Privacy Policy — PageFlow

Last updated: October 31, 2026

PageFlow is a browser extension that helps you schedule and publish your posts to Facebook groups you are a member of, from your own browser using your already-open Facebook session. It is operated by an independent developer (Mohammed). This policy explains what we collect and how we use it.

1. Data stored on our server

• Account data: your email address and password. Passwords are never stored in plain text; only a salted one-way hash (PBKDF2) is kept.
• Session data: a sign-in token kept in the extension's storage on your device, and a hashed copy on our server.
• Sign in with Google (optional): if you choose "Sign in with Google", we receive only your email address from Google (with your consent) to create or access your account. We do not access Gmail, your contacts or files, and we do not store any Google access token.
• Uploaded images: images you attach to your posts (up to 1 MB) are stored temporarily and automatically deleted after 45 days.
• Subscription data: trial/subscription expiry date and license codes you redeemed.
• Password reset code: when you request a reset we store a hashed copy of a temporary code, which expires within one hour and is deleted once used.

2. Data that stays on your device only

Your group list (names and links), scheduled posts and publishing history are saved only in the extension's storage on your device and are never sent to our servers. They are removed when you uninstall the extension.

3. Facebook

The extension does not use Facebook Login or the Graph API, and we never receive any access token for your account or Pages. When you use the feature, the extension works inside your browser with your already-open Facebook session:

• When you press "Fetch my groups", it opens your groups page and reads the names and links of the groups shown.
• When you publish, it opens the group, types the post you wrote and presses "Post".

We do not read group content, other people's posts, your messages or your friends list, and the extension contains no tracking, analytics or advertising.

4. Extension permissions

• storage: keep your sign-in, group list, schedule and history on your device.
• tabs and scripting: open group pages and perform the posting you requested.
• alarms: run scheduled posts at their time (the browser must be open).
• identity: open the Google sign-in window when you choose it.
• facebook.com: access Facebook pages to read your group list and post in them.
• PageFlow server: sign-in, subscription and image upload.

5. Third parties

• Cloudflare: the service and database are hosted on Cloudflare Workers and D1. Cloudflare may log technical data such as IP addresses under its own policy.
• Facebook (Meta): the extension interacts with the Facebook website inside your browser only; your data there is governed by Meta's policies.

6. Retention and deletion

7. Security

We use HTTPS and store passwords hashed. No system is 100% secure, but we take reasonable measures to protect your data. Automated posting in groups is your responsibility and is subject to Facebook's terms.

8. Children

The service is not directed to anyone under 18 and we do not knowingly collect their data.

9. Changes and contact

We may update this policy; the last-updated date at the top will change accordingly. Questions: info@essentialsco1.shop