Privacy Policy

Signing in is by emailed link, so we store your email address and the session it creates. We never see or store a password — not yours, and not your Instagram one.

Alongside it we keep your workspace, who else is in it, and the campaigns you configure: the posts you chose, the keywords, the messages and the links.

To answer a comment we have to know who left it. For each one we store the commenter’s Instagram user id and username, the text of the comment, the keyword it matched, and what happened to the reply — sent, refused by Instagram, or failed, with the reason.

That record is what lets the same person be answered once rather than five times, and what lets you see who was missed. It belongs to your workspace and is visible to nobody else’s.

When a link in a message is clicked, we count the click and keep the browser’s user agent and referring page. The visitor’s IP address is stored only as a one-way hash — enough to tell two clicks apart, not enough to recover the address.

When you connect an account, Instagram gives us an access token. It is encrypted at rest with AES-256-GCM and is used only to do what you configured: read the comments on your own media, send the private reply, and post the public reply when you asked for one.

OpenReply never asks for an Instagram password, never automates a browser session, and never scrapes. Everything goes through Meta’s official API. The events Instagram sends us are stored as received so a failed delivery can be traced afterwards.

This instance runs on a server we operate ourselves, with its database and queue on that same machine. The data is not on a third-party application platform.

Two outside services are involved, both narrowly: Meta, whose API delivers the messages, and Resend, which delivers your sign-in link and therefore sees your email address. Nothing is sold, rented, or shared for advertising, and there is no analytics vendor tracking you across this site.

Campaign records and delivery logs stay until you delete them — they are the history you look at to see what a campaign did. Disconnecting an Instagram account in Settings removes its stored token immediately and stops every campaign attached to it.

Ask us to delete your workspace and it goes, along with its campaigns, logs, webhook records and click counts. The data deletion page describes how.

You can disconnect Instagram at any time, delete a campaign and its logs from the app, or ask for the whole workspace to be erased. If you are outside the workspace — someone who commented and received a message — write to the address below and we will remove your records from it.

If this policy changes materially, the date at the top of the page changes with it.

The data controller for this instance is ИП 1609PLUS, registered in Astana, Kazakhstan. Privacy questions and deletion requests: ceo@1609plus.com.