Privacy Policy
Last updated:
This Privacy Policy explains what Cora ("we", "us", the "app") collects, why, and the choices you have. Cora is a content-planning app for Instagram creators and small businesses: it mirrors your Instagram profile grid, lets you plan and schedule posts, and can publish them to Instagram on your behalf.
Who is responsible
The data controller is Cora. For any privacy request — access, export, correction, or deletion — contact privacy@apollotechstudio.com.
What we collect
Account information
- Email address — how you sign in and how we reach you about your account.
- Name and language — optional, taken from your sign-in provider when available.
- Sign-in identifier — if you sign in with Apple, Google or Facebook, we store the provider's opaque user identifier (never your provider password) to recognise you on return.
- Password — if you register with an email and password, we store a one-way hash of that password, never the password itself. If you only ever sign in with Apple, Google or Facebook, there is no password on your account at all.
Instagram data (only when you connect an account)
Connecting Instagram is optional and uses the official Instagram API with Instagram Login. When you connect, with your authorisation we access and store:
- Your Instagram profile: user id, username, name, biography, profile picture, follower and following counts — to mirror your profile inside the app.
- Your Instagram media: images, videos, captions, permalinks and timestamps — to display and plan your grid.
- An access token, used to talk to Instagram on your behalf. The token is encrypted at rest, stored only on our server, and never sent to the app or any third party.
We request three Instagram permissions and no others:
instagram_business_basic (read your profile and media),
instagram_business_content_publish (publish a post when you ask us to), and
instagram_business_manage_insights (read the reach, saves and shares of your own
recent posts, so the app can show you how they performed). We do not read your direct messages,
and we never post without an explicit action from you.
Instagram does not allow reels or stories to be published automatically by any third-party app. For those, Cora reminds you at the time you chose and you post them yourself — we never publish them on your behalf, because we cannot.
Content you create
- Planned and scheduled posts, drafts, captions, and bookmarks you save in the app.
- When you use the optional AI caption / hashtag assistant, the text you submit is sent to our AI provider (Anthropic) to generate a suggestion. It is used only to answer your request and is not used to train models. We keep a per-user usage count to enforce fair-use quotas.
Technical data
- Basic session data (IP address, device/user-agent) for security and to keep you signed in.
- If you enable notifications, a device push token so we can notify you (e.g. when a scheduled post is published).
Product analytics and diagnostics
To understand how the app is used and to fix what is broken, we collect two kinds of technical events. Both are tied to your account identifier — a number — and never to your email address, your Instagram handle, your captions or your photos.
- Usage events (PostHog, hosted in the European Union): which screens you open and which actions you take — for example that a post was planned, scheduled, or published — together with your app version, platform, language and country. Counts such as your follower number are recorded only as a broad range, never as an exact figure.
- Session replays (PostHog): an anonymised reconstruction of how the interface responded during a session, used to find where the app confuses people. All text and all images are masked before anything leaves your device — we see the layout and the taps, never your captions, your photos or anything you type.
- Crash and error reports (Sentry, self-hosted by us): the technical details of a failure, with personal data scrubbed out, so we can fix it.
We do not use the advertising identifier (IDFA/AAID), we do not track you across other companies' apps or websites, and we do not build advertising profiles. That is why the app never shows you a tracking permission prompt.
Where we look at how Instagram metrics relate to app usage, we do so only in aggregate — for example "creators with under ten thousand followers keep planning for longer" — using broad ranges. Your individual Instagram metrics are yours, are shown to you in the app, and are never attached to you inside our analytics.
How we use your data
- To provide the core service: show your grid, plan content, and publish to Instagram when you ask.
- To keep your Instagram connection alive (periodic token refresh) and your grid in sync.
- To send account and service messages (e.g. a sign-in code, a publish confirmation).
- To secure the service and prevent abuse.
- To measure how the app is used, in aggregate, so we can improve it and fix what breaks.
We do not sell your personal data, and we do not use it for advertising.
Who we share it with
We share data only with the processors needed to run the service:
| Provider | Purpose |
|---|---|
| Meta / Instagram | Reading your profile and media, and publishing posts you schedule |
| Anthropic | Generating AI caption / hashtag suggestions you request |
| Apple / Google / Facebook | Verifying your identity when you sign in with them |
| Email & push providers | Delivering account emails and notifications |
| PostHog (EU) | Product analytics and masked session replay |
| Sentry (self-hosted by us) | Crash and error reports |
| Cloud hosting | Running the servers and database that store your data |
How long we keep it
We keep your data for as long as your account exists.
Disconnecting Instagram destroys the access token immediately, along with the profile details we mirrored from Instagram (your username, biography, picture and counts). It does not delete the posts and plans in your account: that is your work, it belongs to you, and you keep it whether or not an Instagram account is connected. Anything that was waiting to be published automatically simply becomes a reminder instead.
Deleting your account, or removing Cora from Instagram's "Apps and websites" screen, deletes everything — the account, the token, the profile snapshot, your posts, plans and media. That is permanent.
Your rights
- Access & export — request a copy of your data from within the app or by email.
- Deletion — delete your account and all associated data. See our Data Deletion page for the exact steps.
- Correction — ask us to correct inaccurate account data.
If you are in the EU/EEA, you may also lodge a complaint with your local data-protection authority.
Children
Cora is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.
Changes
We may update this policy; the "last updated" date above reflects the latest version. Material changes will be notified in-app or by email.
Contact
Questions about this policy: privacy@apollotechstudio.com.