Privacy Policy

Account data: your email, password (hashed with bcrypt), and organization details. Your phone number, which we may use to verify your account and to contact you (including on WhatsApp) about your account and using the Service. You can change or remove it at any time in Settings.

Operational data you provide: Instagram usernames, message sequences, campaign targets, conversations, and resulting activity logs and statistics. For accounts in server-side mode only, also Instagram account credentials (encrypted at rest) and proxy details.

Browser extension data: when you use the extension, it sends us the results of the actions it carries out on Instagram (for example which messages were sent and whether they succeeded), the Instagram conversations it syncs to your inbox, Instagram profiles you choose to collect as leads, and basic technical data (extension version, browser time zone, error reports and an identifier for that installation). The extension only works on instagram.com and instaoutreach.com. It does not read other sites, your browsing history, bookmarks or saved passwords, and it never collects your Instagram password.

Billing data: handled by Stripe. We store your Stripe customer/subscription identifiers and plan status, never your full card number.

When someone opens a referral link we set a cookie (io_ref, kept for 60 days) that names the person who shared it, and we log the visit with the landing page, campaign tags and a one-way hash of the IP address that changes every day. We never store the raw IP address for these visits.

If that person signs up, we link their workspace to the referrer so the discount and the reward can be applied. The referrer only sees a partly hidden email address (for example ol***@g***.com), the signup date, whether a trial or plan is active, and the status of their own reward. They never see the workspace name, messages, contacts or any other data.

To prevent self-referrals we compare the signup IP range and the payment card fingerprint (supplied by Stripe, not the card number) with the referrer's. This check is used only to decide whether a reward is paid.

The Mac app runs the same engine as the browser extension, so it sends us the same kinds of data described above: action results, the Instagram conversations it syncs to your inbox, profiles it collects as leads, and the public profile and post details used to write a message. It also sends its version number and whether it is running.

What it keeps on your Mac, in ~/Library/Application Support/InstaOutreach: your InstaOutreach sign-in (email, workspace and an access key, protected by the macOS Keychain where the build supports it), a random device identifier and your app settings; a separate Instagram session (cookies and site data) for each account, so each account stays logged in; each account's activity log, which names the Instagram accounts it contacted; a small screenshot of each account's window for the app's own overview; the last exit IP address, country and username of each proxy; and the numbers shown in the desktop widget (today's messages, replies and each account's plan). Logs are kept in ~/Library/Logs/InstaOutreach and name the accounts the app worked with. None of this leaves your Mac unless described here.

What it fetches from us, only to log in: for accounts where you saved them, the Instagram password and the current two-factor code, which it types into Instagram's login form, and the account's proxy details including the proxy password. These are held in memory only and never written to disk. When Instagram emails a login code, our server reads it from the mailbox you configured and passes on the code; your email password never reaches the app. Every time a password or code is handed out we keep an audit record of it.

Diagnostics: when an Instagram page stops working as expected, the app sends what went wrong, its CPU and memory load as percentages, its last five log lines (which can contain Instagram usernames), and an outline of the page's structure with all text and values removed. It sends no screenshots, no crash reports and no list of your files or other apps. To show you which IP address and country Instagram sees, the app asks ipinfo.io for it once through each account's proxy and, at most every 30 minutes, from your Mac's own connection.

How to delete it: Disconnect in the app signs it out and revokes its access key, but keeps the Instagram sessions on your Mac. To remove everything, quit the app and delete /Applications/InstaOutreach.app, ~/Library/Application Support/InstaOutreach and ~/Library/Logs/InstaOutreach. Step-by-step instructions are on instaoutreach.com/mac. Data already sent to us is deleted with your account, or on request (see Your rights).

Solely to operate the Service for you: running campaigns, showing your dashboard and stats, sending transactional email (verification, password reset, billing), and providing support. We do not sell your data or use it for third-party advertising.

The use of information received from the browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide the features you use, we do not transfer it to third parties except the processors listed below as needed to run the Service, and we never use it for advertising, to determine creditworthiness, or for lending. No person at instaoutreach reads it except with your permission, for security, or where the law requires.

We rely on a small set of sub-processors: Stripe and NOWPayments (payments), Brevo (transactional email), our hosting provider (Hetzner), and ipinfo.io (the Mac app's IP address and country check). Each processes data only to provide its function, under its own privacy terms.

Instagram credentials for server-side accounts are encrypted at rest; the app and the extension communicate over TLS. We retain your data while your account is active and delete your organization's data on account deletion, subject to legal retention requirements (e.g. invoicing records).

You can request access, export, correction, or deletion of your personal data, and object to certain processing, by emailing [email protected]. Deleting your account removes your organization's operational data.