Deleting your data

An access token for each connected Page or Instagram Business account, encrypted at rest using AES-256-GCM. This is what lets us publish on your behalf, and it is the only credential we hold.

Basic account identifiers: the Page or Instagram account ID, its handle and display name, and its profile picture URL — so you can tell your connected accounts apart in the app.

The Meta user ID of the person who authorized the connection. We store it for one reason: so that when Meta tells us that person has removed Flowtus, we can find every account they authorized and revoke it.

Content you create in Flowtus and publish through these accounts: post text, scheduled times, uploaded media, and the delivery outcome of each post.

Performance figures we sync back for your reports: impressions, reach, likes, comments, shares, and follower counts.

We do not store your Facebook or Instagram password, we never receive it, and we do not read your private messages.

In Flowtus, go to Accounts, find the account, and choose Disconnect.

This immediately deletes the stored access token and marks the connection revoked. Flowtus can no longer publish to, or read anything from, that account.

Posts you already published stay on Facebook or Instagram — they belong to your account, not to us, and only you can remove them from the platform itself.

You can also do this without opening Flowtus at all. In Facebook, go to Settings & privacy → Settings → Apps and Websites, find Flowtus, and remove it.

Facebook notifies us automatically, and we revoke and delete the stored tokens for every account that person authorized — across every workspace, not just the one they were last using.

We record the request and issue a confirmation code, and Facebook shows you a link where you can check that the deletion completed.

Any team member other than the owner can delete their own account from their account settings. We remove your name, email address, avatar, password and two-factor credentials, sign you out everywhere, and free your seat.

Posts you scheduled and approvals you gave stay with the agency, attributed to a deleted user — it is their record of their own operations.

An owner cannot delete only their own account: an organization with no owner has nobody who can manage billing or delete it. Transfer ownership first, or delete the whole organization below.

An owner can delete the organization from Settings. You type the organization's name and re-enter your password — one proves you know which organization you are deleting, the other proves it is you.

Deletion happens 7 days later. From the moment you ask, the organization is inaccessible: everyone is signed out and nobody can sign back in. Nothing is erased during those 7 days.

We email the owner a single-use link that cancels it. That is the only way back, because nobody can sign in to cancel from inside the product.

After 7 days we permanently delete your users and sessions, clients and workspaces, posts and their scheduling, the media objects themselves, your evergreen library, short links, AI usage records, connected-account tokens — attempting revocation at each platform first — notifications and invitations.

Disconnecting an account, and the automated deletion Facebook triggers, both take effect immediately — the token is erased as part of the request, not queued for later.

Uploaded media is removed by our scheduled cleanup: media attached to posts is deleted once no active post needs it and your organization's retention window has passed (30 days by default). Deleting the whole organization removes the media objects outright, without waiting for that window.

Organization deletion completes 7 days after it is requested.

Audit records — the action, who took it and when — are kept for 12 months after deletion so that security and fraud questions arising afterwards can still be answered. They contain none of the content that was deleted.

The record that a Meta deletion request was made is kept, because Meta requires the confirmation-code status page to keep answering after the data is gone.

Deleted data also remains in our encrypted backups until they age out, which happens within 30 days. Backups exist only for disaster recovery; we do not search them or restore individual records from them.

For Meta's review: Flowtus implements Meta's data deletion callback at https://api.flowtus.io/webhooks/meta/data-deletion, and the deauthorize callback at https://api.flowtus.io/webhooks/meta/deauthorize.

Instagram Login and Threads are separate Meta apps with their own callbacks, at https://api.flowtus.io/webhooks/instagram/data-deletion and https://api.flowtus.io/webhooks/threads/data-deletion, and the matching deauthorize URLs.

Each verifies Meta's signed request against that app's own secret before acting, so no unauthenticated caller can trigger or forge a deletion, and one app's request cannot revoke another app's accounts.

Each request returns a confirmation code and a status URL, at https://api.flowtus.io/webhooks/meta/deletion-status/<code>, which shows whether that deletion has completed.

Repeating a callback is safe: a second identical request affects nothing, so a retry from Meta can never cause a partial or double deletion.

If anything here is unclear, or a deletion has not happened the way this page describes, contact privacy@flowtus.io and we will answer.