SoGrow — Privacy Policy

Last updated: September 9, 2026

SoGrow ("SoGrow", "we", "us") runs an Instagram engagement service for its clients and gives each client an app to follow that work. This policy explains what personal information the SoGrow app and service collect, why, how long we keep it, and how to have it removed. Questions or requests: zenix@zbjagency.com.

1. What SoGrow is

SoGrow places likes and comments on Instagram on behalf of client accounts, using an engagement engine that our team configures and operates. The SoGrow app (iPhone) and website let a client see what that engine did for their account, pause or resume it, and request changes. Access is by invitation: SoGrow creates each client's login. There is no public sign-up and nothing is purchased inside the app.

2. Information we collect

Your SoGrow login

• Username and password. Your username is your Instagram handle. Your password is stored only as a salted bcrypt hash; we cannot read it. Your first password is temporary and must be replaced when you first sign in.
• A display name, if one was set when your login was created.

Your engine's activity

For each Instagram account SoGrow operates, we keep the figures our engine provider reports about the work done on it: counts of likes, comments, follows, unfollows and messages placed, when the engine last ran and is next due, whether it is running or paused, the automations configured, and the accounts they target. We record these figures at each sync so the app can show what changed over time. These figures describe our engine's actions; they are not read from your Instagram account.

Requests you submit in the app

Access requests, change requests and the notes you write in them, with the time they were submitted and any reply from our team.

Instagram data, only if you connect your account

Connecting Instagram is optional. If you choose to connect, you sign in on Meta's own pages and grant SoGrow the following permissions: instagram_basic (your Instagram professional account's profile and id), instagram_manage_insights (follower counts and audience insights), and pages_show_list (the Facebook Page linked to that Instagram account, which Meta requires to identify it). With these we read your follower count and insights so the app can chart follower growth against the engine's work. We do not post, like, comment, message or follow from a connected account, and we never see your Instagram password. The access token Meta issues is stored encrypted at rest and is used only to fetch that data.

Automatically

• Server logs: IP address, device and app version, the request made, its result and time. Kept by our hosting provider for a short period for security and debugging.
• The app itself contains no advertising, analytics or crash-reporting software and does not send push notifications.

3. How we use it

• To run the service you engaged us for and show you its results
• To act on the pause, resume, access and change requests you submit
• To keep the service secure and detect misuse
• To answer your questions and support requests
• To meet legal obligations

We do not sell personal information, and we do not use it for advertising.

4. Who else sees it

We share information only with providers that run the service for us, each bound by its own privacy terms:

We disclose information when the law requires it, or to protect the service and its users.

5. How long we keep it

• Login and engine data: while you are a SoGrow client. Deleted within 30 days after your account is closed or you ask us to delete it.
• Instagram access tokens and follower data: deleted when you disconnect Instagram in the app, or when you revoke SoGrow's access at Instagram, whichever comes first; the follower history collected through the connection is removed at the same time.
• Requests and their replies: while your account is active.
• Server logs: up to 30 days.

6. Deleting your data

You can remove your Instagram connection yourself at any time from the You tab in the app (Instagram → Disconnect) or from Instagram's settings under Apps and websites. To delete your SoGrow login and all data we hold about you, open the You tab in the app and choose Delete account; it takes effect at once and the remaining copies are purged within 30 days. If you no longer have the app, email zenix@zbjagency.com with the subject "Delete my SoGrow account", from an address we can match to your account, and we confirm within 7 days and complete deletion within 30. Full instructions: https://sogrow-api.vercel.app/legal/data-deletion

7. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, receive a copy, object to or restrict certain uses, and lodge a complaint with your local data-protection authority. Write to zenix@zbjagency.com; we answer within 30 days.

8. Security

All traffic uses HTTPS. Passwords are hashed with bcrypt. Instagram access tokens are encrypted at rest with a key held separately from the database. Sessions use signed tokens that can be revoked. Administrative actions on client accounts are logged. If a breach affects your data we will tell you without undue delay.

9. Children

SoGrow is a business service and is not intended for anyone under 18. We do not knowingly collect information from children.

10. Where data is processed

Our API and database run in the United States. If you use the service from elsewhere, your information is processed there.

11. Changes

We will show material changes in the app and ask you to accept them before continuing; the date at the top tells you when this policy last changed.

12. Contact

SoGrow · zenix@zbjagency.com