saywink

Privacy policy

Last updated: November 8, 2026

SayWink lets owners of Instagram professional accounts answer comments with automatic direct messages. This policy explains what we collect, why, and how to delete it. SayWink is operated by [company name] (operator of SayWink). Contact: [contact email].

Account owners (people who connect an Instagram account)

When you connect your account through Instagram's official login, we store:

  • your Instagram professional account ID, username, name and profile picture URL;
  • the access token Instagram gives us, encrypted (AES-256) and used only to run your automations;
  • the rules you create (posts, keywords, message texts and links) and the API keys you create for AI clients (we keep only a hash of each key).

We use these only to show your dashboard, run your rules and refresh your token before it expires. We read your recent posts so you can pick one for a rule; we don't copy your posts or messages elsewhere.

People who comment or send messages to a connected account

When someone comments on a connected account's post or replies to one of its automatic messages, Instagram sends us the event. We store the Instagram-scoped user ID, the username when Instagram provides it, the comment or message text and what the automation did (for example “link sent”). The account owner sees this in their activity log. We may check whether that person follows the account, only after they message it, as Instagram allows. This activity is deleted automatically after 90 days.

What we don't do

  • We don't sell or rent personal data, and we don't use it for advertising.
  • We don't use Instagram data to train AI models.
  • We don't send messages beyond what the account owner's rules and Instagram's messaging rules allow.

Service providers

  • Meta Platforms (Instagram APIs), which delivers comments and messages and sends our replies.
  • Vercel (hosting) and Neon (database), which store and process data on our behalf.
  • AI clients you choose to connect (for example Claude or Codex) receive the data you ask them to read through your API key, under their own terms.

Cookies

We use one essential cookie to keep you signed in to your dashboard, plus a local setting for the light or dark theme. No tracking cookies.

Deleting your data

Removing SayWink from your Instagram account (Settings › Apps and websites) deletes your account, rules, keys and activity from SayWink. You can also follow the steps on Data deletion or write to [contact email]. People who commented on a connected account can ask us to delete their activity the same way.

Security

Tokens are encrypted at rest, webhook calls are verified with Meta's signature, and every request is scoped to the signed-in account. No system is perfectly secure; we'll notify affected owners of any breach as the law requires.

Changes

We'll update the date above when this policy changes and tell connected owners about material changes.