CodeKeeper (“CodeKeeper by The Social Station”) is a service of The Social Station, LLC (“we”, “us”). CodeKeeper helps businesses securely store and share access to their Instagram accounts with their team. This policy explains what information we collect, how we use it, and the choices you have. Questions? Email us at alex@thesocialstation.com.

• Account information — your name, email address, and a password (stored only as a secure hash, never as plain text).
• Business and team information — the businesses, Instagram account usernames, and team members you add.
• Credentials you choose to store — Instagram passwords and two-factor setup keys you save in CodeKeeper are encrypted at rest and revealed only to your authorized team members through explicit, logged actions.
• Phone numbers and messages — the dedicated phone numbers we provision for your Instagram accounts, and the verification/login messages those numbers receive.
• Your mobile number (optional) — if you choose to have login codes texted to your own phone, we store the number you verify.
• Screenshots you share (optional)— if you use the built-in screen help, the screenshot you upload is processed to guide you through the screen you're on.
• Usage and audit records — actions taken in CodeKeeper (like revealing a credential) are logged so account owners can see who accessed what, and when.
• Billing information — payments are processed by Stripe. We never see or store your card details.

We use your information only to run CodeKeeper: to operate your workspace, deliver login and verification codes to the right people, keep your account secure, provide support, and bill for the service. We do not sell your personal information, and we do not use it for third-party advertising.

If you opt in, CodeKeeper sends text messages for exactly two purposes: a one-time code to verify your mobile number, and copies of Instagram login codes you have asked us to relay to your phone.

You opt in by entering your own mobile number in the CodeKeeper app and confirming it with the code we text you. Only verified numbers receive messages. Message frequency varies with how often you sign in — typically a few messages per week. Message and data rates may apply.

You can opt out at any time by replying STOP to any message, or by removing your number in the app. Reply HELP for help, or email alex@thesocialstation.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with service providers acting on our behalf solely to deliver the messages you requested.

We share information only with the service providers that make CodeKeeper work, and only what each needs to do its job: Twilio (phone numbers and text delivery), Mailgun (email delivery), Stripe (payments), Anthropic (processing screenshots you submit to the screen-help feature), and our hosting providers. We never sell your information, and nobody outside your own team can see the credentials you store.

Stored credentials and two-factor keys are encrypted at rest using envelope encryption; passwords are hashed with a modern algorithm; all traffic is encrypted in transit; and every credential reveal is access-controlled and recorded in your workspace's activity log.

We keep your information while your account is active. When you delete an Instagram account from CodeKeeper, its stored credentials are erased and its dedicated phone number is released. If you want your whole workspace deleted, email us and we will remove it.

You can update your name, email, and mobile number on your profile page at any time, turn text forwarding on or off, or remove your number entirely. Account owners and admins control which team members can access each business.

If we make meaningful changes to this policy, we will update this page and note the new date at the top. Significant changes will be communicated in the app or by email.