Leannoku · Permissions

Permissions we request

Leannoku requests six scopes from Meta. Each is explained in plain English below — what we do with it, why we need it, and the customer benefit. All six are submitted for Meta App Review.

Permissions Leannoku requests · 6 scopes

pages_show_list

List the Facebook Pages you manage.

Why we need it: So you can pick which Page to schedule posts to.

Customer benefit: Choose the exact Page in the connect flow — no guessing.

pages_manage_posts

Publish, edit, and delete posts on the Pages you select.

Why we need it: Core scope — this is how Leannoku posts on your behalf.

Customer benefit: Schedule once, publish at the right second across Pages.

pages_read_engagement

Read engagement metrics for posts we published.

Why we need it: To show the post status, likes, and comment counts back in the scheduler.

Customer benefit: See how each scheduled post performed without leaving Leannoku.

instagram_basic

Read your linked Instagram Business profile and media.

Why we need it: Required by Meta to identify which IG account a Page can publish to.

Customer benefit: We can publish to Instagram via the linked Page in one click.

instagram_content_publish

Publish images, videos, and carousels to your Instagram Business account.

Why we need it: Core scope for the Instagram half of the scheduler.

Customer benefit: Schedule Reels, single-image, and carousel posts to Instagram.

business_management

Identify which Business Manager owns the Pages and IG accounts.

Why we need it: So multi-brand operators can pick the right business context.

Customer benefit: Manage multiple brands in one Leannoku account cleanly.

How we minimise scope

We request only the six scopes listed above — nothing else.
We never request publish_to_groups, ads_management, read_insights, or other broad permissions.
You pick which Pages and Instagram accounts to connect. Pages you don't select are not stored.
You can revoke any scope at any time from Facebook → Business Integrations.

How access tokens are stored

All Facebook and Instagram access tokens are encrypted at rest with application-level keys (envelope encryption). They are decrypted in memory only when needed to publish or fetch engagement for a post you scheduled.

How long we keep tokens

Tokens are deleted within 30 days of channel disconnect or account closure. See /post/data-deletion for the full deletion process.

If you have concerns

Email [email protected]. Full privacy notice at /post/privacy.

Operator

Outspirations MB (operator of Leannoku)
Registry code: 305739215
Address: Alekniškio vs. 10, Širvintų r., Lithuania
Email: [email protected]