Skip to content
Social TARS

Privacy policy

Last updated 8 August 2026

Social TARS replies to comments on your Instagram posts and sends follow-up direct messages on your behalf. Doing that requires handling some personal data, both yours and that of people who interact with your posts. This page explains exactly what is held and why.

Who this covers

Two groups. Creators are people with a Social TARS account who connect an Instagram account. Commenters are people who comment on a creator's post or message them, and who never sign up for anything here.

What is collected from creators

  • Your email address and a hashed version of your password. The password itself is never stored.
  • The Instagram account you connect: its account ID, username, display name, and profile picture.
  • An access token issued by Instagram, encrypted before it is written to the database.
  • The automations you build, and counts of how often they ran.

What is collected from commenters

  • The Instagram-scoped ID and username of anyone whose comment or message triggers one of your automations.
  • The text of that comment or message, and of anything Social TARS sent in reply.
  • Whether they tapped a button or a link, so a creator can tell whether an automation is working.
  • Any tag a creator's automation applies, such as marking someone as having asked for a particular link.

This data comes from Instagram as a consequence of interacting with a creator's post. It is not bought, scraped, or combined with data from anywhere else.

Why it is held

Only to run the automations a creator has set up, and to show that creator whether they worked. There is no advertising, no profiling, and no sale of data to anyone, ever.

Who it is shared with

  • Meta Platforms, because sending a reply or a DM means calling Instagram's API.
  • The hosting and database providers that run the service.
  • Anyone we are legally required to disclose it to.

That is the whole list.

How long it is kept

Creator data is kept while the account is open. Commenter data is kept while the creator's account is open, because the creator may need to see who they replied to. Both are deleted on request — see the data deletion page.

Security

Instagram access tokens are encrypted at rest. Passwords are hashed with Argon2. Traffic is served over HTTPS. No system is perfectly secure, and this one is young — it is stated plainly rather than dressed up.

Your rights

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Write to tmmiltd@gmail.com and you will get a reply within 30 days.

Changes

If this policy changes materially, the date at the top changes with it.