Privacy policy

Effective date: 2026-08-22.

What we collect

There are four separate things, and they arrive at different moments.

• Your sign-in. When you sign in with Google we receive and store your email address and an account identifier. This happens whether or not you ever connect an Instagram account.
• Your Instagram data, once you connect a Business or Creator account — collected via the official Instagram API, with your explicit authorization: profile basics (username, account type, follower count), media metadata (captions, permalinks, post dates, thumbnails), and performance insights for your posts and account (views, reach, likes, comments, saves, shares, watch time). Your access token is stored encrypted.
• What you write in the app. Questions you ask in the chat, and the answers, are stored so a conversation survives a refresh.
• Data about people who comment on your posts, but only if you switch on a comment automation. This is the one category that is not about you, so it is spelled out separately below.

Comment automations, and other people’s data

If you create an automation, this app acts on your behalf: it watches for comments on your posts, and sends a private reply to whoever commented. That means we process data about people who never signed up here and have no relationship with us. We want to be exact about what that involves.

When an automation runs, we store, for each comment it acts on:

• the commenter’s Instagram username and the account identifier Instagram gives us for messaging them;
• the identifier of the comment and the post, and whether the message we sent succeeded or failed — so you can see what your automation actually did;
• if you enable the email step, the email address they reply with, saved to that automation’s leads;
• if your message contains a link, the fact and time that the link was clicked. We do not record their IP address, device, browser or location, and we do not use cookies or any other tracker on that redirect.

We do not store the text of their comment beyond deciding whether it matched your keywords, we never contact them for our own purposes, and none of this is used to build a profile of them, sold, or shared with anyone.

This makes you responsible for them too. The people your automation messages are your audience, not our users. If you collect their email addresses, you are the one deciding to do that, and your own privacy notice and local law — not this policy — govern what you may then do with them. We hold that data on your instructions and delete it when you delete the automation or disconnect the account.

Why we collect it

To compute and show you your own performance analysis, and — only if you turn one on — to run the comment automations you configure. We do not sell your data, we do not use it for advertising, and we do not share it with anyone for their own purposes.

Who else processes it

We use a small number of service providers to run the product. They process your data on our instructions only:

• Neon — our database, and the Google sign-in that authenticates you.
• Upstash — the job queue that fetches your Instagram data in the background.
• OpenRouter, and the AI model provider it routes to — used to generate the written audit and to answer your chat questions. What we send is the material the answer is about: your Instagram username, follower count, post metrics and excerpts of your captions. We do not send your email address or your Instagram access token.

These providers operate servers that may be located outside your country.

Benchmarks (not active yet)

We intend to offer cohort benchmarks — how your save rate compares to other creators of a similar size in your niche. This is not running today, and no benchmark pool exists. If we launch it, contributing will require a separate, explicit opt-in from you; only anonymized, aggregated metrics would be used, cohorts would never be shown below a minimum size, and no output would identify your account.

Retention and deletion

Disconnecting an Instagram account deletes that account’s data — profile, media, insights, generated audits, chats, and every automation with its activity log, captured emails and click counts — immediately and outright. It is not a soft hide. You can do this in two ways, and both have the same effect: in the app under Settings → Disconnect Instagram, or from Instagram itself (Settings → Apps and websites → Social Maker), which notifies us automatically.

What disconnecting does not do is delete your sign-in. If you connected more than one Instagram account, the others are also left alone. We keep your email address so you can sign back in and connect again.

To delete your sign-in as well — and with it anything still attached to it — email us at the address below from the address you signed in with, and we will remove it.

Changes

If we change what we collect or who processes it, we will update this page and the effective date above.

Contact

Bitfumes Webnologies Pvt. Ltd. — bitfumes@gmail.com