Grandma Rosie’s Recipes · Rosie’s Recipe Publisher

Privacy policy

Updated October 31, 2026

This policy explains how Grandma Rosie’s Recipes uses information through Rosie’s Recipe Publisher, including its Instagram connection and webhook receiver. The service is operated by the owner of Grandma Rosie’s Recipes. For privacy questions, contact [email protected].

Anonymous website statistics

Our websites count visits, page views, broad traffic sources, button clicks, download clicks, and on-site video starts. We save the date, website, page category, action, broad source category, and public button, recipe or video title. This feature does not save IP addresses, full referring URLs, names, email addresses, tracking cookies, or persistent visitor identifiers. A browser-tab session uses session storage and expires after 30 minutes of inactivity. Activity records are kept for up to 90 days and removed on the next recorded event. Browser Do Not Track and Global Privacy Control are respected. Hosting providers may independently process technical request data to operate and secure the site.

Information we process

• For Instagram accounts connected by the operator: account IDs, usernames, authorization dates, granted permissions, access-token expiration dates, and access tokens needed to perform authorized actions.
• For Instagram comments delivered to the service: comment text and IDs, the associated post or Reel ID, commenter usernames and Instagram-scoped IDs when Meta provides them, and delivery times.
• For incoming Instagram DMs used to establish an interaction: sender and recipient account IDs, message IDs, and timestamps. The webhook receiver stores this message metadata, not DM text. Follower checks can retrieve whether the interacting account follows Rosie; unavailable results remain unknown.
• Configuration and security information needed to verify Meta notifications and protect the connection, plus limited operational status and error information.
• Recipe content, uploaded dish photographs and publishing preferences entered by the operator. Private administration uses the operator’s signed-in account identity for access control.
• Information you choose to send when contacting us, such as your email address and the details of your request.

We do not request your Instagram password. Connected accounts authorize access through Meta. Hosting and platform providers may process technical request information, including IP addresses and browser information, to deliver and secure their services.

How information is used

We use this information to operate the recipe service, maintain authorized Instagram connections, receive and display comment notifications, identify requested keywords and spelling variations such as “recipe” or “recip,” associate Reels with recipes, diagnose delivery problems, protect the service, and respond to privacy requests.

The webhook receives comments and can match recipe-request keywords, including configured spelling variations. When automatic delivery is enabled by the operator and recipe links are public, new matching comments on Rosie’s current and future Instagram posts and Reels can trigger one private recipe reply with an invitation to follow Rosie. No follower check is required for this delivery. Recipes are public. Old comments are excluded. After Meta confirms the private recipe reply was sent, the service posts “Sent! ❤️” as a public reply to that comment. When enabled by the operator, new matching comments on current and future posts and Reels on the connected Facebook Page trigger a private recipe reply, followed by a public “Sent! ❤️” reply after confirmed delivery. Old comments are excluded. The operator may also authorize individual tests. Facebook Page comment IDs, text, names and scoped sender IDs, post IDs, delivery times, and delivery-attempt outcomes are processed for this delivery. Up to 100 recent Facebook comment records are retained; delivery-attempt records are retained to prevent duplicate sends. The operator may explicitly authorize individual test messages. Comment detection does not establish whether someone follows Rosie. The separate follower diagnostic can query Meta’s profile API using a recorded commenter’s ID. Meta may deny access; an unavailable result stays unknown. Follower diagnostics do not control recipe delivery.

Access and service providers

The recipe administration area and recorded webhook events are restricted to the operator. Public policy pages do not display comment records or connection credentials. We use Meta’s Instagram APIs and Sites hosting provided through OpenAI, with Cloudflare infrastructure, to operate the integration. These providers process information as needed to provide their services and under their applicable terms and privacy policies. We may disclose information when required by law or reasonably necessary to protect the service or others.

We do not sell Instagram data or use it for advertising profiles. Processing through hosting and platform providers may occur in countries other than your own.

Security and retention

Saved connection credentials and webhook comment records are encrypted by the application. Meta webhook signatures are checked before notifications are accepted. These safeguards reduce risk but do not guarantee absolute security.

The receiver retains up to 200 recent comment records, combining repeated deliveries of the same comment. Older records are removed as the limit is exceeded. This is a count-based limit, not a fixed deletion period. The receiver also retains up to 200 incoming-message metadata records. Delivery-attempt records are retained to prevent duplicate sends and diagnose delivery outcomes. Connection information and configuration remain stored while the integration is configured or until removed. Limited operational logs and backups may have separate retention managed by the hosting providers.

Your choices and deletion requests

You can request access to, correction of, or deletion of information held by this service by contacting [email protected]. Include the relevant Instagram username and enough detail to identify your request. We may ask for reasonable verification of account ownership. Do not send passwords, access tokens or app secrets.

Connected account owners can revoke the app’s authorization through Instagram’s app-access settings. Revoking access stops future authorized access but does not by itself remove previously stored records. For removal of those records, follow our data-deletion instructions. Deleting data from our service does not delete your Instagram account or comments held by Meta. Requests are reviewed and handled subject to applicable requirements, including any necessary security or legal retention.

Policy updates

Changes to the service’s data handling will be reflected on this page with an updated effective date. Contact us using the email above if you have questions.