Security and privacy

You're posting your own listings (real estate, goods, services) within Israeli law and the rules of each specific group. You log in to Facebook yourself through the connection window to your server (it's like TeamViewer right inside your browser), and the service never asks for, sees, or stores your password. The software behaves like a human: realistic clicks, random pauses, and constant monitoring of Facebook's restrictions. Spam, fraud, phishing, and posting in groups where your type of content is explicitly forbidden are not allowed - following each group's rules is your responsibility.

Nowhere on our end. You enter it yourself in the Chrome browser that's open on YOUR own server through the connection window to your server - the password only goes to your server, never to us. From there the login is "remembered" in the Chrome profile on that server, and the software signs in on its own. All our database keeps about Facebook is a "logged in" flag - the password itself isn't there, and there isn't even a separate column for the FB password in the database.

No. Since your FB password isn't stored anywhere on our side, an operator can't log into your account "for you" - it simply isn't kept with us. The persistent session lives in the Chrome profile on your server; to switch accounts or log back in, you have to open the server screen of your server specifically, and that's available only to you (and, if needed, to an admin for technical support).

The risk can't be fully eliminated - Facebook changes its rules, and responsibility for the account stays with you (you confirm this at registration). But the service does a lot to reduce that risk: the software works at a human pace with random delays, there's a posts-per-hour limit, the Facebook groups and Marketplace windows are spread out over time (groups during the day from 07:00, Marketplace at night), and at the first sign of a restriction the program pauses itself and sends you an alert on Telegram. And if Facebook does restrict the account anyway - that's not a failure of the service.

Several mechanisms work together. Pace: random pauses between actions, and a 20-60 second delay after each post. Limit: 4 posts per hour by default, with a warning in the dashboard "no more than 5 - risk of restriction." Windows: groups and Marketplace post at different times, never simultaneously. Group tagging: in large, strict groups the software leaves a minimal "footprint" (phone only, no extra links). Anti-duplicate: the software doesn't send the same listing to the same group more than once every 4 hours, plus multiple servers won't post the same apartment in the same hour (otherwise Facebook reads it as coordinated spam). And on a rate-limit, the software puts itself into a cooldown on an escalating ladder: 3h → 6h → 24h.

Only the minimum needed to operate: your name, contact details (Telegram/WhatsApp/phone), email and an encrypted (bcrypt) dashboard password, your listings (apartment photos and descriptions), the list of your FB groups, technical server data (IP, tokens), payment history, and an action log. We don't store your Facebook password. The most sensitive items - your server password, your Telegram session, and your 2FA secret - we store only in encrypted form.

Write 'delete my data' to @BuzzPostil on Telegram (or WhatsApp +972 58-638-4995). Under the Privacy Policy all your data is deleted within 24 hours. Deleting data and getting a refund are different things: a refund is only possible in the cases described in the Return Policy.

Yes. Go to your dashboard → "Security" section → "2FA" tab → "Enable 2FA," confirm with your current password, scan the QR code in Google Authenticator / Authy / 1Password (or enter the secret manually), and click "Confirm and enable." After that, every login will require a 6-digit code from the app in addition to your email and password. The QR and the secret never leave our server, and the same code can't be reused.

You can turn off 2FA in your dashboard → "Security" → "2FA" → "Disable 2FA," confirming with your current dashboard password. When it's disabled, all previously issued sessions are revoked, so an old stolen token won't survive the change. And if you've lost both the app and the ability to log in - write to support @BuzzPostil.

Yes. After 5 failed login attempts within 15 minutes, login is blocked for 15 minutes. There are also additional limits: no more than 10 attempts per minute from one IP and no more than 20 per hour for one email, and the login form is protected by a CSRF token. The dashboard password itself must be at least 10 characters long and is stored only as a bcrypt hash.

Only you (the owner) and the service admin. Both the regular request to open the connection window and the remote-screen channel itself verify that you're the owner of that server, and block access for any other user (returning a 403 error). When you open that window, no one but you can see that screen. Other people's screenshots and post history can't be viewed either - everything is strictly tied to the owner.

Sensitive fields (the program machine's password, the Telegram session, the 2FA secret) are stored encrypted with Fernet, and the encryption key is kept separately from the database. So a leak of the database alone does not expose this data.

No, that password isn't shown in the dashboard - it's stored in encrypted form. And you don't actually need it for day-to-day use: logging in to Facebook and managing the server are done through the connection window and the buttons in the dashboard. Technical access to the machine itself belongs to the service admin for maintenance.

Because your Facebook account and any restrictions on it (rate-limit, a group ban, account suspension) are your area of responsibility. At registration you need to check your agreement with the Terms of Use and the Privacy Policy and confirm that you understand this; without the checkbox, registration won't go through. The service reduces the technical risks, but it can't guarantee that Facebook will never restrict your account.

Under the Terms, you may not share panel access with third parties, resell the service, or attempt to reverse-engineer it - that's grounds for termination with no refund. The service is also for people 18+ only (a requirement of both Facebook and Israeli law). And technically you wouldn't be able to "share" your server's screen anyway: both the connection request and the remote-screen channel only let the account owner in.

Yes, the service keeps an action log: the action, the time, and the IP address are recorded - including sensitive events like enabling and disabling 2FA. This exists precisely for security, so things can be sorted out if something goes wrong. On top of that, enabling or disabling 2FA and changing your password always require entering your current password - that's a safeguard in case someone hijacks your session.