Privacy Policy for FactsOnly

Overview

FactsOnly is an automated fact-checking service that performs metadata-first fact analysis and may request direct media upload when metadata confidence is low. Currently available on Instagram, with more platforms planned. This policy explains how we handle your data.

What Data We Collect

Automatically Collected

• Platform User ID: To enforce rate limits (20 fact-checks per day)
• Message Content: Text and captions you send to the bot
• Permalink Metadata: If you share a post link, we may resolve metadata (for example caption/title and author name) through official APIs
• Media Content: Images/videos you send for fact-checking when deep analysis is required
• Message Metadata: Timestamps, message IDs (from platform webhooks)

Persisted Intelligence (Structured, Not Raw Media)

• Claim records: normalized claim text, claim hash, verdict, search content (source snippets), topic, language
• Source records: URLs of sources used to verify each claim
• Post linkage: external post IDs and claim-to-post links
• Verdict log: full response text and extracted claims for quality review
• Cache records: short-lived Redis entries for rate limiting, deduplication, and follow-up conversation context

Not Collected / Not Retained Permanently

• We do NOT scrape or crawl Instagram outside user-provided interactions
• We do NOT permanently store raw uploaded media files
• We do NOT track your activity outside of direct interactions with the bot

How We Use Your Data

Ephemeral Processing (Temporary)

1. Media Analysis: Your image/video is temporarily processed to extract factual claims
2. AI Processing: Content is sent to Google Gemini AI for claim extraction; claims are verified via Tavily Search API and, as a fallback, Google Search grounding
3. Automatic Deletion: All media is permanently deleted within 60 seconds of analysis completion

Persistent Intelligence (Core Database)

• Structured claim intelligence is stored in Supabase (Postgres) as the system of record
• This includes claim normalization, verdicts, search content, and post linkage
• This does not include permanent storage of raw uploaded images/videos

Caching & Rate Limiting (Redis)

• Platform user IDs are stored for 24 hours to enforce daily usage limits (20 checks/day)
• Duplicate message IDs are cached for 60 seconds to prevent double-processing

Third-Party Services

We share data with the following services only during active fact-checking:

Google Gemini AI (Gemini 3 Flash)

• Purpose: Extract factual claims from media
• Data Shared: Your image/video content temporarily
• Privacy: Subject to Google's Generative AI Terms

Tavily Search API

• Purpose: Per-claim web search to find authoritative sources for verification
• Data Shared: Rewritten search queries derived from claims (no images/videos)
• Privacy: Subject to Tavily Privacy Policy

Google Search (Grounding Fallback)

• Purpose: Fallback verification when primary search returns no results
• Data Shared: Text claims only (no images/videos)

Messaging Platforms (currently Instagram/Meta)

• Purpose: Deliver responses to you via DM
• Data Shared: Message content (fact-check results only)
• Privacy: Subject to the platform's own privacy policy (e.g. Meta's Privacy Policy)

Supabase (Database Hosting)

• Purpose: Persistent storage of structured claim intelligence and lifecycle history
• Data Shared: Claim text, verdicts, search content snippets, source metadata, post linkage
• Privacy: Subject to your Supabase project configuration and regional setup

Data Retention

Your Rights

Can the developer see my messages?

As the service operator, we technically have access to message content through the Instagram API and server logs. We do not read, review, or monitor individual conversations. Messages are processed automatically by AI and are not reviewed by humans unless required for abuse investigation or legal compliance.

Access & Deletion

Raw media is ephemeral and auto-deleted within 60 seconds. Structured claim records may persist in Supabase. To request deletion of your data, contact us at the email below.

Opt-Out

Stop using the bot at any time by:

• Blocking or unfollowing FactsOnly on your platform
• Deleting your conversation with the bot

Data Security

• All communication uses HTTPS/TLS encryption
• Media is processed in-memory when possible
• Temporary files are deleted with best-effort cleanup (finally blocks + timeout cleanup)
• Rate limit data is stored in Redis according to your hosting/deployment configuration
• Supabase service-role credentials are intended for backend-only use

Children's Privacy

FactsOnly is not intended for users under 13. We don't knowingly collect data from children. Instagram requires users to be 13+.

Changes to This Policy

We may update this policy. Changes will be posted here with an updated "Last Updated" date. Continued use after changes constitutes acceptance.

Legal Basis

If applicable in your jurisdiction (for example GDPR/UK GDPR), processing may rely on:

• Legitimate Interest: Providing fact-checking services you request
• Consent: By sending media to the bot, you consent to processing

This section is informational only and is not legal advice.

Limitations & Disclaimers

Not Professional Advice

• Results are for informational purposes only
• Not medical, legal, financial, or professional advice
• Verify important claims with qualified professionals

Accuracy

• We use AI and automated sources which may contain errors
• Always verify critical information independently
• Sources are provided for your own verification

Fair Use

• Content analysis is designed for transformative fact-checking use
• We don't republish or redistribute your content
• Permanent storage is limited to structured intelligence, not raw media

Contact

For privacy questions, data deletion requests, or concerns:

• Email: support@innovatechsolutions.tech
• GitHub: github.com/margarita26/FactsOnlyBot/issues

Compliance

This service is designed to align with:

• Instagram Platform Terms
• Meta Developer Policies
• Google Generative AI Terms
• General data protection best practices

Actual compliance depends on your deployment configuration, jurisdiction, and operational controls.