Privacy Policy

1. Instagram comments and prompt delivery

We use the official Instagram/Meta API. Meta sends Instagram comment events to our server through a webhook. We verify the request signature, identify the post, and compare the comment with that post’s configured keyword. A matching comment can receive an automated private reply containing the prompt page link.

For comments on posts linked to our published prompts, we store the comment text, Instagram comment and post IDs, the commenter’s Instagram user ID when supplied, and the associated prompt record. We also store processing status, attempt counts, timestamps, a reply message ID when a reply succeeds, and diagnostic error information if needed.

Nonmatching comments on these posts may be recorded as ignored to avoid processing them again. Posts not linked to our prompt records are normally ignored. We do not store complete raw webhook payloads, collect commenters’ profile details, or read their general private-message inboxes.

2. Why we use this information

We process only the information needed to provide and operate this service: match a comment to the right prompt, deliver a requested link, prevent duplicate replies when Meta retries an event, and diagnose delivery problems. We do not use Instagram interaction records for advertising, profiling, or unrelated marketing, and we do not sell personal data.

3. Website and published content

You do not need an account to browse or copy prompts. We store the artwork, titles, prompt text, optional model information, captions, trigger keywords, reply templates, publication IDs, and publication status entered or generated through our local admin. Published artwork and prompt-page content are public; Instagram interaction logs are not exposed to website visitors. Uploaded images use publicly accessible storage URLs, including draft images; draft prompt pages are not publicly listed.

Our website does not add analytics tools, advertising cookies, or tracking pixels, and does not keep a separate history of your code searches or clipboard copies. Hosting and infrastructure providers may process ordinary request information, such as IP addresses, request URLs, and browser information, to deliver, secure, and troubleshoot the service.

4. Services involved

Meta/Instagram supplies comment events and processes the private replies we send through its API. Vercel hosts the public website and webhook endpoint. Supabase provides our database and image storage. Relevant information passes through these providers as needed to operate the service; it is not shared for unrelated purposes.

These providers may process information outside your country. Their services are also subject to their own privacy terms: Meta/Instagram, Vercel, and Supabase.

5. Retention and security

Interaction records support delivery, duplicate prevention, and troubleshooting. They currently have no automatic expiry and remain in our database until manually removed. Deletion requests are handled manually; we remove data that is no longer needed for these purposes or that must be deleted under applicable requirements.

We use HTTPS, signed-webhook verification, and restricted database access. API credentials stay server-side, and interaction records are not publicly readable. No internet service can guarantee absolute security.

6. Privacy and data deletion requests

Anyone using our service can request access to, correction of, or deletion of their information by emailing sendmeprompt@gmail.com with the subject “Privacy request”. Include enough information to locate the interaction, such as a link to the Instagram post or comment, or a relevant Instagram ID. Do not send passwords or access tokens. We may ask for limited information to verify the request.

If you contact us, we use your email address and the information you provide to handle your request. Depending on applicable law, you may also have rights to restrict or object to processing, obtain a portable copy of your data, or complain to your local data protection authority. Deleting our records does not delete the original comment or messages held by Instagram; those are managed through Instagram.

7. Updates

We will update this page if our data practices change and revise the date above. Questions about this policy can be sent to sendmeprompt@gmail.com.