Privacy policy

Who runs this service

Viral is a self-hosted tool operated privately at viral.albushari.com. It is not a commercial product, it has no other users, and it does not sell, rent, or share data with anyone.

What the service does

Viral connects to one or more Instagram Professional accounts belonging to the operator. When someone leaves a comment containing a configured keyword on one of those accounts' posts, Meta sends this service a webhook, and the service replies to that person with a Direct Message.

What is stored

About the operator

• Email address, name, and a bcrypt hash of the password.
• Session records: a hashed session token, the browser or device description, and timestamps.
• Instagram account details returned by Meta — the account id, username, account type, and profile picture URL — together with an access token encrypted at rest with AES-256-GCM.

About people who comment

• The Instagram-scoped user id Meta provides (an IGSID, which identifies the person only to this application), their username, the text of the comment, and the comment's id.
• Whether a DM was sent, skipped, or failed, and why.

This is the minimum needed to send the reply the comment asked for, to avoid messaging the same person twice, and to show the operator whether the automation worked.

What is never stored

• Instagram passwords. Access is granted through Meta's OAuth flow and revoked from Instagram at any time.
• Direct message conversations. The service sends one message and does not read a person's inbox.
• Payment details. Nothing here takes payment.

How long it is kept

Automation logs are retained for 90 days and then deleted. Raw webhook payloads are retained for 30 days for debugging. Expired and revoked session records are purged after 30 days. Instagram account records are deleted immediately when the account is unlinked, together with that account's triggers and logs.

Sharing

Data is not shared with third parties. The service communicates with Meta's Graph API to receive comments and send messages, and with nothing else. It runs on a single server operated by the operator; there are no analytics scripts, advertising trackers, or third-party embeds on any page.

Your choices

If you commented on a post and would rather not have been messaged, or want the record of your comment deleted, contact bigmbushari@gmail.com and it will be removed. Meta's data-deletion callback is also honoured: a deletion request made through Instagram removes the corresponding records here.

The operator can revoke this application's access at any time from Instagram under Settings → Website permissions → Apps and websites.

Security

Traffic is served over HTTPS only. Instagram access tokens are encrypted at rest. Passwords are hashed with bcrypt and are not recoverable. Session tokens are stored as SHA-256 digests, rotate on every refresh, and a replayed token revokes every session for that account.

Changes

Any change to this policy is published on this page with a new date at the top.