Simino Social
Security and trust
You are about to give a small company access to accounts that may be your livelihood. That deserves more than a reassuring sentence. Here is precisely what we can and cannot do, and how you can check it yourself.
1. We never see your password
When you connect an account, we do not show you a Facebook or Google login form. We send your browser to Facebook or Google, on their own domain, over their own connection. You type your password there.
You can verify this yourself in two seconds: when the password field appears, look at the address bar. It will read facebook.com or accounts.google.com, with the padlock. If it ever says siminosocial.smartnetra.com while asking for a social password, close the tab and email us — that is not our product.
What comes back to us is an access token: a revocable key, scoped to the specific permissions you approved, that can be cancelled from your platform settings at any moment without changing your password.
2. Four barriers around your tokens
A token is still worth protecting. Each of these holds on its own:
- Encryption. Tokens are encrypted with AES-256-GCM before they are written down.
- Key separation. The encryption key lives in the server-side function environment, not in the database. A stolen database copy yields ciphertext and nothing else.
- Not on the public API. Credentials live in a private database schema that our public API does not expose. There is no request any user can make — including you, including us from the browser — that returns a token.
- No access policy at all. Row-level security is switched on for that storage with zero policies granting access, so ordinary application credentials are refused by default rather than by omission.
Tokens are decrypted only inside the function that is publishing your post, for the duration of that one call. They are never sent to your browser or your phone.
3. We ask for the narrowest permissions that work
Every permission below is required by a specific step in publishing. There are no spare ones held for a future feature.
Facebook and Instagram
| Permission | Why we need it |
|---|---|
pages_show_list | List the Pages you administer, so you can pick one. |
pages_read_engagement | Read a Page's name and picture, and obtain its publishing token. |
pages_manage_posts | Create the photo or video post you composed. |
instagram_basic | Identify the Instagram Business account linked to your Page. |
instagram_content_publish | Publish your media to that Instagram account. |
YouTube
| Scope | Why we need it |
|---|---|
youtube.upload | Upload the video you composed to the channel you chose. |
youtube.readonly | List your channels and read their title and thumbnail. |
Notice what is absent: no permission to read your inbox, your messages, your followers, your friends list, your ad accounts or your existing content library. We cannot read them because we never asked to.
4. Your media stays private
Uploads go to a private bucket. Nothing is public, indexed or listable, and access is scoped to your workspace.
Facebook and Instagram publish by fetching a URL rather than accepting an upload, so at publish time we mint a signed link that is unguessable and expires in two hours, hand it to Meta, and let it lapse. YouTube needs the bytes, so videos go from your device straight to Google’s upload endpoint without passing through us.
5. Every record is scoped to your workspace
Isolation between customers is enforced in the database, not in application code. Each table carries a row-level security policy tying every row to a workspace you belong to. A bug in a screen cannot leak another customer’s posts, because the query itself would return nothing.
6. You can leave at any moment
Disconnect an account in Simino Social and its stored token is deleted immediately. Or cut us off at the source, without visiting our site at all:
Full deletion of everything we hold is described step by step on Delete your data.
7. Who we are
Simino Social is operated by SIMINO LABTEST PRIVATE LIMITED, a registered Indian company at At Plot -1, Forest Park, Near Sishuvawan Square, Bhubaneswar, Odisha, India. It is built by Smartnetra, the company’s AI product studio, which is why this site is served from smartnetra.com. We are a named, addressable, incorporated entity — not an anonymous app listing.
8. Reporting a vulnerability
If you find a security problem, email SiminoSocial@smartnetra.com with the subject Security. Tell us what you found and how to reproduce it. We will acknowledge within two business days and keep you updated until it is closed. We will not pursue legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before disclosing.