Privacy policy

Last updated 27 September 2026

This service is a self-hosted publishing console operated by noefx6gycdef.dx4x.com. It lets the operator schedule and publish posts to Instagram professional accounts they own or manage, and optionally answer direct messages and comments automatically.

It is not a public product. Only the operator and people they create accounts for can sign in. This page explains what it stores about two different groups: the operators who sign in, and the members of the public who interact with the Instagram accounts they connect.

1. Data about operators

What	Why	Kept for
Username and a hashed password	To sign in. Passwords are stored as scrypt hashes, never in readable form.	Until the account is deleted
Instagram access tokens	To publish and reply on the connected account’s behalf	Until the account is disconnected
Connected account id, username and profile details	To show which page a post belongs to	Until disconnected
Uploaded images and video	To render and publish the posts requested	Deleted from disk on a fixed retention schedule after publishing
Scheduled posts, captions and publishing history	To run the schedule and show what happened	Until deleted by the operator

2. Data about members of the public

If the operator turns on automatic replies, the service receives messages and comments that people send to the connected Instagram account. For those people it stores only:

the Instagram-scoped user id of the sender — an identifier specific to this application, which cannot be used to look the person up elsewhere;
the text they sent;
the time it arrived, and whether a reply was sent.

The text is stored so the operator can see what was received, and the sender id so that a rule set to reply “only once per person” does not answer the same person repeatedly. No profile information, follower list, email address or phone number is collected.

3. What is never done with any of it

It is never sold, rented or licensed.
It is never shared with advertisers or data brokers.
It is not used to build advertising profiles.
It is not used to train machine learning models.

4. Who else sees it

The service runs on infrastructure controlled by the operator. Data leaves it in one direction only: to Meta Platforms, when publishing a post or sending a reply that has been asked for. That exchange is governed by Instagram’s own privacy policy. There are no analytics, advertising or tracking services embedded in this application.

5. Security

All traffic is served over HTTPS.
Passwords are hashed with scrypt and compared in constant time.
Incoming webhooks from Meta are rejected unless they carry a valid X-Hub-Signature-256 signature.
Each signed-in account can reach only its own pages, media and posts; a request for another account’s records is refused.

6. Your rights

You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be erased. Erasure is available immediately and without contacting anyone, at /data-deletion.

7. Children

This service is not directed at children and is not intended for anyone under 13. Instagram itself requires account holders to be at least 13.

8. Changes

If this policy changes materially, the date at the top of this page changes with it.

9. Contact

Questions about this policy, or about data held here:
admin@noefx6gycdef.dx4x.com