Privacy at Sosaly.

What we collect

Your account. When you sign up, we use your email and sign-in records to give you access and keep your account safe. Our authentication provider handles your password, email verification, and password resets. We also note which version of the Terms and Privacy Policy you accepted, and when.

Visiting the site. Like any website, our hosting provider sees basic technical details such as your IP address, browser, and the pages you request. We keep a few security records to stop abuse.

Support. If you email us, we use your address and message to help. Please don't send passwords or anything sensitive we don't need.

Cookies

One cookie keeps you signed in for up to 24 hours. Connecting the GroupSignal extension sets a second cookie, a random browser identifier kept for up to 400 days, so reconnecting after a reinstall replaces that browser's connection instead of adding one. We store only a hash of it, and signing out doesn't remove it. During signup, your browser briefly holds an account reference and the policy version you accepted, never your password. No advertising or marketing trackers. Service providers run the site, sign-in, and support email for us.

GroupSignal, AI, and webhooks

What we store. Your monitors (names, what to look for, exclusions); the ID of each Facebook account you connect; the groups you select, whether each is active, and which of your accounts can read and collect it; and the identifiers that keep your browsers in sync. Your online inbox keeps matching posts (with any text read from their photos), saved opportunities, review history, links, group and author names, and why each post matched. Your Facebook login and cookies stay on your device. See the GroupSignal privacy overview for more.

Facebook account names and group lists. For each Facebook account you connect, we store its name and its group list (group IDs and names), so you can tell accounts apart and search all your groups from any device. Both are encrypted with keys held apart from our database, opened only for your group search, and never sent to AI or webhooks. Group memberships can reveal sensitive information, such as your health, beliefs, or politics. You can stop syncing or delete a list, or forget the account, on the Connections page.

AI matching. To check whether a post fits a monitor, your browser sends a short excerpt of it for analysis. When a post is only a photo, your browser reads the text in the photo on your device and sends that text instead; the photo itself is never saved or uploaded. Setup help sends your draft. OpenRouter and the model provider process it under routing that denies data collection and requires zero data retention. Sosaly keeps only matching posts and their explanations, not nonmatching posts, raw responses, or unsaved setup suggestions.

Webhooks. If you connect Zapier or Make, we store the trigger, payload choice, and on/off state, with the destination URL and any key encrypted. Sosaly's backend then sends matches or saved opportunities without asking each time, even while your browsers are closed. Minimal sends the event and post link; Standard adds a post excerpt; Full adds author and group names when available. Pause or remove it anytime. Once the service has the data, its own privacy policy applies and we can't recall it.

Accepting the Terms and Privacy Policy at signup covers all of this, with no extra consent prompts. You still choose browser permissions, groups, when monitoring starts, and where webhooks go. Signing up doesn't start a trial, monitoring, or a payment.

How long we keep it

Unsaved matches and their review history are deleted 30 days after each match arrives. Saved opportunities stay until you delete them. Deleting a monitor deletes all its records, saved opportunities included, on every device. Pausing, disconnecting a browser, signing out, removing the extension, or an ended subscription doesn't delete saved opportunities or shorten the 30 days. A Facebook account's name and group list stay until you delete the list, forget or fully disconnect the account, or delete your Sosaly account.

To delete your account, go to your account page. Renewals stop, any paid time you have left still counts, and you get 30 days after access ends to change your mind. Then we remove the account. We keep required payment records, and a used 7-day trial can't be restarted with the same email for 12 months.

Security records are cleared during routine cleanup, which can take a little while. Support emails are kept as long as we need them to help you.

Questions and requests

Email support@sosaly.com to ask a question, see your data, or correct it. If you can't delete your account from the account page, we can help. We may need to confirm it's you.