Privacy

Privacy Policy

Last updated November 9, 2026. This covers the Tovaka Builds website, the @tovakabuilds Instagram account and Quedone, our social media scheduling app. Tovaka Builds is run by Tovaka Brands LLC in Portland, Oregon.

Website and Instagram

The sections from here to Quedone cover the website and @tovakabuilds. If you use the scheduler, read the Quedone section too.

What we collect

On the website. If you use the contact form, we receive your name, email address, website address and the message you write. We send it by email so we can reply to you.

Quedone waitlist. If you join the waitlist on quedone.com, we receive your email address and the time you joined. We use it only to tell you when you can sign up and to hold your founder spot. We do not sell it or share it. Ask us and we delete it.

On Instagram. When you comment a keyword (like APPROVE) on an @tovakabuilds post, Instagram sends us your Instagram user ID for our app, your username and the text of your comment. If you reply to the message we send you, we also receive your reply.

What we do with it

• Send you one private message with the link you asked for, and one short public reply under your comment.
• Keep a record that you asked, so you do not get the same message twice and so we can follow up if you reply.
• Answer questions you send us.

We do not sell your information. We do not use it for advertising, and we do not share it with anyone except the services below that help us run this.

Services that handle it

• Meta (Instagram): delivers comments and messages.
• Vercel: hosts the website and the tools behind it.
• Supabase: stores the records, including waitlist emails, in the United States.
• Resend: sends the contact form emails.

Delete your information

You can ask us to delete everything we hold about you at any time. Either:

• Send a direct message to @tovakabuilds on Instagram with the word DELETE, or
• Email michael@tovakabrands.com from the address you used, or tell us your Instagram username.

A person reads these requests and deletes the records by hand. We delete it within 30 days of your request and confirm when it is done.

How long we keep it

We keep these records for up to 12 months after your last message, then delete them. You can ask us to delete them sooner at any time.

What Instagram collects

What Instagram itself collects about you is covered by Meta's own policies, not this one.

Quedone

Quedone publishes posts to the social accounts a business connects. It is in an invite-only beta.

What the scheduler collects

• Your account. The email address you sign in with. Sign-in uses email links, so we never store a password. We also keep your invitation and which businesses you own in the app.
• Connected social accounts. Account and Page IDs, display names and handles, the permissions you granted, and access tokens. Tokens are encrypted with AES-256-GCM before they are stored.
• Content you schedule. Captions, images, videos, covers, posting times and which accounts each post goes to.
• Review activity. Approvals, edits and notes made on review links, and when they happened.
• Publishing records. What published, where and when, the platform's post ID, and any error a platform returned.
• Results. For posts the scheduler published: the counts a platform reports, a link to the live post, and each connected account's follower count once a day. Counts only, never who liked, commented or followed.
• Technical data. A sign-in cookie and standard server logs, such as IP address and browser type, used for security.

How the scheduler uses it

• To publish your posts to the accounts you choose, at the times you choose, after they are approved.
• To explain failures, renew connections, keep receipts and show you how posts did.
• To send service emails, such as sign-in links, approval requests and failure alerts.
• For security, support and to meet legal obligations.

We do not sell this information, share it for advertising, or use your content to train AI models. If you connect your own AI assistant, your conversations with it are between you and its provider. We only receive the drafts it sends.

Data from social platforms

We request only the permissions needed to publish, to confirm what was published, and to read the counts shown in Results. We use data from Meta (Instagram, Facebook, Threads), Bluesky and other platforms only to provide the scheduler to you, and in line with each platform's developer terms.

Services the scheduler uses

• Vercel: hosts the app.
• Supabase: database and file storage, in the United States.
• Resend: sends service emails.
• Pushover: optional push alerts to our team about failures, which can include a business or account name and the error.
• Meta, Bluesky and other platforms you connect: publish your posts, at your instruction.

How long the scheduler keeps it

• While your account is open, we keep what is needed to run it.
• When you disconnect a social account, its access token is erased right away and posts that have not started are canceled. Its post history is kept until you ask for a full deletion.
• Results are deleted automatically 90 days after they are collected.
• When you ask us to delete your data, we follow the steps on the data deletion page.

Access to production data is limited to the people who run the service. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

The scheduler is a tool for businesses and creators and is not meant for anyone under 18.

Children

This is not meant for anyone under 13. If you think a child has sent us information, tell us and we will delete it.

Changes and contact

If this policy changes, the date above changes. Questions about your information: michael@tovakabrands.com. Tovaka Brands LLC, Portland, Oregon.