On the first connection screen, THE-Y explains and requests the complete permission bundle for the publishing, media, engagement, messaging, insight, and management features it actually provides. If the user approves only some permissions or assets, only those features are enabled and the unavailable features and reconnection steps are shown. Permissions for features THE-Y does not provide are not requested.
Supported scope
Current availability is shown per platform and depends on provider review status and channel type. Comment, message, automation, and analytics controls stay unavailable unless their exact capability has been approved and exposed in THE-Y.
Security and deletion
Platform tokens are encrypted and stored only in THE-Y, never sent to THE-Y related services. THE-Y handles disconnect and account-deletion requests; inbox content is retained for 90 days by default.
YouTube data and uploads
THE-Y identifies YouTube API data as YouTube data and makes channel-level data available only to the channel owner or their authorized representative. It does not combine YouTube data with other sources to create replacement metrics. Before an upload, you choose the exact title, description, and visibility, then certify compliance with the YouTube Community Guidelines. THE-Y revalidates or refreshes retained YouTube API data and authorization at least every 30 days. If you request deletion or continuing authorization cannot be verified, THE-Y stops access immediately and deletes the related YouTube API data within 7 days.
PUBLIC REVIEW DISCLOSURE
Platform scopes and current limitations
These scope bundles cover every feature THE-Y actually provides. They are explained together during the first connection, but only the scopes and assets the user actually approves are applied. General users remain blocked until platform approval and THE-Y capability evidence are present.
Instagram
Implemented · production use requires provider approval
Scope group
instagram_business_basic
instagram_business_content_publish
instagram_business_manage_comments
instagram_business_manage_messages
instagram_business_manage_insights
Current limitation
Designated reviewer and tester accounts can execute the real OAuth and feature flow end to end; general-account connection opens after provider approval.
Only Instagram Business or Creator accounts can connect.
Instagram Stories, if approved, are limited to eligible Business accounts.
Before Instagram media is sent, the user explicitly selects whether it was generated or materially edited with AI; Yes is sent as is_ai_generated=true on the supported container.
Immediately before an Instagram container is created, THE-Y reads the account's rolling 24-hour API publishing quota and blocks before any external write when the limit is reached.
THE-Y does not offer arbitrary new-recipient, unsolicited, or bulk cold messaging. It replies only to an existing conversation initiated by the user, when current platform policy, app permissions, and conversation access allow it, and only after the THE-Y user gives final approval.
Replies are permitted only while the platform's applicable inbound conversation window is open.
Instagram private comment replies are restricted by the platform's recipient and time-window policy.
Implemented · production use requires provider approval
Scope group
pages_show_list
pages_read_engagement
pages_read_user_content
pages_manage_posts
pages_manage_engagement
pages_manage_metadata
pages_messaging
read_insights
Current limitation
Designated reviewer and tester accounts can execute the real OAuth and feature flow end to end; general-account connection opens after provider approval.
Only Facebook Pages are supported; personal profiles and groups are excluded.
A permission set in one Facebook Login for Business configuration must be accepted in full at initial sign-in. The user may select only some Pages to share; if a permission or Page task is revoked later, only the affected feature is disabled.
THE-Y does not request Business Asset User Profile Access. Facebook Page comments and Messenger conversations use generic author labels; names, profile photos, and raw user IDs are not exposed in the UI or client-facing API.
THE-Y does not offer arbitrary new-recipient, unsolicited, or bulk cold messaging. It replies only to an existing conversation initiated by the user, when current platform policy, app permissions, and conversation access allow it, and only after the THE-Y user gives final approval.
Replies are permitted only while the platform's applicable inbound conversation window is open.
Implemented · production use requires provider approval
Scope group
https://www.googleapis.com/auth/youtube.force-ssl
Current limitation
Designated reviewer and tester accounts can execute the real OAuth and feature flow end to end; general-account connection opens after provider approval.
Messaging inside the platform's native app is outside the THE-Y API integration. The API scopes requested by THE-Y do not include message read or send access, so THE-Y provides no DM feature for this platform.
Google OAuth app verification and the YouTube API compliance audit are separate. THE-Y allows only private uploads until public-upload eligibility for this project has been confirmed.
Any approved YouTube comment synchronization uses polling rather than a real-time webhook.
YouTube API data is refreshed or deleted within the applicable 30-day policy period.
Effective 2026-06-01, videos.insert uses 1 unit from the separate Video Uploads quota bucket; the documented default upload limit is 100 calls per day.
Implemented · production use requires provider approval
Scope group
user.info.basic
user.info.stats
video.list
video.upload
video.publish
Current limitation
Designated reviewer and tester accounts can execute the real OAuth and feature flow end to end; general-account connection opens after provider approval.
TikTok's commercial API does not provide comment or direct-message management in THE-Y.
TikTok Direct Post, if approved, requires a fresh creator check and final user confirmation for every post.
TikTok visibility has no default: the creator must choose one of the current allowed options.
TikTok comments, Duet, and Stitch stay off unless the creator explicitly enables an allowed option.
Before TikTok audit approval, any Direct Post capability is restricted to the creator's private/self-only visibility.
AI-generated photo disclosure is enabled only after request-field acceptance is verified in this app's TikTok Sandbox.
Implemented · production use requires entitlement confirmation
Scope group
tweet.read
users.read
offline.access
tweet.write
media.write
tweet.moderate.write
dm.read
dm.write
Current limitation
Designated reviewer and pilot accounts can execute the real X OAuth and feature flow. General-customer access opens only after the declared use case, endpoint entitlements, account standing, and current contract are confirmed for the intended scale.
X access can incur usage-based provider cost; THE-Y uses delayed polling rather than guaranteeing real-time synchronization.
THE-Y replies or sends a message only in an existing X conversation or explicit invocation started by the other user, when current X access and policy allow it and the THE-Y user approves the exact final text. Cold DMs, repeated automated replies, random bulk messages, and identical or substantially similar cross-account posts are not offered.
X media publishing is shown only when the current app contract and approved media-upload route support it.
Programmatic X quote posting requires an Enterprise contract and is not offered by THE-Y's current pay-per-use integration.
THE-Y displays X Posts only with the official X mark, profile image, display name, @username, unmodified text, timestamp, and links back to the author and Post.
X access is limited to designated review and pilot users. General-customer production opens only after X confirms in writing that THE-Y's specific external-customer managed SaaS use case is permitted under the current or a separate agreement; an Enterprise subscription alone is not treated as permission.
Implemented · production use requires provider approval
Scope group
threads_basic
threads_content_publish
threads_read_replies
threads_manage_replies
threads_manage_insights
threads_delete
threads_manage_mentions
threads_location_tagging
Current limitation
Designated reviewer and tester accounts can execute the real OAuth and feature flow end to end; general-account connection opens after provider approval.
Messaging inside the platform's native app is outside the THE-Y API integration. The API scopes requested by THE-Y do not include message read or send access, so THE-Y provides no DM feature for this platform.
Threads supports webhooks; THE-Y's current review implementation deliberately uses revalidatable polling for replies and mentions.
Immediately before a Threads container is created, THE-Y reads the profile's rolling 24-hour publishing quota and blocks before any external write when the limit is reached.
Threads replies, owned-post deletion, and location search each read their own usage and config immediately before the action; reaching one limit blocks only that feature.
For channel connections, permissions, data deletion, or platform review, contact official.yshorts@gmail.com, the shared support mailbox operated by Bizcode Inc. for THE-Y and YShorts. Do not include OAuth credentials or platform tokens in email.
