Privacy Policy

• Instagram account username, display name, and User ID — collected once at OAuth time to identify the connected account.
• A long-lived Instagram access token — encrypted with AES-256-GCM and stored in our database solely to send automated replies on behalf of the account owner.
• OpenAI API key — encrypted with AES-256-GCM and stored solely to call the OpenAI API on behalf of the account owner.
• Incoming DM webhook payloads from Meta — used transiently to generate a reply and immediately discarded. Message content is not stored.

• The Instagram access token is used exclusively to send a reply message via the Instagram Messaging API in response to an incoming DM.
• No data is sold, shared with third parties, or used for advertising.
• No user message content is persisted.

• Account credentials are retained while the account remains active on the platform.
• Accounts can be deleted at any time by contacting [email protected].
• On deletion, all stored tokens and keys are permanently erased.

• All sensitive values (access tokens, API keys) are encrypted at rest using AES-256-GCM before database storage.
• All connections are HTTPS-only.
• Webhook payloads are verified using HMAC-SHA256 against the Meta App Secret before processing.

[email protected]