# Meta App Review preparation — Postvertise

Internal preparation notes for Meta Business Verification and App Review.
Based on the production codebase as of the September 20, 2026 disclosure accuracy update.
Do not treat this document as Meta approval status.

`/docs/` is gitignored in this repository; this file lives under tracked legal materials.

## 1. App purpose

Postvertise is a creator–brand marketplace operated by RightBack.com LLC d/b/a Postvertise.

Creators create profiles, connect supported social accounts (Instagram, Facebook Pages, TikTok, X), and participate in brand campaigns. Brands discover creators, create campaigns, invite creators, review applications, and review deliverable URL submissions.

Postvertise retrieves authorized social profile/metrics/Insights data through official platform APIs after user authorization. It does not scrape social websites, automatically publish posts, automate messaging, or process escrow/payouts in the current product.

## 2. Creator user flow

1. Sign up as Creator (passwordless magic link / existing auth flows).
2. Complete creator profile (display name, username, niche, optional bio/photo/personal fields).
3. Optionally connect Instagram, Facebook Page, TikTok, and/or X from Dashboard → Social Accounts.
4. View synced analytics for connected accounts (availability depends on platform/API).
5. Browse opportunities, accept invitations or apply to campaigns.
6. Submit deliverable content as URLs/captions/notes for brand review.
7. Disconnect social accounts or delete the Postvertise account from Settings when desired.

## 3. Brand user flow

1. Sign up as Brand and complete brand profile/onboarding.
2. Discover creators (authenticated Discover + public creator profiles).
3. Create campaigns with briefs, targeting metadata, and deliverable definitions.
4. Invite creators and/or review applications; manage participants.
5. Review deliverable submissions (approve / request revisions).
6. Delete the Postvertise account from Settings when desired.

Payments between brand and creator: Stripe SetupIntent / PaymentIntent / Connect Transfers are implemented (Phases 4–6). Do not claim “no payments” in Meta review notes. Escrow and application-initiated bank payouts are still out of scope.

## 4. Instagram connection flow

1. Creator opens Dashboard → Social Accounts and chooses Instagram.
2. OAuth starts with Business Login for Instagram (default `SOCIAL_INSTAGRAM_AUTH_METHOD=instagram_login`).
3. Requested scopes: `instagram_business_basic`, `instagram_business_manage_insights`.
4. After callback, Postvertise stores encrypted credentials and enqueues social sync.
5. Sync pulls profile, audience, content sample, demographics (when Insights return them), and account Insights/analytics.
6. Public profile may show allowlisted aggregates and top audience segments from Instagram Insights when available.

Legacy path: `facebook_login` remains for older accounts / optional config (`instagram_basic`, `pages_show_list`, `pages_read_engagement`, `public_profile`). Do not expand legacy scopes in this review package unless that path is the live demo path.

Evidence:
- `backend/config/social_oauth.php` (`providers.instagram`)
- `backend/app/SocialData/Providers/InstagramSocialDataProvider.php`
- `frontend/components/dashboard/DashboardSocialAccountsPage.tsx`
- `frontend/lib/legal/social-data-sections.ts`

## 5. Facebook Page connection flow

1. Creator chooses Facebook on Social Accounts.
2. OAuth requests: `pages_show_list`, `pages_read_engagement`, `read_insights`, `public_profile`.
   Do **not** request `pages_read_user_content` — Meta's allowed usage is visitor UGC/comments, and Review requires a screencast showing a user-generated comment displayed in-product. Page-authored posts are covered by `pages_read_engagement`.
3. Creator selects a Page they manage.
4. Postvertise stores the Page connection + encrypted Page token and syncs profile/audience/content.
5. When the token includes `read_insights` and Page ANALYZE access, Postvertise may enrich post media-view Insights and other Page Insights Meta returns.
6. Facebook audience-country (`page_follows_country`) is experimental and disabled by default (`FACEBOOK_AUDIENCE_COUNTRY_ENABLED=false`). Age/gender Page Insights are not available in the current Graph integration.

Evidence:
- `backend/config/social_oauth.php` (`providers.facebook`)
- `backend/config/social_data.php` (`demographic_dimensions.facebook`)
- `backend/app/SocialData/Providers/FacebookPageSocialDataProvider.php`

## 6. Social analytics flow

1. After connect (and periodically while connected), `social-accounts:enqueue-syncs` runs hourly; per-account interval defaults to ~6 hours (`social_data.auto_sync`).
2. `SyncSocialAccountJob` calls provider adapters over official APIs.
3. Creator sees analytics in dashboard platform analytics UI.
4. Public creator profiles expose allowlisted follower aggregates and, when Insights demographics exist, top audience countries/age/gender via `PublicCreatorProfileResource`.
5. Manual sync remains available from the Social Accounts / data API.

Evidence:
- `backend/routes/console.php`
- `backend/config/social_data.php` (`auto_sync`)
- `backend/app/Actions/SocialData/SyncSocialAccount.php`
- `backend/app/Http/Resources/PublicCreatorProfileResource.php`
- `frontend/components/profile/PublicProfileView.tsx`

## 7. Why each currently requested Meta permission is required

| Permission | Feature | User flow | API usage | Evidence | Screencast needed |
|---|---|---|---|---|---|
| `instagram_business_basic` | Link IG Professional account; profile/media basics | Creator connects Instagram | IG Graph profile/media endpoints | `social_oauth.php`, `InstagramSocialDataProvider.php` | Yes — connect + profile metrics |
| `instagram_business_manage_insights` | Follower demographics + account Insights | Creator views analytics; public audience section when available | `follower_demographics`, account Insights | `InstagramSocialDataProvider.php`, `PublicCreatorProfileResource.php` | Yes — Insights/demographics UI |
| `pages_show_list` | List Pages the user can manage | Facebook connect + Page selection | Pages listing during OAuth selection | Facebook OAuth controllers/actions, Social Accounts UI | Yes — Page picker |
| `pages_read_engagement` | Page profile + Page-authored posts + engagement summaries | Sync Page metrics/posts for analytics/marketplace | Page fields + `/posts` + engagement summaries | `FacebookPageSocialDataProvider.php` | Yes — Page posts/metrics after sync |
| `read_insights` | Post media-view Insights + eligible Page Insights | Enrich analytics when token/ANALYZE allow | `/{post-id}/insights`, Page Insights | `FacebookPageSocialDataProvider.php`, `social_oauth.php` content_insights_required_scopes | Yes — Insights enrichment path |
| `public_profile` | Basic Facebook user identity for Login | Complete Facebook Login handshake | Standard Login profile | Facebook OAuth config | Covered by Facebook connect screencast |

Do **not** request for this product state: `pages_read_user_content` (requires UGC comment UI + screencast), publishing permissions, messaging permissions, `business_management` beyond what Meta auto-grants for the use case, unrelated Instagram manage permissions, or TikTok `video.list`.

## 8. What data is collected (Meta-relevant summary)

- Connection identity (provider ids, usernames/display names, profile images/URLs)
- Encrypted OAuth access/refresh tokens (never shown in public API resources)
- Profile and audience counters returned by APIs
- Limited public content/metadata samples where supported (Instagram, Facebook, X; not TikTok video items)
- Insights/analytics and aggregated audience demographics when permissions + APIs return them
- Sync status and derived metrics calculated from platform-supplied aggregates

Public profiles may show Creator-provided personal fields (optional gender/age) **and separately** platform audience aggregates. See Privacy Policy §10 and §18 and `/social-data`.

## 9. How users disconnect accounts

Dashboard → Social Accounts → Disconnect. Deletes that connection’s stored credentials and synced social data for the connection. Provider-side token revocation is not implemented; users may also revoke access in Meta/TikTok/X settings.

## 10. How users delete their Postvertise account

Dashboard → Settings → Delete account (Danger Zone) → confirms → `DELETE /api/account` for the authenticated owner. Removes/anonymizes account data per implementation, disconnects social accounts, ends authenticated access. Offline requests: `/data-deletion` + `support@postvertise.com`.

## 11. What Postvertise does NOT do

- No scraping of Instagram/Facebook/TikTok/X websites
- No automatic publishing to social networks
- No messaging automation / inbox product
- No escrow product; no application-initiated bank payout (Stripe Connect Transfers to Express balances are implemented)
- No claim that every connected account receives every Insights metric
- No claim that Facebook audience country is a generally available production capability
- No request for `pages_read_user_content` without a visitor-comment UI

## 12. Reviewer test flow (suggested)

1. Create a Creator test account and complete profile.
2. Connect Instagram Professional account; complete OAuth; wait for sync; open analytics.
3. Connect a Facebook Page with ANALYZE access; complete OAuth + Page selection; wait for sync; show Page metrics/posts and Insights where returned.
4. Open public profile URL (`/profile?username=…`) and show allowlisted aggregates / audience Insights segments if present.
5. Disconnect Instagram and Facebook from Social Accounts.
6. Optionally show account deletion path in Settings (use disposable reviewer account).
7. Confirm privacy/social-data/data-deletion/contact pages are publicly reachable without login.

Provide reviewers with a test Creator account, Instagram Professional account, and Facebook Page that grant the requested permissions.

## 13. Screencast checklist

- [ ] App home / signup as Creator
- [ ] Instagram connect OAuth consent showing requested scopes
- [ ] Post-connect sync and Instagram analytics UI (including Insights/demographics when available)
- [ ] Facebook connect OAuth consent showing requested scopes
- [ ] Facebook Page selection
- [ ] Facebook Page analytics / posts / Insights enrichment when available
- [ ] Public creator profile showing API-backed metrics (and audience Insights segments if available)
- [ ] Disconnect social account
- [ ] Link to Privacy, Social Data, Data Deletion, Contact pages
- [ ] Explicit statement on camera or slide: no publishing, no messaging automation; payments via Stripe (no escrow / no app-initiated bank payout)

## Related public pages

- `/privacy`
- `/social-data`
- `/data-deletion`
- `/contact`
- `/terms`
- `/cookies`