What to Post privacy
Updated October 13, 2026. What to Post is a content-planning tool hosted by ShahzadNest. Contact: theshahzadnest@gmail.com.
Your account and workspace
Email sign-in uses a one-use link that expires after 15 minutes. Account workspaces—including your profile, plans, post results, audience questions, and footage notes—are stored encrypted on our server so you can access them from multiple devices. A browser copy supports temporary offline work. Guest workspaces stay on the current device until you choose to sign in and import them. Original video files are not uploaded.
Instagram permission
Instagram connection is available only when app configuration and the required Meta approvals are complete. When you grant access, the tool can read your account identity, up to 30 recent posts, and available performance metrics. Reading audience comment questions is optional. The tool never publishes content, sends messages, or modifies your Instagram posts. Metrics unavailable from Instagram remain unknown.
AI generation
When you request AI plans, we send your creator profile, brief, selected recent post results, audience questions, and footage notes to OpenAI. Original video files and your Instagram access token are not sent. We request that generated responses are not stored as reusable response objects by the API; the provider's own applicable retention policies still apply. AI output may be inaccurate and should be reviewed before use. Server-side evidence lines use the post and question data you supplied, not invented performance figures.
Emails
Sign-in links are sent when requested. Weekly planning emails are off by default. If you opt in in Settings, the tool prepares next week's plans on Sunday morning in your selected time zone and emails you after successful generation. You can turn this off in Settings at any time. Email is delivered through the ShahzadNest Gmail connection.
Cookies and local storage
An essential HttpOnly session cookie authenticates requests and protects your account. Local storage keeps an offline copy of your workspace. No advertising tracker is required for this tool. Use a private device for confidential content. Downloaded backups remain under your control.
Retention and deletion
Sign-in sessions expire after 30 days. Magic links expire after 15 minutes. Workspace data remains until you delete it or delete your account. In Settings you can export a backup or permanently delete your account, server workspace, sign-in records, and connection tokens. Disconnecting Instagram removes access tokens and imported post/question data from the workspace. Meta-signed deletion requests remove the related Instagram data and connection; an Instagram-only sign-in account is also removed. Clear old offline copies and downloaded backups separately.
Sales and other manually entered data
Clicks, inquiries, and sales are optional figures entered by you. The tool does not automatically verify sales attribution or collect your store's customer payment data. Do not add other people's private or sensitive information to prompts or footage notes.
Security
Private keys and tokens are stored encrypted, are not returned to the browser, and are separate from your public portfolio. Requests that change account data require session verification. We use request limits and reject conflicting saves to protect access and prevent silent overwriting.