Access tokens are encrypted, not stored in plain text
When you connect a social account, the platform (Instagram, TikTok, Threads) never asks for your password: it generates an access token, a kind of temporary key that authorises specific operations without ever sharing your credentials. It's the same mechanism, called OAuth, that you use when you sign in to a site with "Continue with Google".
That token still needs protecting, because whoever gets hold of it can use it. On Carosell, access tokens are encrypted in the database: even in the event of unauthorised access to stored data, they're not readable in plain text. It's the minimum standard you should expect from any tool you trust with access to your accounts.
Disconnecting an account is a real revocation, not just a local one
Many tools, when you "disconnect" an account, simply delete the link from their own database: the token stays valid on the platform's side, and could in theory still be used. It's a difference few people check, but it matters.
On Carosell, disconnecting a social account also sends a revocation request to the platform itself (Instagram, TikTok or Threads): the token actually stops working, not just being used by us. You can do this at any time from settings, without having to write to anyone.
No publishing without your approval
The most concrete risk of a tool that publishes on your behalf is that it does so without you having seen it first. On Carosell, every carousel — idea, copy, graphics — lands in your approval board first. Nothing gets published on Instagram, TikTok or Threads without your explicit consent: the final decision is always yours.
Your data isn't sold or used for third-party advertising
The data we collect — brand, content, post results — serves a single purpose: making Carosell work for you, generating content consistent with your style and learning what works with your audience. It isn't sold to third parties or used for advertising targeted outside the service.
You can request deletion of your data
GDPR, the European data protection regulation, gives you the right to request deletion of your personal data at any time (the right to be forgotten). On Carosell you can exercise it by requesting deletion of your account and linked data: profile, generated content, publishing history.
We don't promise certifications we don't have: no ISO badge, no SOC2 label to show off. What we can guarantee are the concrete practices described above — encryption, real revocation, mandatory approval, the right to deletion — verifiable, not just claimed.