Back to Soccial AI

Privacy Policy

For the Givaway iOS app, soccial.ai and the Instagram Giveaway Picker · Last updated: November 8, 2026

1. Summary

  • We don't sell your data, use it for advertising, or track you across other companies' apps and websites.
  • In the Givaway app, your Instagram access token is kept in your iPhone's Keychain. Our servers handle it only to get and renew it with Instagram and to confirm which account is signed in, and we don't save it in our database.
  • In the Givaway app, Options > Delete account deletes what we keep for your Instagram account, and Options > Delete soccial.ai account deletes your soccial.ai account. Section 8 explains what each removes and what we keep.

2. Who we are

GIVAWAY LLC ("we", "us"), of Hurricane, Utah, USA, makes the three products this policy covers:

  • Givaway, an iPhone app that picks random winners for Instagram giveaways from a post's comments. You sign in with an Instagram Business or Creator account.
  • Soccial AI, an AI assistant at soccial.ai for running giveaways and related Instagram, Facebook, X, CRM and Shopify work. It has its own accounts.
  • Instagram Giveaway Picker, a website at www.instagramgiveawaypicker.com that picks random winners for Instagram giveaways from a post's comments. You sign in with an Instagram Business or Creator account.

You can link a soccial.ai account to Givaway, and one subscription then covers both products. Section 3 covers the Givaway app, section 4 covers soccial.ai, section 4a covers the Instagram Giveaway Picker, and the rest applies to all three.

3. Data the Givaway app collects

The app asks for no device permissions: it doesn't access your location, contacts, photos, camera or microphone. It has no advertising code and doesn't track you across other companies' apps or websites.

  • Your Instagram account. When you sign in, Instagram sends a one-time code back to the app through a small page we host on Google's Firebase Hosting. Our server exchanges the code with Instagram for an access token and passes the token to the app, which keeps it in your iPhone's Keychain. The app uses the token to read your profile, posts, comments and post view counts directly from Instagram. Before the token expires, the app sends it to our server to renew it, and requests to our API, including plan checks for saved profiles, include it so we can confirm with Instagram which account it belongs to. We don't save the token in our database. We store your Instagram user ID, username, display name, follower, following and post counts, account type, and when and on which platforms you signed in, with the app version, device model and iOS version.
  • Posts, comments and winners. To pick winners, the app reads your posts and their comments, including commenters' usernames and comment text, on your iPhone. Comments and winners aren't sent to our servers. Giveaway results and entry rules are saved on your iPhone. If you use "Add to story", the app gives Instagram an image of the result, which shows the winner's username.
  • GoHighLevel (Premium and up). Connecting GoHighLevel requires a linked soccial.ai account. Our server completes the GoHighLevel sign-in and stores its tokens (encrypted), your GoHighLevel user ID, and the location's ID and name with your soccial.ai account. The app reads your forms and their submissions, including entrants' names, email addresses, phone numbers and answers, from GoHighLevel and checks entries on your iPhone. The app may also save a record of the form, with your Instagram user ID, in our database. Until October 11, 2026, it also saved entrants who gave an email address, with their form submission data, so orders from a connected Shopify store could be matched to them. We keep those entrants, and still match new orders against them, until you delete them (section 8). New entrants aren't stored. Because the connection belongs to your soccial.ai account, Soccial AI's chat can use it too (see section 4).
  • Messages you send to entrants. With GoHighLevel connected, you can email, text or Instagram-message entrants and winners, and add them as GoHighLevel contacts. These go from your iPhone through your GoHighLevel account, and we don't store their content. If your GoHighLevel location was set up through Givaway's former agency program, it sits in an agency account we administer.
  • Shopify (Premium and up). Connecting Shopify also requires a linked soccial.ai account. We store your store's access token, and Shopify sends our server every new, paid and updated order from your store, with the customer's details. We check each order against the giveaway entrants we stored (see GoHighLevel above) and keep only matches: the order number, name, date, total, currency, items, discount codes, sales channel and referring site, the customer's email address and phone number, the matched entrant and how they matched. The app shows your store's name and these results.
  • Purchases. Plans are App Store subscriptions. Apple handles payment, and we never see your card details. RevenueCat manages subscriptions for us. While you're signed in, it receives your Instagram user ID, and its requests include your purchases and renewals, device model, iOS and app version, preferred languages, App Store country, and the identifier Apple assigns to our apps on your device. We store your plan, product, renewal status and expiry date. Older Givaway web subscriptions were billed by Stripe (see section 7).
  • App activity. The app records events such as screens viewed, sign-in results, paywall views, purchases (product, price, currency and App Store transaction ID), errors and features used, with the app version, device model, iOS version and a random ID for each app session. Events are linked to your Instagram user ID when you're signed in. We use them to understand how the app is used and to fix problems.
  • Plan checks. When the app checks your plan, our server logs the check with your IP address, the app's version details, the account identifier it used and the plan it found. These logs are deleted after 30 days.
  • Crash reports. Sentry receives crash and error reports and app freezes from every launch, a short summary of each app session, and performance measurements from a sample of launches. They include device, iOS and app details, a random installation ID, a hashed device identifier, and the addresses of recent network requests, which can contain post and account IDs. We don't attach your name or account to them.
  • A soccial.ai account. You need one to connect GoHighLevel or Shopify; otherwise it's optional. In Options you can create one with your email address and a password or Sign in with Apple, or link an existing one by signing in to it or with a 6-digit code we email you. For a code, we keep a hashed copy with your Instagram ID and username, IP address and device details until 7 days after it expires. We keep a record of each link, which can include the IP address and device details. Section 4 describes the account itself.
  • Google sign-in (earlier versions). If you signed in with Google in an earlier version, the app keeps that sign-in in your Keychain and renews it with Google. Any spreadsheet it read stayed on your iPhone.

4. Data soccial.ai collects

  • Account. Your email address and, optionally, your name. With Sign in with Apple, Apple provides your email address, which can be a private relay address, and sometimes your name. With Google, we receive your name, email address and profile picture. Supabase, our sign-in provider, stores passwords in hashed form. Our database records each signed-in session's IP address and browser, and keeps an audit log of sign-ins and account events with IP addresses.
  • Payments. Your plan, credits and usage, auto-recharge settings, and Stripe customer and subscription IDs. Stripe handles card details. Card numbers never reach our servers, and we don't store card details.
  • Connected accounts. When you connect Instagram, Facebook Pages, X, GoHighLevel or Shopify, we store its access tokens, and refresh tokens where the service issues them, encrypted (AES-256-GCM). We store them with the connected account's name, ID and basic details (such as its follower count or store domain), and when the connection expires. For GoHighLevel we also store the permissions you granted. Connecting Instagram also creates or updates a profile record for that Instagram account, the same record the Givaway app uses (section 3): its user ID, username, display name, follower, following and post counts, account type, when you last used it, and which of our products you've used it on. Each chat while Instagram is connected updates it. This record isn't part of your soccial.ai account, so disconnecting Instagram or deleting your soccial.ai account doesn't remove it (see section 8).
  • Activity from connected accounts. Once an Instagram account or Facebook Page has been connected, Meta sends us events about it, such as comments, messages and mentions, including other people's usernames and messages. We store every event we receive. Events keep arriving until our access is removed in Instagram or Facebook, even after you disconnect or delete your account. X sends similar events, such as new followers, unfollows, direct messages and Spaces you start, for X accounts you connect, and we keep each one for 30 days. Deleting your soccial.ai account doesn't stop them, so disconnect X in Soccial AI first. Direct messages can keep arriving even after you disconnect, until you also remove Soccial AI under Connected apps in X. Shopify sends us new and updated orders from every store where our Shopify app is installed, until the app is uninstalled in Shopify, even after you disconnect the store in Soccial AI. We keep the orders that used a discount code Soccial AI created (the order ID and name, the code, net amount, currency, fee and payment status), including orders placed after you disconnect, and the discount codes we created. Your automations, their runs and scheduled actions are stored too.
  • Chats. Your messages, the AI's replies, images you upload and images it generates, and results from tools the AI uses. Those results can include other people's data, such as contacts, customers, commenters and people who message you, and the public Instagram and X profiles and posts the AI looks up. Uploaded and generated images are stored at unlisted links that anyone with the link can open.
  • Voice. Dictation uploads your recording to our server, which sends it to xAI for transcription. In voice mode, your browser usually streams your audio directly to xAI instead. If your browser doesn't support that, or the connection fails or drops, voice mode sends each spoken turn through our server to xAI, the same way as dictation. To read replies aloud, we send the reply text to xAI. Transcripts are saved as chat messages.
  • Usage. How much you use chat, images and voice, and the AI model and cost of each request.
  • Devices and account activity. We record each browser, and each Givaway app with a linked account, that signs in: the device type and name, browser or app details, and IP addresses. We email you when a new device signs in. We also log account events such as new devices, Instagram links, device removals, connections and plan changes, with the IP address and browser for new devices and Instagram links.
  • Cookies and browser storage. soccial.ai uses cookies to sign you in and keep you signed in, which can last up to 400 days, and short-lived cookies while you connect Shopify or X (up to 10 minutes) or GoHighLevel (up to 30 minutes). Your browser also stores a device ID that it sends us every few minutes while you're signed in, plus unsent chat drafts and display settings. There are no analytics or advertising cookies.

4a. Data the Instagram Giveaway Picker collects

The website at www.instagramgiveawaypicker.com has no payment or advertising code, and it loads no analytics or tracking scripts. If your Instagram account has no profile picture, the Manage Accounts page shows a placeholder image hosted on Imgur, so Imgur receives your IP address and browser details.

  • Your Instagram account. When you sign in, our server exchanges Instagram's one-time code for an access token that lasts about 60 days, and stores it in a cookie in your browser. Your browser sends the cookie with each request, and our server uses the token to read your profile, posts and comments from Instagram. We don't save the token in our database. Signing in creates or updates the profile record the Givaway app uses (section 3) and adds an entry to your sign-in history with your IP address and your browser's user agent, which names your browser and operating system.
  • Posts, comments and winners. To pick winners, our server reads your posts and their comments, including commenters' usernames and comment text, from Instagram and passes them to your browser, which picks the winners. We don't save comments or winners in our database. Your browser keeps the winners you pick (up to 100), your entry rules and the Instagram accounts you've signed in with in its local storage.
  • GoHighLevel. If you connect GoHighLevel on the website (it calls this Givaway Premium), its access and refresh tokens, your GoHighLevel user and location IDs and the permissions you granted are kept, unencrypted, in your browser's local storage, not in our database. This connection is separate from one made in Givaway or on soccial.ai. Your browser sends the access token to our server in the web address of each GoHighLevel request, along with commenters' usernames when it checks entries. To check entries, our server fetches your form's submissions from GoHighLevel, including entrants' names, email addresses, phone numbers and answers, and passes them to your browser, which keeps the entrants' Instagram usernames in local storage. When you connect, GoHighLevel also receives your Instagram user ID.
  • Server logs. Our server's logs, kept for about 1 day, include your Instagram username and user ID and, each time you sign in, your whole profile record, including your follower counts and plan and subscription details. When you open a post, they also include the post's details, its comments and your access token. When you check entries, they include entrants' usernames and one entrant's full form submission, and when a request is rate limited, your IP address.
  • Rate limiting. To limit abuse, our server sends your IP address to Upstash with most requests, even before you sign in. Upstash counts requests for each IP address, and the counts expire within about 2 days. It also keeps an hourly tally of each IP address's allowed and blocked requests, with no expiry.
  • Cookies and browser storage. Signing in sets four cookies: your Instagram access token, user ID, username and the token's expiry date. They last as long as the token, about 60 days, and only our server can read them. Log out deletes the token, user ID and username cookies. Removing an account under Switch Account also deletes it from the accounts your browser keeps, and disconnecting GoHighLevel removes its details from local storage. Everything else the website keeps there stays until you clear the site's data in your browser. There are no analytics or advertising cookies.

5. Other people's data

Givaway, Soccial AI and the Instagram Giveaway Picker handle data about people who aren't our users, including giveaway entrants; people who comment on, react to, message, mention, follow or unfollow a connected Instagram, Facebook or X account; people whose public Instagram or X profiles and posts Soccial AI looks up at a user's request; Shopify customers; and CRM contacts. We process it on behalf of the user who ran the giveaway or connected the account, to provide our services to them, and that user is responsible for telling those people how their data is used and for having any permission the law requires. The exception is events about an Instagram account or Facebook Page that is no longer connected, because the user disconnected it, switched to another account or deleted their soccial.ai account. Instagram and Facebook keep sending these until our access is removed (section 4). We store them, and the events we already had when an account is deleted, without linking them to anyone. We don't use them, and we keep them (section 9). If your data reached us this way, email support@givaway.com and we'll delete it.

6. How we use data

  • To run the products: signing you in, showing your posts, picking winners, checking entries, matching orders, and carrying out the chats, integrations and automations you ask for.
  • To manage subscriptions and billing across Givaway and soccial.ai, including credit top-ups and auto-recharge, and to attribute Shopify sales to Soccial AI discount codes and calculate any fee on them.
  • To keep accounts secure: confirming sign-ins, limiting abuse, recording devices and sending security emails.
  • To send service emails, such as link codes, digests of failed automations and reminders before a connection expires.
  • To fix problems and improve the products, using our own app activity data, crash reports and logs.
  • To answer support requests and comply with the law.

We don't sell personal data, use it for advertising, share it with data brokers, or train AI models on it.

7. Who receives data

We use these service providers:

  • Supabase — our database, sign-in, file storage, and the functions that get and renew Instagram tokens.
  • Vercel — hosts soccial.ai, the Instagram Giveaway Picker and our API servers, which run in the United States, stores chat image uploads, and resizes and caches the Instagram images the Instagram Giveaway Picker shows.
  • Upstash — rate limiting for the Instagram Giveaway Picker, which sends it your IP address (section 4a).
  • RevenueCat — subscription management for Givaway: App Store subscriptions, and older Givaway web subscriptions billed by Stripe. For those web subscriptions, our server sends RevenueCat your Instagram user ID and your Stripe customer and subscription IDs.
  • Sentry — crash and error reports and session summaries from the Givaway app and soccial.ai, performance measurements from a sample of Givaway app launches, and browser security reports from soccial.ai.
  • Resend — account and service emails.
  • Stripe — payments on soccial.ai and older Givaway web subscriptions.
  • xAI — the AI models behind Soccial AI's chat, images and voice. Each chat request includes details of your connected accounts (such as usernames and Page and store names), your messages and attachments, and the results of tools the AI uses, such as data from your connected accounts, public Instagram and X profiles and posts it looks up, and your automations and their run history, which can include other people's data. When your browser streams voice audio directly to xAI, xAI also receives your IP address and browser details. The Givaway app itself sends nothing to xAI, but accounts you connect in Givaway, such as GoHighLevel, are also available to Soccial AI's chat.
  • Google — Firebase Hosting passes Instagram's one-time sign-in code to the Givaway app, and Google Workspace handles our email.

The software kits built into the Givaway app (from RevenueCat, Sentry, Supabase and Google) send data only to those companies. Service providers that receive personal data from us, including through those kits, must protect it at least as well as this policy does. They may use it only to provide their services to us and for their own security, fraud prevention and legal obligations.

Services you choose to use process data under their own terms and privacy policies: Instagram and Facebook (Meta), including when you share a result to your Instagram story; Apple (the App Store and Sign in with Apple); Google (Sign in with Google); Shopify; GoHighLevel; and X. Some email templates in the Givaway app load images from Cloudflare and Unsplash, which receive a recipient's IP address and device details when the email is opened.

We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business, in which case this policy continues to apply.

8. Deleting your data and other choices

  • Delete account (Givaway). In the Givaway app, open Options > Delete account. This deletes what we keep for the signed-in Instagram account: its profile record (including any soccial.ai created when you connected Instagram there), sign-in history, app activity, plan records, giveaway records and entrants, Shopify connection and matched orders, and account links. It also deletes your customer record at RevenueCat, then signs the account out of that iPhone. If the account is still signed in on another device, or connected on soccial.ai, using it there creates new records, and so does signing in to the Instagram Giveaway Picker. A linked soccial.ai account keeps its own records, including its link history, devices and GoHighLevel connection, until you delete it. Delete account doesn't cancel an App Store subscription: cancel it in iPhone Settings > your name > Subscriptions.
  • Delete soccial.ai account. When the Givaway app is signed in to soccial.ai, open Options > Delete soccial.ai account. If you created the account on soccial.ai, sign in to it from Options first, with its email and password, or with Sign in with Apple if you signed up with Apple. If you signed up with Google, first set a password on soccial.ai, then sign in from Options with your email and that password, or email us as described below. This deletes the account and its data: profile, chats (except images you uploaded to them), generated images, connected accounts, automations, devices, activity log, usage and credits. Images you uploaded stay at their links, so to have them removed, email support@givaway.com with their links before you delete the account. It revokes Sign in with Apple, and ends a web plan at the end of its billing period without a refund. It doesn't cancel an App Store subscription, and records kept by Instagram account stay until you also use Delete account.
  • Without the Givaway app. soccial.ai doesn't have a delete button yet. Email support@givaway.com from your account's email address, and we'll delete your account and confirm when it's done.
  • Instagram Giveaway Picker. The website has no delete button. To delete the profile record and sign-in history we keep for your Instagram account, use Delete account in the Givaway app, or email support@givaway.com with your Instagram username and we'll delete them. Log out deletes the token cookie from your browser, and clearing the site's data in your browser removes everything else the website keeps there, including GoHighLevel tokens.
  • Removing our access. Disconnecting an account, or deleting your data, removes the tokens we store but not our apps' access on the other service. To remove that, in Instagram remove Givaway or Soccial AI under Apps and websites, which also covers the Instagram Giveaway Picker; in Facebook, under Business integrations; in X, under Connected apps; and in Shopify or GoHighLevel, uninstall our app. If you signed in with Google in an earlier version of Givaway, that sign-in still gives Givaway read-only access to your Google Sheets and Drive, although this version doesn't read them. The app can't sign out of Google, and deleting your data or the app doesn't remove that access. To remove it, and to remove Sign in with Google for soccial.ai, open your Google Account and remove our access under your connections to third-party apps and services.
  • Signing out. Options > Log out of Instagram switches the app away from the account but keeps it, with its token, as a saved profile. The app still uses a saved profile's token: each time the app starts, it checks the account with Instagram and asks our server for its plan, and the sign-in screen asks for the plan of each profile it shows. Our server confirms the token with Instagram and logs these plan checks as section 3 describes. To remove saved Instagram accounts and their tokens from your iPhone, tap … on the sign-in screen, then "Remove profiles from this device". This removes every saved profile at once.
  • Connections and chats. Disconnecting Shopify in Givaway, or any connection on soccial.ai, deletes its stored tokens. A GoHighLevel connection made in Givaway is stored with your soccial.ai account, and the Givaway app can't remove it. You can disconnect it on soccial.ai while your soccial.ai plan is Premium or higher. Otherwise, use Options > Delete soccial.ai account in the Givaway app, which deletes its connected accounts, or email support@givaway.com and we'll delete it. Deleting a conversation on soccial.ai deletes its messages, but not the images uploaded or generated in it.
  • On your iPhone. Deleting the app removes its giveaway results, entry rules and cached images. What the app keeps in the iPhone Keychain stays after the app is deleted, and the app can use it again if you reinstall: saved Instagram profiles and their tokens; the GoHighLevel details saved for each Instagram account, including its access token and entrants' Instagram usernames; each account's Shopify store; and your soccial.ai sign-in and link. "Remove profiles from this device" removes only the Instagram profiles and their tokens. Delete account also removes the GoHighLevel, Shopify and link details saved for that Instagram account, and Delete soccial.ai account signs the app out of soccial.ai; the app has no other soccial.ai sign-out.
  • Your other rights. You can ask for a copy of your data, or for us to correct or delete it, by emailing support@givaway.com. Section 13 covers the EEA and UK.

Most deletions take effect immediately. Some copies last longer: logs on our servers at Vercel about 1 day, backups up to 7 days, results of actions the AI took in your chats (cached briefly so an action doesn't run twice) up to 2 days, plan-check logs and X events up to 30 days, logs at Supabase (database, API request and function logs) about 90 days, crash reports up to 90 days at Sentry, and copies our providers keep under their own terms, such as up to 30 days at xAI. Section 9 lists the records we keep after deletion.

9. How long we keep data

  • Most data is kept until you delete it with the options in section 8. That includes your Instagram account record, sign-in history, app activity, giveaway entrants, matched Shopify orders, chats, connected accounts and device records.
  • Plan-check logs and X events are deleted after 30 days, account-link codes 7 days after they expire, cached results of actions the AI takes in chat after 1 to 2 days, and rate-limit records, which include IP addresses, after 1 to 3 hours, or, for the Instagram Giveaway Picker's request counts, within about 2 days.
  • Logs on our servers at Vercel are kept for about 1 day, backups for up to 7 days, logs at Supabase (database, API request and function logs) for about 90 days, and crash and error reports at Sentry for up to 90 days.
  • We keep these indefinitely, including after deletion: billing and subscription records (including invoices at Stripe), complimentary plan records, Shopify app install records (with the email address, IP address and device details), sign-in audit logs (with email and IP addresses), records of Meta deauthorization and deletion requests, identifiers we use to avoid handling an X post twice, and the events we receive from Instagram and Facebook. App activity recorded while no one was signed in isn't linked to anyone and is kept too, and so are Upstash's hourly tallies of the IP addresses that reached the Instagram Giveaway Picker's server.
  • Images uploaded to soccial.ai chats aren't deleted, even when you delete your account. Email support@givaway.com with their links, before deleting your account, to have them removed.

10. Security

  • Traffic to our servers uses HTTPS, and our database and its backups are encrypted at rest.
  • Tokens for connections made on soccial.ai, and for GoHighLevel connections made in Givaway, are encrypted with AES-256-GCM. Shopify store tokens for connections made in Givaway are stored without this encryption.
  • The Givaway app keeps your Instagram token in the iPhone Keychain, and we don't save it in our database.
  • The Instagram Giveaway Picker keeps your Instagram token in a cookie that only our server can read, and GoHighLevel tokens unencrypted in your browser's local storage. We don't save either in our database, but our server logs can include your Instagram token for about 1 day.
  • Webhooks from Stripe, Shopify, GoHighLevel, X and RevenueCat, and Meta webhooks to soccial.ai, are verified before we process them.
  • If a data breach affects you, we'll tell you as the law requires.

11. Children

Givaway, Soccial AI and the Instagram Giveaway Picker are business tools, not directed to children under 13, or under the age of digital consent where you live (up to 16 in some EEA countries). We don't knowingly collect children's data. If you believe a child has given us data, email support@givaway.com and we'll delete it.

12. Where data is processed

We're based in the United States. Our database is in the United States, and our API servers run there. Some requests are handled first by our providers' global networks, and the functions that handle Instagram sign-in may run in the region nearest you. Our service providers, including xAI, may process data in the United States and other countries. If you use our products from outside the United States, your data is transferred to the United States.

13. If you're in the EEA or UK

We process your data to provide the services you ask for (performance of a contract), for our legitimate interests in keeping them secure, supporting them and improving them, to meet legal obligations, and with your consent where we ask for it, such as when you connect an account. You have the right to access, correct, delete or receive a copy of your data, to object to or restrict some processing, to withdraw consent, and to complain to your data protection authority. Email support@givaway.com to use these rights.

14. Changes to this policy

We may update this policy. We'll post changes here and update the "Last updated" date, and for significant changes we'll also email soccial.ai account holders.

15. Contact

Email support@givaway.com with questions, requests or concerns. GIVAWAY LLC, Hurricane, Utah, USA.