Instagram automation privacy
Last updated: 31 October 2026
What this covers
Our Instagram automation (the comment-keyword replier) answers keyword comments and keyword direct messages on Instagram professional accounts that we own and run. This page explains how it works and what data it handles. The general site policy is our privacy policy.
How it works
- An account owner connects an Instagram professional account through Instagram's official login. We use Instagram's official API only. We do not scrape Instagram, and we never ask for or see your Instagram password.
- The replier checks the connected account's own posts for new comments and its inbox for new messages. If a comment or message is only a keyword the owner set up (for example a single word named in the post's caption), it sends one reply with what the post promised, typically a link.
- For comments, the reply is a private reply sent through Meta's official private-replies feature, which Instagram allows once per comment within seven days of the comment. It may also post a short public reply under the comment. For direct messages, it replies only inside Instagram's 24-hour messaging window.
- Sentences that merely contain a keyword do not trigger a reply. Only the keyword on its own does.
No spam, and how to opt out
We send at most one reply per comment, never reply twice to the same comment, and never message people who did not comment or message first. Send STOP as a direct message to the account and the replier records your opt-out and sends you no more automated messages from that account, including replies to later comments. Some messages also say they are automated and remind you of STOP, but STOP works whether or not a message says so. We do not use the replier for advertising or bulk messaging.
What we receive
- From the account owner (us, or an owner who connects an account): the Instagram account id, username and an access token issued through Instagram Login. The token is stored encrypted (AES-256-GCM).
- From people who comment or message: your Instagram-scoped user id and username, the comment id, and the comment or message text, which the replier reads to check for a keyword. We do not receive your email address, phone number or password from Instagram.
- What we keep: a handled-reply record (comment id or sender id, the account, the matched keyword, what was sent, the status or error code, timestamps) and, if you sent STOP, an opt-out record. The replier does not save the text of your comment or message. The separate OpenReply campaign tool on the same server can keep a log of comment text and display name for campaigns created in it.
- Retention: records currently have no automatic expiry. We use them only to avoid duplicate replies and to honour STOP, we delete them on request, and we review and clear old records at least once a year.
How we use it
Only to send you the one reply you asked for by commenting or messaging a keyword, to avoid sending the same reply twice and to honour STOP. We do not use this data for advertising, do not sell it, and do not build profiles from it. Links in messages may carry campaign tags such as a source name, which tell us which post led to a visit.
Who can see it
The data sits on a virtual server we rent from OVH, a European hosting provider, and is visible to the people who run the accounts, currently Oren Gabay. We do not share it with anyone else, except Instagram and Meta, which operate the platform and API, or where the law requires it.
Deleting your data
See how to delete your data. Account owners can also disconnect the account in the dashboard, which deletes the stored token.
Contact
Oren Gabay, Miami, Florida, USA, gabay.oren3@gmail.com.