Privacy Policy

Last updated: August 26, 2026

The Short Version

• sfeed keeps encrypted platform credentials on its hosted control plane. The CLI stores only a sfeed identity and safe destination metadata.
• The CLI sends anonymous telemetry by default. You can turn it off with sfeed telemetry off or SFEED_TELEMETRY=0. It never sends post content, media, tokens, account IDs, or file paths.
• You can report a problem from the CLI. sfeed report sends the message you write, optional contact email, command context, CLI version, OS, and Node version.
• The CLI checks for updates. In interactive terminals, it checks signed release metadata on sfeed.dev at most once per day and asks before updating.
• The website uses Google Analytics. We use it only to understand web traffic on sfeed.dev.
• The former launch notification list is closed. Historical signup records remain covered by this policy and can be deleted on request.
• We don't sell your data.
• Immediate and scheduled provider calls use the hosted service. Provider credentials are never returned to the CLI.

1. What sfeed is

sfeed is a CLI tool, MCP server, and hosted publishing control plane that posts to Facebook Pages and Instagram on your behalf.

sfeed is made and operated by Nemantic. You can learn more at nemantic.com.

2. Authentication

When you run sfeed auth facebook connect or sfeed auth instagram connect, your browser opens so you can approve access for that platform. sfeed stores the resulting provider credential encrypted on the hosted control plane.

1. You sign in to Facebook or Instagram and approve access
2. sfeed exchanges the authorization code on the server
3. The encrypted connection can then be used for immediate and scheduled posting

3. What we store

On your machine (always):

• Your sfeed hosted identity and safe destination metadata
• Your CLI telemetry preference and anonymous telemetry ID

In the hosted service:

• Encrypted Facebook and Instagram provider credentials and destination metadata
• Scheduled post data needed for hosted scheduling
• Uploaded media staged temporarily for publishing and previews
• The billing state needed to manage a hosted scheduling subscription
• Anonymous CLI telemetry events, unless you turn telemetry off
• Problem reports you send with sfeed report
• Automatic crash reports when telemetry is enabled
• Your email address, signup source, and consent record if you joined the former launch notification list

Provider access tokens are not stored in the CLI's local auth file and are not returned by hosted APIs.

4. Hosted scheduling

When you schedule a post with sfeed post "content" --at "2026-04-01T09:00:00Z", sfeed keeps the information needed to publish that post later.

If you post immediately, the hosted service receives the post content and media references needed to perform that request. It does not create a scheduled-post row for later delivery.

When you list, read, edit, or delete a published Facebook Page post, the hosted service retrieves or changes that post for the selected Page. Read results are returned to the CLI or MCP client and are not copied into a separate hosted post-history table.

5. Credential security

Provider credentials are encrypted at rest and are decrypted only inside the hosted Worker when sfeed needs to validate, refresh, or use them. CLI and MCP responses contain destination metadata, not provider credentials.

6. Third-party services

• Facebook and Instagram Graph APIs -- to connect accounts and publish on your behalf.
• Stripe -- processes payments for hosted scheduling subscriptions. When you subscribe, Stripe receives your email and payment details directly. We never see or store your card number. Subject to Stripe's privacy policy.
• Google Analytics, used on the sfeed.dev website to understand web traffic. It is not part of the CLI.
• sfeed.dev, used by the CLI to check for newer signed release metadata.
• PostHog, used for anonymous CLI telemetry unless you turn it off.

7. CLI telemetry and problem reports

Anonymous CLI telemetry is enabled by default. You can change this with sfeed telemetry on or sfeed telemetry off. You can also set SFEED_TELEMETRY=0 to disable telemetry from the environment.

When telemetry is enabled, sfeed sends command usage information such as command name, CLI version, operating system, Node major version, whether a post was scheduled, whether media was included, and the error type when a command fails. It does not send post content, media, tokens, account IDs, page IDs, account names, file paths, or billing details.

When you run sfeed report "what went wrong", sfeed sends the message you write, optional contact email, command context, CLI version, OS, and Node version. Do not include tokens, auth codes, payment details, or private post content in the message.

When telemetry is enabled, uncaught CLI crashes send an automatic crash report. Crash reports include the crash message and stack. Before sending, sfeed redacts bearer tokens, obvious token fields, and your home directory path.

When you run an interactive terminal command, sfeed checks sfeed.dev for newer signed CLI release metadata at most once per day. Set SFEED_UPDATE_CHECK=0 to disable update checks.

8. Former launch notification list

The launch notification list is closed and sfeed no longer accepts new signups. If you previously joined it, the signup recorded your email address, form source, consent version, and signup timestamps.

The list did not create a sfeed product account and was never required to install or use sfeed. We do not sell the list. To delete your historical signup record, contact legal@nemantic.com.

9. How to remove sfeed completely

1. Revoke each provider you used: sfeed auth facebook revoke and sfeed auth instagram revoke
2. Revoke Facebook access: go to Facebook Settings > Business Integrations, find sfeed, click Remove.
3. Uninstall sfeed by removing its managed install directory: rm -rf ~/.sfeed/bin.

Revoking one provider does not remove an independent connection to the other provider. Scheduled posts for disconnected destinations remain visible but cannot publish until the matching platform is reconnected.

Deletion instructions for Meta are also available at sfeed.dev/data-deletion.

10. The website

This website (sfeed.dev) serves static pages and uses Google Analytics to understand basic web traffic, like which pages are visited. The CLI does not include Google Analytics.

11. Changes

If this policy changes, the "Last updated" date at the top will change.

12. Contact

Questions about privacy: legal@nemantic.com