1. Who we are
Murmio (“Murmio”, “we”, “us”) is a social media management service that helps teams schedule and publish content, reply to comments and messages, and review performance across X, Facebook, Instagram and TikTok. Murmio is operated by James, an individual based in Singapore. For any privacy question, contact jameschen@salemesh.freeqiye.com.
This policy covers the Murmio web application (the “Service”) and this website. It explains what we collect, why, and the choices you have.
2. Information we collect
Account information
- Google sign-in: your name, email address and profile picture, as shared by Google, plus a Google account identifier used to recognise you on return.
- Email sign-in: your email address. We send a one-time code to it; codes expire after 10 minutes and are stored only as a hash.
- Profile and team details you add: display name, language, time zone, team name, markets and team members you invite (their email addresses and roles).
Content you create or upload
Post text, images, videos, scheduled times, replies, saved replies, tags and notes you create in the Service.
Data from connected social accounts
When you connect a social account, we receive the data described in section 3, only within the permissions you approve on that platform.
Technical and security data
IP address, browser user agent, sign-in times and an audit log of significant actions in your team (for example, who connected an account or changed a role). We use these to keep accounts secure, prevent abuse and troubleshoot problems.
3. Connected social accounts
Murmio connects to social platforms only through their official authorisation flows (OAuth). We never ask for or store your social media passwords. Access tokens are encrypted at rest and used only to provide the features you use.
| Platform | What we access | Why |
|---|---|---|
| TikTok | Basic profile (user.info.basic, user.info.profile): open ID, display name, avatar, profile link. Video upload and publishing (video.upload, video.publish). | To show which account is connected, and to upload and publish videos or photo posts to your account only when you schedule or publish them in Murmio. |
| X | Profile (name, username, profile image), your posts, and permission to publish posts and upload media (users.read, tweet.read, tweet.write, media.write, offline.access). | To identify the account, publish the posts you schedule, and keep the connection active without asking you to sign in again. |
| Facebook and Instagram (Meta) | The Pages and Instagram professional accounts you choose, their basic profile, and permission to publish content, read and reply to comments and messages, and read insights. | To publish your content, bring comments and messages into the inbox, let you reply, and show performance data. |
We use data from these platforms only to provide the Service to you and your team. We do not sell it, do not use it for advertising, and do not use it to train AI models. Our use of data received from each platform also follows that platform's developer terms and policies.
4. How we use information
- Provide the Service: sign-in, teams, scheduling, publishing, inbox, analytics and reports.
- Send service emails: sign-in codes, invitations, and notices that a connected account needs to be re-authorised. We do not send marketing email without your consent.
- Keep the Service secure: detect suspicious sign-ins, prevent abuse, keep audit logs.
- Optional AI features (writing help, translation, reply suggestions, tagging): the text you choose to process is sent to an AI model provider to produce the result. These features are off unless you or your team turn them on.
- Record usage (for example, posts published or AI requests) to operate limits and future plans.
- Meet legal obligations.
5. How we share information
We do not sell personal information. We share it only:
- With the platforms you connect, when you publish or reply through Murmio.
- Within your team, according to the roles your team assigns.
- With service providers that process data for us under confidentiality obligations: Cloudflare (hosting, website delivery and network security), email delivery (Resend), and, only for optional AI features, an AI model provider.
- When required by law, or to protect the rights and safety of users and the public.
6. Security
Connections use HTTPS. Platform access tokens are encrypted at rest. Sessions use secure, HTTP-only cookies. Access within a team is controlled by roles, and important actions are recorded in an audit log. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users of a breach as required by law.
7. Retention
- Account and team data: kept while your account is active.
- Platform tokens: deleted when you disconnect the account or delete your Murmio account.
- Content and synced comments or messages: kept while your team uses the Service, then deleted with the team or account.
- Sign-in and audit logs: kept for up to 12 months for security.
- One-time sign-in codes: expire after 10 minutes.
8. Disconnecting and deleting
- Disconnect an account: in Murmio, open Social accounts and choose Disconnect. We stop using the account and delete its access tokens.
- Revoke access on the platform: you can also remove Murmio from TikTok (Settings and privacy → Security → Apps and services permissions), X (Settings → Security and account access → Apps and sessions) or Meta (Facebook Settings → Apps and websites; Instagram Settings → Website permissions).
- Delete your Murmio account: email jameschen@salemesh.freeqiye.com from your account's address. We delete your account and personal data within 30 days, except where we must keep certain records by law.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact jameschen@salemesh.freeqiye.com. We will respond within 30 days. You may also complain to your local data protection authority.
10. International transfers
Murmio serves teams in many countries, and our service providers may process data outside your country. Where we transfer personal information internationally, we take steps to protect it as required by applicable law.
11. Children
The Service is for businesses and professionals. It is not intended for anyone under 16, and we do not knowingly collect personal information from children.
12. Cookies
The Murmio application uses only strictly necessary cookies: a session cookie to keep you signed in and short-lived cookies that secure sign-in and account connection flows. This website does not use analytics, advertising or tracking cookies.
13. Changes
We may update this policy. We will change the date at the top and, for significant changes, notify you in the Service or by email before they take effect.
14. Contact
James, operator of Murmio · Singapore · jameschen@salemesh.freeqiye.com