Instagram DM Inbox ("the service") is an independent productivity tool that lets an Instagram Business account owner mirror their own incoming Instagram direct messages into their personal Obsidian vault on their own device. This policy describes what data the service handles and how.
What we collect
When you connect your Instagram Business account, the service stores:
- Your two Instagram account identifiers. Instagram Login for Business issues two per account, and the message webhook may arrive carrying either, so both are stored to match an incoming message to you.
- A long-lived Instagram access token issued to the service by Meta.
- An API key the service generates for you. It is what your Obsidian plugin uses to authenticate, and it is not derived from anything Instagram gave us.
- Your funnel stage names and their trigger codes, so the server can recognise a code you typed at the end of a reply. This is configuration you wrote, not anything read from Instagram.
- Inbound direct messages addressed to your account: sender ID, sender username, message text, timestamp, and the Instagram message ID.
- A contact record for each person who messages you: their Instagram user ID, their username, their Instagram profile name where they have set one, the funnel stage you have filed them under, and when they were last seen.
- The identifier of the most recent message you sent in each conversation, so the same reply is not processed twice.
The username of the account you connect is read once, at the moment you connect, and shown back to you on the page that follows so you can confirm you connected the account you meant to. It is not stored.
Beyond the fields listed above, we collect nothing: no follower or following lists, no media, no insights or metrics, and no content outside the messages in your own conversations.
How we use it
Inbound DMs are queued on the server only so that the companion application running on your own device can retrieve them and write them into your local Obsidian vault.
The access token is used to (a) subscribe your account to Instagram message webhooks, (b) resolve sender usernames for inbound DMs, and (c) read the most recent message in each of your conversations, about twice a minute. That third use exists because Instagram does not send a webhook for messages you send yourself, and it is how a trigger code typed at the end of your own reply moves a conversation to another funnel stage. It means the text of your own most recent reply in each conversation is read by the service. That text is matched against your trigger codes and is not stored.
We never send, edit, or delete messages on your behalf.
Permissions we request
When you connect your account, Instagram asks you to grant two permissions, and the service uses each only for what is described above.
instagram_business_basicidentifies the Instagram professional account you connected, and resolves the username and profile name of a person who messages you so their notes are filed under a readable name instead of a numeric ID.instagram_business_manage_messagesreceives your inbound direct messages through Instagram's webhook, and reads the most recent message in each conversation so that a trigger code at the end of a reply you sent can move that conversation to another funnel stage. It is never used to send, edit or delete a message.
Both can be withdrawn at any time by removing the app from Instagram, under Settings, Apps and websites. That revokes the token at Instagram immediately, so all processing stops. The service discards its own copy of the token as well: either when Instagram notifies it, or, if that notification does not arrive, within about a minute, as soon as Instagram refuses the next request the service makes. See Your rights below for deleting the rest.
Retention
- Inbound DMs are deleted from the server as soon as your companion application acknowledges retrieval (typically within seconds).
- The access token is discarded as soon as Instagram stops honouring it, which is what deauthorizing does. Nothing else is removed at that point.
- Your two Instagram identifiers, your API key, your funnel configuration, and your contact records persist until you request data deletion. Deauthorizing deliberately leaves them, so that reconnecting later does not lose the funnel stages you have assigned. Use the deletion request below to remove them.
Sharing
We do not sell, rent, or share any data with third parties. There is no advertising, no analytics, no tracking, and no profiling. Data leaves Meta's systems only to be relayed to your own device.
One processor is involved in that relay: the service runs on Railway, which hosts the application and its database. Railway stores only what is listed above, only for the retention periods listed above, and acts solely on our instructions. No other third party receives your data.
Your rights
- Deauthorize: remove the service from your Instagram account settings at any time. That revokes the token at Instagram straight away, and the service discards its own copy within about a minute even if Instagram's notification never reaches it.
- Delete all data: request full deletion of your account, access token, and any queued messages. After deletion you will be issued a confirmation code as proof.
Contact
For data deletion requests or privacy questions, email jkmoona@gmail.com.