Entrar

Meta App Review — how Ritornelo uses Instagram

Ritornelo is a content tool for small businesses and agencies. A user connects their own Instagram professional account with Instagram Login (Business Login for Instagram), prepares posts, publishes or schedules them, reads their own insights and answers comments on their own posts. The app acts only on the account the user connected, only after the user’s action, using the user access token returned by Instagram Login.

Not server-to-server: there is no system user token and no access to accounts that did not log in. Every call uses the token of the person who connected the account.

How to test (about 5 minutes)

  1. Open ritornelo.com.br/entrar. Sign-up is open: type any e-mail address you can read and click the link we send (valid for 15 minutes). The account is created when the link is opened. No password and no test credentials are needed — please do not send us any credentials.
  2. Use the PT / EN switch at the top of the page to see the interface in English.
  3. Complete the short onboarding (business name and one brand).
  4. Go to Accounts → Log in with Instagram. Instagram shows its own login page and the permission screen; approve it and you come back to Ritornelo with the account connected.
  5. Go to Publish: upload an image (or a video for a reel or story), choose the type, write or generate the caption, choose the account and “Now”, then Publish. The post appears on Instagram and its status changes to “Published”.
  6. Go to Insights. Insights are read for posts published through Ritornelo: 6 hours and 1, 3, 7 and 28 days after publishing (Meta’s numbers can take up to 48 h), so the numbers of a brand-new post appear a few hours later. Comment on that post from another Instagram account, click Fetch comments now, then Reply on the comment — the reply appears on Instagram under the comment.

While the app is in development mode only Instagram testers can connect. If your test account is not a tester yet, reply to the review with its @username and we will add it the same day — or e-mail privacidade@ritornelo.com.br.

Permissions

instagram_business_basic

Identify the connected professional account (user_id, username, account_type) so the user sees which account each post will go to, and to keep the connection valid (token refresh).

Endpoints (graph.instagram.com):

  • GET /me?fields=user_id,username,account_type
  • GET /refresh_access_token

Where in the app: Accounts screen (/app/conexoes): the connected @username card, and the account picker in the Publish wizard.

instagram_business_content_publish

Publish the image, carousel, reel or story that the user prepared and explicitly confirmed — immediately or at a time the user scheduled. Nothing is published without a click from the user.

Endpoints (graph.instagram.com):

  • POST /{ig-user-id}/media (image_url | video_url | media_type=CAROUSEL | REELS | STORIES)
  • GET /{container-id}?fields=status_code
  • POST /{ig-user-id}/media_publish
  • GET /{ig-user-id}/content_publishing_limit

Where in the app: Publish tab (/app/publicar): upload → type → caption → where and when → “Publish now”. The status of each account appears on the post page.

instagram_business_manage_insights

Show the user how their own posts and account performed (reach, views, likes, comments, saves, shares, total interactions), so they can decide what to post next.

Endpoints (graph.instagram.com):

  • GET /{ig-media-id}/insights?metric=reach,views,likes,comments,saved,shares,total_interactions
  • GET /{ig-user-id}/insights?metric=reach,views,total_interactions

Where in the app: Insights tab (/app/analisar): numbers per post and for the account.

instagram_business_manage_comments

List the comments on the user’s own posts and let the user reply to a comment from inside Ritornelo. Every reply is typed and sent by the user; there are no automatic replies.

Endpoints (graph.instagram.com):

  • GET /{ig-media-id}/comments?fields=id,text,username,timestamp,from,parent_id,replies
  • POST /{ig-comment-id}/replies (message)

Where in the app: Insights tab (/app/analisar): “Comments” list → “Reply”. Also summarized on the Today screen.

Safeguards

  • Personal (non-professional) accounts are detected before the connection and the user is told how to switch.
  • Tokens are encrypted at rest; disconnecting the account deletes the token. Data deletion: /exclusao-de-dados.
  • Each company’s data is isolated by row-level security in the database; a user only sees accounts of their own organization.
  • Publishing respects the account’s publishing limit and never publishes without the user’s confirmation.

Privacy policy: /privacidade · Terms: /termos