Home → Transparency

Meta App Review Notes

A plain description of the Oye Creators app for Meta’s reviewers and for anyone curious: what it is, who uses it, how each permission is used, and where the required policies live. Test credentials and the screencast are supplied inside the App Review submission, not on this page.

1. What the app is

Oye Creators is a marketplace where brands state a marketing intent and nano and micro creators in India are matched to it. Creators use the mobile app to connect their Instagram professional account, complete a profile, accept campaigns, post, and get paid. Connecting Instagram is what lets us verify ownership and show brands real performance data. Auto-DM is an optional value-add inside the same app that lets a creator automate replies on their own account.

2. Who the users are

  • Creators — individuals aged 18+ with an Instagram professional (creator or business) account, any follower count.
  • Brands — businesses using the web dashboard to state intents and run campaigns. Brands never receive creators’ tokens or private messages; they see aggregated performance and campaign deliverables.

3. The user flow

  1. Creator installs the app and signs up (phone/email).
  2. Creator taps Connect Instagram and completes login with either Instagram Login or Facebook Login for Business, granting the permissions shown.
  3. The app shows the creator’s profile, follower count and recent media, and reads insights to complete their Oye profile.
  4. Brands’ intents are matched to the creator; the creator accepts or skips campaigns.
  5. Optionally, the creator opens Auto-DM, chooses keywords and writes replies, and switches it on. Replies are sent only in response to comments, messages, story replies or mentions on the creator’s own account.
  6. The creator can pause Auto-DM, disconnect Instagram, or delete their data from Settings at any time.

4. Permission-by-permission use

PermissionWhere it is used in the appUser benefit
instagram_business_basic / instagram_basic, pages_show_listConnect Instagram screen; Profile tabProves account ownership; fills the creator’s Oye profile without manual entry.
instagram_business_manage_insights / instagram_manage_insights, pages_read_engagementProfile → Performance; campaign matchingCreators are matched to campaigns that fit their real audience; brands see verified reach.
instagram_business_manage_messages / instagram_manage_messages, pages_manage_metadataAuto-DM → Message replies & Story repliesCreators answer common questions and story replies automatically with their own text, and take over any conversation in Instagram.
instagram_business_manage_comments / instagram_manage_commentsAuto-DM → Keyword comment-to-DMA commenter who types the creator’s keyword receives the link or answer the creator promised, without the creator replying by hand.
business_management (Facebook Login only, where required)Campaign matching via Meta business toolsEnables partnership and marketplace workflows for creators who opt in.

5. What Auto-DM will not do

  • Message anyone who has not first commented, messaged, replied to a story or mentioned the creator.
  • Send bulk, promotional or unsolicited messages, or use uploaded contact lists.
  • Send messages on behalf of brands or third parties.
  • Publish posts, stories or comments on the creator’s behalf.
  • Operate outside the messaging windows and rate limits Meta’s platform sets.

6. Implementation checklist for the review

Items the engineering team implements and demonstrates in the screencast:

  • Login flow for both products, requesting only the permissions listed above, with a clear explanation screen before the Meta dialog.
  • Privacy Policy, Terms of Service and Data Deletion URLs configured in the app dashboard and reachable without login (this site).
  • Deauthorise callback and data-deletion callback endpoints live, returning a confirmation code and status URL.
  • In-app data-deletion path (Settings → Account → Delete my data) working end to end.
  • Auto-DM: replies sent only on comment, message, story-reply and mention events; automation identified as such; stop keyword honoured; creator can pause instantly.
  • Messaging-window and rate-limit handling with no retries outside allowed windows.
  • Tokens encrypted at rest; access logged; sub-processors listed on the Vendors page.
  • Test creator account and step-by-step screencast covering every permission attached to the submission.

7. Contact for reviewers

Support@ttlmedia.in · TTL Media Private Limited. Official references: Meta Platform Terms, Developer Policies, Instagram Platform documentation.