Privacy Policy

Last updated: July 4, 2026

This Privacy Policy explains how the Bodriy Leo Inbox application ("the App", "we", "our") handles information. The App is a personal automation tool that helps the owner of a single Instagram Business account automatically reply to comments and send direct messages on that same account.

1. Who this App is for

The App is operated by the owner of the Instagram account it is connected to. It does not offer accounts or services to third parties and does not act on behalf of other Instagram users. Only the account owner configures and uses it.

2. What data we access

Through the Instagram API (Instagram API with Instagram Login) the App receives:

• New comments left on the owner's posts, including comment text, the comment ID, the associated media (post) ID, and the ID of the user who left the comment.
• Basic account information required to authenticate (Instagram account ID and username).
• Message-sending capability limited to replying to people who interact with the owner's content within the permitted interaction window.

3. How we use the data

• To detect whether a comment matches keyword rules configured by the account owner.
• To publish a public reply under the matching comment.
• To send a private (direct) message to the person who left the matching comment.
• To avoid replying to the same comment more than once (deduplication).

4. What we store

We store only the minimum needed to operate: the owner's automation rules, a global on/off setting, the IDs of comments already processed (for deduplication), and the Instagram access token. Data is stored in a private Upstash Redis database accessible only to the App. We do not sell data and do not share it with third parties for advertising.

5. Data retention

Processed-comment markers are automatically deleted after a short period. Rules and settings are kept until the owner deletes them. The owner can erase all stored data at any time by clearing the App's database or removing the deployment.

6. Data deletion

To request deletion of any data associated with the App, contact name.xru@gmail.com. Because the App only processes data for the owner's own account, revoking the App's access in Instagram settings and deleting the deployment removes all stored data.

7. Third-party services

• Meta / Instagram — provides the API and webhook events.
• Vercel — hosts the application code.
• Upstash — provides the Redis database used for storage.

8. Security

Access tokens and secrets are kept in server-side environment variables and are never exposed publicly. Incoming webhook requests are verified using a signature so that only genuine events from Instagram are processed.

9. Changes

We may update this policy; the "Last updated" date will reflect any changes.

10. Contact

Questions: name.xru@gmail.com