post. You may disconnect an account in the app or revoke permissions through Meta or TikTok. Loss of permission may prevent features that depend on the connection.

Website analytics can be controlled through the site consent choice.

Changes to This Policy

We may update this policy as the service changes. We will post the updated date and text here.

Contact

For questions or concerns about this privacy policy, contact us at hello@gridley.app.