Privacy Policy

1. Scope

This policy applies to the Throwback website and its account registration, social account authorization, media sync, memory-film creation, and film storage features. Instagram and Facebook are provided by Meta Platforms, Inc. and its affiliates, whose own data practices are governed by their policies.

2. Information we process

• Throwback account data: your email address, encrypted login credentials, login state, preferences, and registration, authentication, and security records.
• Social account data: after you authorize access, account ID, username or name, account type, profile picture, granted permissions, and connection status from Instagram or Facebook. For the connected Instagram professional account, we also display the available biography, follower count, following count, and media count so you can identify the source account for your memories.
• Social media content: authorized post or media IDs, photos, videos, thumbnails, captions, permalinks, publication times, and media types.
• Creation data: selected media, templates, generation-job records, finished films, and analysis produced to organize and create a film.
• Authorization credentials: access tokens, expiration times, and permission scopes issued by Instagram or Facebook. Tokens are encrypted and are never shown to other users.
• Technical and security data: IP address, browser or device information, access times, request and error logs, and security audit records.

3. Sources of information

Information comes from what you submit, your actions in Throwback, the Instagram or Facebook interfaces you authorize, and technical records generated to operate and secure the service. Social authorization is optional, but media sync and film creation will not work without it.

4. How we use information

We do not use your authorization to publish, comment, or send messages for you unless a future feature clearly explains that purpose and obtains the required authorization. We do not sell or rent personal information or use Meta user data for targeted advertising.

• Create and maintain your Throwback account, verify identity, and protect account security.
• Show the authorized account profile and connection status, label its media source, and sync media you have authorized from Instagram or Facebook.
• Organize selected media, create and store films, and provide playback or downloads.
• Provide support, diagnose failures, and prevent abuse, fraud, and security incidents.
• Comply with applicable law, regulatory requirements, and legally valid requests.

5. Sharing and service providers

We disclose information as needed to provide and protect the service. The services used for the following purposes include:

Provider retention and processing terms can differ between services and endpoints. We do not make a blanket claim that every cloud, email, or AI service has zero data retention. Contact us for information about the processing chain relevant to your request.

• Meta, to complete Instagram and Facebook authorization and retrieve data you agree to provide.
• Google Cloud, to store synced or uploaded media, processing files, and finished films.
• Amazon Web Services, to run the service and store accounts, connection status, media indexes, job records, and operational/security logs.
• OpenRouter, Inc., to route AI requests. Photo understanding and story organization send necessary images or thumbnails, captions, publication dates, and related content metadata to Google (Gemini) or Alibaba Cloud (Qwen). AI image features may also use Google image models.
• When you choose an AI-video feature, necessary reference images and generation instructions are sent through OpenRouter to the model service used by that template: Seed / BytePlus for Seedance, or AtlasCloud for the inspected Kling service. These video-generation requests are separate from photo understanding; a Gemini/Qwen configuration does not describe the entire video-generation chain.
• Twilio SendGrid, to deliver verification emails using the recipient email address and message content. Customer support correspondence is handled through our support mailbox.

6. Storage, international processing, and security

Dealism PTE. LTD. is established in Singapore, and authorized operations personnel access data from China. Our application/database infrastructure is in the AWS US West (Oregon) region, and our Google Cloud Storage bucket uses the US multi-region. These storage locations do not determine every AI inference, email, or provider-support processing location.

Data may be stored or processed where we or our providers operate. Privacy rules may differ from those in your location. We use reasonable safeguards including encrypted transport, encrypted OAuth tokens, access controls, user-isolated storage, and access logs. No internet service can guarantee absolute security; when required, we will respond to and notify you of security incidents under applicable law.

7. Retention

Disconnecting Instagram or Facebook removes the access token and stops new retrieval, but does not automatically delete previously synced indexes or finished films. Follow the User Data Deletion instructions to remove those records.

• OAuth tokens are kept until you disconnect, the token expires, or authorization is revoked.
• Synced media indexes, creation assets, and films are kept until you delete them or submit a deletion request.
• After a valid full-deletion request, we normally delete applicable data from active systems within 30 days.
• Minimal records may be retained when needed for security, fraud prevention, disputes, or legal obligations. Residual backup copies are isolated and removed through normal backup rotation.

8. Your choices and rights

• Disconnect Instagram or Facebook from Connected accounts in Throwback.
• Remove Throwback from the Apps and Websites settings in Facebook or Instagram.
• Request access, correction, export, deletion, withdrawal of consent, or restriction where applicable law provides those rights.
• Request deletion of social-platform data or your entire Throwback account. We may verify your identity to protect your account.

9. Children’s privacy

Throwback is not directed to children under 13 and does not knowingly collect their personal information. If your location sets a higher digital-consent age, you must meet it or use the service with a parent or guardian’s consent. Contact us if you believe a child provided information to us.

10. Changes to this policy

We may update this policy as our features, laws, or security practices change. Material changes will be communicated through the product, account notices, or another reasonable method, and the date above will be updated.