Privacy Policy

Xreply collects only the data necessary to function:

• Account info: name, email, and a hashed password (for authentication).
• Instagram info: Instagram account ID and username (to send DMs on your behalf).
• Comment data: comment text, commenter username, and media ID (to match keywords and trigger automations).
• Access tokens: Instagram access tokens (stored encrypted, used only to call Meta's APIs).

Solely to automate sending Instagram DMs when comments match your configured keywords, and to send public comment replies you enable. We do not sell, share, or use your data for any other purpose.

You connect your Instagram account using Instagram Login (OAuth). We never ask for or store your Instagram password. We process comment content only to evaluate your automations and send the messages you configured.

You can delete your account at any time, which permanently removes your account, connected Instagram accounts, automations, comment events, DM logs, and payment history. Deletion is available in the dashboard (Profile → Danger zone → Delete account) or via our Data Deletion page, and any active subscription is cancelled as part of the process. Deletion requests are processed immediately and all data is removed within 30 days.

You may request deletion of your data at any time through the dashboard or the Data Deletion page. We do not sell or share personal data, and we retain comment and DM records only while your account is active to deliver the service and for debugging.

We call Meta's Instagram Graph API using your tokens. Payments are processed by Razorpay under their privacy policy. No other third party receives your data.

For data deletion requests or questions, use the Data Deletion page or email the support address listed on the app.