Privacy Policy

Effective and last updated: 18 October 2026

This Privacy Policy explains how Feedliyo (“Feedliyo”, “we”, “us”, “our”) collects, uses, shares, and protects personal information. It covers every Feedliyo product and every developer app we publish on a social platform:

Website — https://feedliyo.com, including demos, documentation, support, and checkout;
Plugins — Feedliyo – Social Feed & Product Feed Lite (free, from WordPress.org) and Pro (paid add-on), which site owners install on their own WordPress sites;
Connect — our sign-in service at https://connect.feedliyo.com, which links a site owner’s social account to their WordPress site;
Developer apps — the “Feedliyo” apps registered with TikTok, Meta (Instagram, Facebook, Threads), Google (YouTube, Google Photos), X, and Pinterest. Each app has its own section below.

The same policy is published at https://feedliyo.com/privacy-policy/ and https://connect.feedliyo.com/privacy-policy. Please also read our Terms of Service.

1. Summary

Our social apps are read-only. They let a website owner display their own social content on their own WordPress site. We never post, message, follow, like, or delete anything on your behalf.
Access tokens are sent to the WordPress site that requested them and stored there, encrypted. Connect does not keep tokens after the sign-in finishes.
Feed content (posts, videos, images) is fetched by the plugin on the site owner’s server directly from each platform’s official API. It does not pass through or get stored on our servers.
We do not sell personal information, and we do not use social platform data for advertising, profiling, data brokering, or training AI models.
You can revoke access at any time on the platform, disconnect in WordPress, and ask us to delete anything we hold by emailing [email protected].

2. Who we are and our role

Feedliyo is the developer of Feedliyo and the owner of the Feedliyo developer apps. Contact: [email protected].

We are the controller for information we collect through the website, purchases, support, and Connect.
The site owner is the controller for information the plugin stores and displays on their own WordPress site (connected accounts, cached feeds, product catalogs, pixel events). That site runs on the owner’s hosting, not ours, and we have no access to it. Visitors of a site that shows a Feedliyo feed should read that site’s own privacy policy.

3. Information we collect

3.1 Website visitors

Technical data: IP address, browser and device type, pages requested, referring URL, and date and time, recorded in standard server logs.
Cookies: cookies needed for the site to work (for example, session and checkout cookies). Where we use analytics, we use them to understand aggregate traffic and not to build advertising profiles. You can block or delete cookies in your browser.
Information you send us: your name, email address, and message when you contact us, request support, or subscribe to updates.

3.2 Customers (Pro licenses)

Pro licenses are sold through Freemius, which acts as our reseller and merchant of record. When you buy, Freemius collects your name, email address, billing address and country, tax details, and payment details. We receive your name, email, country, plan, license key, the website URLs where the license is activated, and order history. We never receive or store your full card number. Freemius’s own privacy policy applies to the payment process.

3.3 Connect (sign-in service)

When a site owner clicks Connect in WordPress, their browser visits Connect, which sends them to the selected platform’s official sign-in and consent screen. Connect processes:

the platform name, a one-time security value (“state”), the WordPress site address, and the admin page to return to;
the authorization code the platform returns after you approve, which Connect exchanges for an access token and, where offered, a refresh token, using our app credentials;
for X and Google Photos, a username or email address returned with the token so WordPress can label the account;
technical request data (IP address, user agent, time) for security, rate limiting, and debugging.

Connect immediately redirects your browser back to your own WordPress admin with the tokens. It keeps only a short-lived sign-in record that expires after 15 minutes and is deleted when sign-in finishes, a functional session cookie (fspf_connect) that ends when you close your browser, and a rate-limit counter keyed by a one-way hash of your IP address that holds only a count and a start time. It does not keep tokens, does not fetch your posts, and does not create an account for you.

Token refresh. For TikTok, YouTube, Google Photos, X, and Pinterest, access tokens expire quickly. To renew them, the plugin on the site owner’s server sends the refresh token to Connect, which exchanges it with the platform using our app secret and returns the new token in the same response. Refresh requests are processed in memory and are not logged or stored.

3.4 Support

If you ask for help, we process what you send us: your messages, screenshots, site URL, and any diagnostic details you choose to share. Please do not send passwords or access tokens. If you give us temporary access to your site, we use it only to solve your request and ask you to remove it afterwards.

3.5 What the plugins send to us

The Lite plugin contacts our servers only when it uses Connect (to sign in or refresh a token). The Pro plugin may also contact our licensing provider to check your license key and offer updates, sending the license key, site URL, and plugin and WordPress versions. Neither plugin sends us your feed content, your visitors’ data, or your WooCommerce orders.

4. How the plugins handle data on your site

Everything in this section happens on the site owner’s own WordPress server. We cannot see or access it.

Connected accounts: account id, username, profile details, and tokens are stored in the site’s database. Access and refresh tokens are encrypted with AES-256-CBC using a key derived from the site’s WordPress security salts.
Feed cache: fetched posts are cached in the site’s database (by default for 6 hours, adjustable by the site owner) and refreshed hourly by WordPress cron. Profile pictures, banners, and post thumbnails are copied to the site’s wp-content/uploads/fspf folder so pages load fast and do not send visitors’ browsers to the social platforms just to load images.
Removed content: when a post is deleted or made private on the platform, it stops appearing on the site at the next refresh. Site owners can also hide individual posts, refresh a feed immediately, or clear all caches in the plugin.
Health emails: if enabled, the plugin emails the site administrator when a connected account needs attention.
Uninstall: with “Remove data on uninstall” turned on, deleting the plugin removes its database tables and settings, including all tokens. Copied images in uploads/fspf can be deleted by removing that folder.
Site visitors: the plugin does not set tracking cookies for feed display. Videos play in each platform’s official embedded player (YouTube uses the privacy-enhanced youtube-nocookie.com domain), and those players are governed by that platform’s policy.

5. Social channel apps

Each developer app below is used only by a website owner who chooses to connect their own account. The permissions requested are the minimum needed to display that owner’s content. Data is requested only after the owner approves the platform’s consent screen, and is used only for the purpose shown.

5.1 TikTok

Applies when you connect a TikTok account to Feedliyo using TikTok Login Kit and TikTok Display API.

Permissions requested: user.info.basic, user.info.profile, user.info.stats, video.list.
Account data we access: open_id, union_id, display name, username, avatar URL, bio, profile link, verified badge, and follower, following, like, and video counts.
Content we access: the connected account’s public videos: video id, title, description, cover image URL, share URL, embed link, duration, publish time, and like, comment, share, and view counts.
Tokens: An access token (valid about 24 hours) and a refresh token (valid up to 365 days). The plugin renews the access token through Connect before it expires.
Why: to show the site owner’s own TikTok profile header and video grid on their WordPress site, with each video linking back to TikTok.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer TikTok data.
What we never do: post, upload, edit, or delete videos; read direct messages, comment text, drafts, or private videos; access other users’ accounts; or use TikTok data for advertising, profiling, or AI model training.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: In the TikTok app go to Profile → Menu → Settings and privacy → Security → Apps and services (Manage app permissions), select Feedliyo, and remove access.
TikTok policies:TikTok Privacy Policy · TikTok Terms of Service · TikTok Developer Terms

The TikTok Pixel and TikTok Events API, which are separate optional commerce features, are described in section 6. They do not use the TikTok Login connection.

5.2 Instagram

Applies when you connect a Instagram account to Feedliyo using Instagram API with Instagram Login (and, for Pages-linked accounts, Instagram Graph API through Facebook Login).

Permissions requested: instagram_business_basic.
Account data we access: Instagram user id, username, name, account type, profile picture URL, biography, website, and media, follower, and following counts.
Content we access: the connected professional account’s own posts, reels, and carousels: media id, caption, media type, media and thumbnail URLs, permalink, timestamp, and like and comment counts. Where the site owner turns on hashtag feeds (Pro), public media returned by the official Hashtag Search API for that hashtag.
Tokens: A long-lived access token (about 60 days) that the plugin refreshes automatically before it expires.
Why: to show the site owner’s own Instagram feed on their WordPress site, link each post back to Instagram, and, if the owner chooses, attach their own WooCommerce products to posts as shoppable tags.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer Instagram data.
What we never do: publish or delete posts, read or send direct messages, access personal (non-professional) accounts, or use Instagram data for advertising or profiling.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: In Instagram go to Settings → Website permissions → Apps and websites, and remove Feedliyo.
Meta Platforms policies:Meta Privacy Policy · Instagram Terms of Use · Meta Platform Terms

5.3 Facebook

Applies when you connect a Facebook account to Feedliyo using Facebook Login and the Pages API.

Permissions requested: pages_show_list, pages_read_engagement, pages_read_user_content.
Account data we access: Page id, name, username, category, link, profile picture and cover photo URLs, and fan and follower counts, plus a Page access token for each Page the user selects.
Content we access: posts published by the selected Page: post id, message, created time, permalink, images, video and attachment details, and reaction, comment, and share counts.
Tokens: A long-lived Page access token for each Page the user selects in the Page picker. The user’s own Facebook profile is not stored.
Why: to show posts from a Facebook Page the site owner manages on that owner’s WordPress site, linking each post back to Facebook.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer Facebook data.
What we never do: post to Pages or profiles, read Messenger conversations, manage ads, read personal profile timelines, or use Facebook data for advertising or profiling.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: On Facebook go to Settings & privacy → Settings → Business integrations (or Apps and websites), and remove Feedliyo.
Meta Platforms policies:Meta Privacy Policy · Facebook Terms · Meta Platform Terms

5.4 Threads

Applies when you connect a Threads account to Feedliyo using Threads API.

Permissions requested: threads_basic.
Account data we access: Threads user id, username, name, profile picture URL, and biography.
Content we access: the connected account’s own threads: post id, text, media type, media and thumbnail URLs, permalink, shortcode, and timestamp.
Tokens: A long-lived access token (about 60 days) that the plugin refreshes automatically before it expires.
Why: to show the site owner’s own Threads posts on their WordPress site, linking each post back to Threads.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer Threads data.
What we never do: publish, reply, or delete posts, read replies or mentions from other users, or use Threads data for advertising or profiling.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: In Threads go to Settings → Account → Website permissions, and remove Feedliyo.
Meta Platforms policies:Threads Supplemental Privacy Policy · Threads Terms of Use · Meta Platform Terms

5.5 YouTube

Applies when you connect a YouTube account to Feedliyo using YouTube Data API v3 (Google OAuth), or a public channel URL with an API key or RSS.

Permissions requested: https://www.googleapis.com/auth/youtube.readonly.
Account data we access: channel id, title, handle, description, avatar and banner URLs, and subscriber, view, and video counts.
Content we access: the channel’s public videos, Shorts, and playlists: video id, title, description, thumbnails, duration, publish date, and view, like, and comment counts.
Tokens: An access token (about 1 hour) and a refresh token. The plugin renews the access token through Connect.
Why: to show the site owner’s YouTube channel header, videos, and playlists on their WordPress site, played through YouTube’s own embedded player.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer YouTube data.
What we never do: upload, edit, or delete videos, manage comments or subscriptions, read private or unlisted videos, or use YouTube data for advertising, profiling, or AI model training.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: Go to your Google Account → Security → Your connections to third-party apps & services, select Feedliyo, and remove access.
Google policies:YouTube Terms of Service · Google Privacy Policy · YouTube API Services Terms of Service · Google API Services User Data Policy

Feedliyo uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

Google Limited Use: Feedliyo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read this data unless you give us permission for support, it is needed for security, or the law requires it.

5.6 Google Photos

Applies when you connect a Google Photos account to Feedliyo using Google Photos Picker API (Google OAuth).

Permissions requested: https://www.googleapis.com/auth/photospicker.mediaitems.readonly, openid email and profile (userinfo.email, userinfo.profile).
Account data we access: Google account email address and name, used only to label the connected account in WordPress.
Content we access: only the photos and videos the user explicitly picks in Google’s own Picker window: media item id, file name, MIME type, dimensions, creation time, and a temporary base URL to the media.
Tokens: An access token (about 1 hour) and a refresh token. The plugin renews the access token through Connect.
Why: to show photos and videos the site owner hand-picked from their own Google Photos library as a gallery on their WordPress site.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer Google Photos data.
What we never do: browse, search, or download the rest of the user’s library, upload or edit media, read albums the user did not pick from, or use Google user data for advertising, profiling, or AI model training.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: Go to your Google Account → Security → Your connections to third-party apps & services, select Feedliyo, and remove access.
Google policies:Google Privacy Policy · Google Terms of Service · Google API Services User Data Policy

5.7 X (formerly Twitter)

Applies when you connect a X (formerly Twitter) account to Feedliyo using X API v2 with OAuth 2.0 (or an app-only bearer token the site owner supplies).

Permissions requested: tweet.read, users.read, offline.access.
Account data we access: X user id, username, name, description, profile image and banner URLs, and follower, following, and post counts.
Content we access: the connected account’s own public posts: post id, text, creation time, links and mentions, attached media (image URLs, video variants, alt text, duration), and like, repost, reply, and view counts.
Tokens: An access token (about 2 hours) and a refresh token. The plugin renews the access token through Connect.
Why: to show the site owner’s own X posts on their WordPress site, linking each post back to X.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer X (formerly Twitter) data.
What we never do: post, repost, like, follow, read direct messages, read other users’ timelines, or use X data for advertising, profiling, or to train AI models.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: On X go to Settings and privacy → Security and account access → Apps and sessions → Connected apps, select Feedliyo, and revoke access.
X Corp. policies:X Privacy Policy · X Terms of Service · X Developer Agreement

5.8 Pinterest

Applies when you connect a Pinterest account to Feedliyo using Pinterest API v5 with OAuth 2.0.

Permissions requested: user_accounts:read, boards:read, pins:read.
Account data we access: username, business name, account type, profile image URL, about text, website URL, and follower, following, board, Pin, and monthly view counts.
Content we access: the connected account’s own Pins and boards: Pin id, title, description, alt text, destination link, dominant color, image and video cover URLs, dimensions, creation time, and the name of the board each Pin is saved to.
Tokens: An access token (valid 30 days) and a refresh token (valid about one year). The plugin renews the access token through Connect before it expires.
Why: to show the site owner’s own Pinterest profile header and Pins, optionally from one chosen board, on their WordPress site, with each Pin linking back to Pinterest.
Where it is stored: only in the site owner’s WordPress database (tokens encrypted) and media folder, as described in section 4. Connect passes tokens through and does not keep them.
Who it is shared with: nobody, except that the content is shown publicly on the site owner’s website because the owner chose to display it. We do not sell or transfer Pinterest data.
What we never do: create, edit, save, or delete Pins or boards, follow accounts, read messages or secret boards, read other users’ Pins, access ads or analytics, or use Pinterest data for advertising, profiling, or AI model training.
Retention and deletion: data stays only while the account is connected. Disconnecting the account in WordPress (Feedliyo → Accounts → Remove) deletes its tokens and profile record immediately, and cached posts are removed when the cache is cleared or expires.
Revoke access: On Pinterest go to Settings → Security and logins (or Apps) → Connected apps, find Feedliyo, and remove access.
Pinterest policies:Pinterest Privacy Policy · Pinterest Terms of Service · Pinterest Developer Guidelines

6. Product Feed, shoppable posts, and pixels

These optional features run on the site owner’s WordPress site with WooCommerce. We do not receive any of this data.

Product catalogs: the plugin generates catalog files (Meta / Instagram XML, and TikTok, Pinterest, and Snapchat CSV) from the store’s published products: product id, title, description, price, availability, product link, image link, and brand. Each file sits at a secret URL that the store owner gives to the commerce platform. Catalogs contain product data only, not customer data.
Shoppable posts: site owners can attach their own products to posts. Tags are stored in the site’s database.
Meta Pixel and Conversions API, TikTok Pixel and Events API: if the store owner adds their own pixel ids and tokens, the plugin sends shopping events (ViewContent, AddToCart, Purchase) from visitors’ browsers and from the store’s server to Meta and/or TikTok. Events can include product ids, value, currency, a SHA-256 hash of the customer’s email address, IP address, user agent, and page URL. These are sent under the store owner’s own Meta and TikTok accounts, and the store owner is responsible for informing visitors and getting consent. With the plugin’s GDPR mode on, pixels stay off until a consent tool allows them.

7. How we use information and legal bases

To provide Connect and complete sign-ins and token refreshes — performance of a contract with the site owner who requested it.
To sell, license, deliver, and support Pro, and to send service messages such as receipts, renewal notices, and security notices — performance of a contract.
To secure our services, prevent abuse, and fix bugs — legitimate interests.
To send product news, only if you opt in, with an unsubscribe link in every email — consent.
To keep tax and accounting records and respond to lawful requests — legal obligation.

We do not use personal information for automated decisions that have legal or similarly significant effects on you.

9. Retention

Data	Kept for
Connect sign-in record (state, return URL)	Until sign-in finishes; at most 15 minutes
Access and refresh tokens on Connect	Not stored
Connect session data	Cleared when sign-in finishes; session files are removed by routine server cleanup, normally within 24 hours
Rate-limit counters (one-way hash of IP, count, start time)	Counter resets every 10 minutes; no IP address is stored
Server logs	Up to 30 days, longer only to investigate an incident
Support messages	Up to 2 years after the conversation ends
Customer and license records	For the license term, then as long as tax and accounting law requires
Data in the plugin on your site	Controlled by the site owner (see section 4)

10. Security

We use HTTPS everywhere, signed and time-limited sign-in state, PKCE where platforms support it, strict checks that tokens return only to the WordPress admin page that started the sign-in, rate limiting, least-privilege permissions, and app secrets kept outside the public web folder. Tokens on WordPress sites are encrypted at rest. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and the relevant authorities as the law requires. Site owners should keep WordPress, plugins, and admin accounts secure.

11. International transfers

We are based in Bangladesh, and our servers and service providers may be in other countries, including the United States and the European Union. When we transfer personal information from the EEA, the UK, or Switzerland, we use safeguards such as the European Commission’s Standard Contractual Clauses.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict processing, and to withdraw consent. To use these rights, email [email protected]. We reply within 30 days and may need to verify your identity. We will not treat you differently for using your rights. You may also complain to your local data protection authority.

For information stored by a website that uses our plugin, please contact that website’s owner; we will help them respond if needed.

13. Data deletion instructions

To remove a connected social account and its data:

In WordPress, open Feedliyo → Accounts and click Remove on the account. Its tokens and profile record are deleted immediately.
Clear the feed cache (Feedliyo → Settings → Clear cache), or wait for it to expire.
Revoke the Feedliyo app on the platform (see the “Revoke access” step in that platform’s section above). This invalidates every token immediately.
If you are not the site owner, or you want us to confirm that we hold nothing about you, email [email protected] with the subject “Data deletion request” and your platform username. We confirm deletion within 30 days.

14. Children

Our services are for businesses and adults who manage websites. They are not directed to children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their personal information. If you believe a child has given us information, email [email protected] and we will delete it.

15. Regional notices

EEA, UK, and Switzerland: the legal bases we rely on are listed in section 7, and your rights in section 12.

California and other US states: in the last 12 months we collected identifiers, commercial information (purchases), internet activity (server logs), and, for connected accounts, social account information, for the purposes in section 7. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information. You may request to know, correct, or delete your information as described in section 12, including through an authorized agent.

Bangladesh: we process personal information in line with applicable Bangladeshi law and this policy.

16. Changes to this policy

We will update this policy when our products, a platform’s rules, or the law change — for example, when we add a new channel app. We change the “last updated” date at the top, and for significant changes we notify customers by email or in the plugin before the change takes effect.

17. Contact us

Feedliyo
Email: [email protected]
Website: https://feedliyo.com