Privacy Policy

This policy explains what DraftsReady does with your information. It is written to be read, not skimmed. If anything is unclear, write to hello@draftsready.com.

DraftsReady is operated by YouFact LLC, 224 W 35th St, Ste 500, New York, NY 10001, United States, the controller of the data described here.

What DraftsReady does

DraftsReady connects to your Instagram professional account with your permission. It reads your posts and comments, and, when you switch on Direct in Settings, reads your Direct conversations too. It writes suggested replies for comments and messages. A reply is sent only when you press Send. DraftsReady never sends a reply on its own, and it never sends a reply you have not seen.

What we ask for

You connect DraftsReady through the Facebook Page linked to your Instagram account, not by signing in to Instagram directly. That connection asks for these eight permissions:

• instagram_basic — your account's name, username, profile picture and your recent posts, so the app can show you which post a comment belongs to.
• instagram_manage_comments — the comments on your posts, and the ability to publish the reply you approve.
• pages_show_list — the list of Facebook Pages you manage, so we can find the Page linked to your Instagram account.
• pages_read_engagement — reads that Facebook Page, which is how we locate the Instagram account linked to it.
• business_management — used only inside the Facebook sign-in, so you can grant access to a Page or Instagram account that belongs to a Meta business portfolio. We do not read or change your business portfolio, ad accounts, people or roles.
• instagram_manage_engagement — liking or unliking a comment when you press its heart. Hearts on Direct messages use instagram_manage_messages.
• instagram_manage_messages — reading Direct conversations, showing suggested replies, and sending the reply you approve. Message hearts also use this permission.
• pages_manage_metadata — subscribing the linked Facebook Page to notifications for new Instagram comments, so DraftsReady can check for them sooner. It is not used for Direct-message notifications.

We also ask Meta for one messaging feature, Human Agent. It gives DraftsReady no additional data. If Meta approves it, then after Instagram's standard 24-hour reply window it lets you send a reply by hand for up to 7 days after the person's last message: you review or write the reply and press Send, and DraftsReady marks that one message with Meta's HUMAN_AGENT tag. It is never automatic and is never used for promotions.

We do not ask Meta for your email address, follower lists, insights, advertising access or the ability to publish posts. Information we receive from Instagram or Facebook in this way is referred to below as Meta Platform Data, and we use it only as described in this policy and as permitted by Meta's Platform Terms.

What we store

When you connect an Instagram account, we store:

• Your Instagram account id, username, display name and profile picture address.
• An access token, encrypted at rest. We never see or store your Instagram password.
• Your recent posts: caption, link, media type, timestamp, a cached copy of the thumbnail image, and extracted text from post images and speech from your videos (we send the video file itself to OpenAI to transcribe its speech); we store the extracted text, not those media files.
• The comments on those posts: the text, the commenter's Instagram username, the timestamp, and which comment a reply belongs to.
• When Direct is switched on, conversation and message IDs, the other person's Instagram ID and username, message text and timestamps, and the replies you send.
• For Direct attachments and shared posts, links and limited details such as type or title. We store links and metadata, not copies of the media files. Voice-message audio is sent to OpenAI for transcription; we store the transcript, not the audio.
• Direct reply drafts and their status, and whether you have added a heart to a Direct message. We also store the Instagram ID of a person whose chat you mute, so we can keep skipping that chat.
• The drafts we write for you, each saved version of a draft as you edit it, and the reply that was finally sent.
• The style rules and facts you enter or approve, and examples of your own past replies that the app uses to learn your voice.
• Counts of drafts written and model usage, used for limits and billing.
• A log of failures (for example, a reply Instagram refused), so we can tell you what went wrong.
• Limited technical diagnostics when a request fails or stalls, or a draft-card button is blocked: action or button label, timing, error or HTTP status, page visibility and connection state. The server log includes only the last four characters of the account id. These diagnostics never include comment text, draft text or instructions.
• When someone opens a Meta App Review access link, we record when it was opened, the kind of browser used and the name of the network it came from; we do not store the IP address.
• Your email address and the sign-in methods you add, your sign-in session, and any feedback you send us from inside the app.

If you request early access, we also store the handle, email address and answers you give in that form.

People who comment on or message you

To draft a reply we necessarily hold comments and, when Direct is switched on, messages: their text, the person's Instagram username and the time they were sent. We use them only to prepare a reply for the account owner to review and send. We do not use them to build a profile of that person, contact them elsewhere or advertise to them. They are deleted with the account data on the schedule below. If somebody wants their comment or message removed from our copy sooner, they can write to hello@draftsready.com with a request.

What we do not store

• Passwords. Facebook authenticates you; we never see the password.
• Payment details. There is no payment yet, so we collect none.
• Follower lists or the audience data Instagram calls insights.
• Anything from an Instagram account that has not connected to DraftsReady, other than the public comments left on the posts of an account that has.

Connecting an AI chat (optional)

You can connect DraftsReady to an AI chat you use, such as ChatGPT or Claude, to read and work on your drafts from that chat. Nothing is shared with a chat until you sign in to DraftsReady, choose the Instagram account, choose what to share with it (comments, Direct messages or both) and press Allow. You can change what a chat sees, or disconnect it, at any time in Settings → Connected chats, and the change applies at once. Only a link to a post picture the chat already received can keep working for up to 7 days, unless you disconnect the chat.

While a chat is connected, and when you ask it to, it can receive: the captions of your posts and their thumbnail pictures; the comments on them with each commenter's username; if you chose to share Direct messages with that chat, recent Direct messages with the other person's username; the drafts we wrote; your style rules and facts; your Instagram username; and how many drafts you have left this month.

Before Direct messages are shown to a chat's AI, we replace a message that contains a card number or mentions certain health topics with "[hidden — open in DraftsReady]", and we hide email addresses and phone numbers in common formats. Bank account details such as an IBAN are shown as written, so you can check them in the chat. When you send a Direct reply from the DraftsReady card inside the chat, the card receives the full text of that reply, so the chat's service may see it too. We never pass a chat your Instagram access token or anything from another account.

The chat's provider (for example OpenAI for ChatGPT, or Anthropic for Claude) receives this data under your own account with them. Their terms and privacy policy apply to it, including whether it may be used to improve their models, which you control in that service's settings. For this data they act independently of DraftsReady, not on our behalf.

When you ask, a connected chat can write, change or skip drafts, skip, archive or restore comments and chats, pause or resume drafting for a post, mute or unmute a person and suggest notes for your style. A reply is still sent only when you press Send, in DraftsReady or on the DraftsReady card shown inside the chat, and a style note is saved or removed only when you confirm it there.

To make the connection we use WorkOS, a sign-in service based in the United States. While you connect, it sees your IP address and browser type, and it keeps a random identifier for each connection, not your name or email address.

For each connection we store which chat it is and when you connected it, and a record of your consent: the date, the version of the consent text, the Instagram username you chose and a one-way fingerprint of your IP address. We also store single-use codes behind the Send button inside the chat; each expires after 10 minutes.

Who we send it to

We share your data only with the service providers that run DraftsReady, each only for the purpose described below, and with an AI chat if you connect one:

• OpenAI — AI processing: drafting suggested replies to comments and Direct messages (using the comment or recent conversation text, the person's username and your voice rules and facts), rewriting a draft when you ask, turning your dictation into text, and transcribing voice messages sent to you. For drafting replies to comments, we also send the text and images of your own posts to read their text, and the video files themselves to transcribe their speech; we store the extracted text, not the files. OpenAI does not use data sent through its API to train its models.
• Anthropic — automated analysis with Claude, Anthropic's AI model, to check and improve draft quality: the model looks over comments, Direct messages, the drafts we wrote for them and your voice rules and facts, and helps find out why a draft went wrong. The analysis is done by the model, not by people reading your conversations; our team works with its conclusions. Model training is switched off for this use, so Anthropic does not use this data to train its models.
• Railway — hosting of the application, its database and server logs, in the United States.
• Amazon Web Services — storage of encrypted database backups, in the United States.
• Meta — Instagram itself: reading your posts, comments and (when switched on) Direct messages; sending the replies and message hearts you choose; and receiving webhook notifications for new comments.
• Google — sign-in with Google, if you choose it, and our support mailbox, if you write to us.
• Resend — sending DraftsReady's own emails to you: sign-in codes and links, email-address confirmations and account notices, in the United States.
• WorkOS — sign-in for connecting an AI chat, only if you connect one.
• An AI chat you connect — only what is described under "Connecting an AI chat", and only after you allow it.

That is the whole list. We use no advertising networks and no analytics that identify a person. We do not sell your data, and we do not share it with anyone else, except with an AI chat you choose to connect.

How long we keep it

• While your account is connected, we keep the data above.
• Encrypted backups of our database are kept for up to 90 days and are used only to recover from a failure.
• Technical diagnostic lines are kept in Railway's hosting logs under its log-retention period. They may remain there after you delete your account.
• When you disconnect an Instagram in DraftsReady, we erase that Instagram's token at once. When you remove DraftsReady in Facebook, we erase it at once or as soon as Meta confirms whose login the connection uses. We delete the rest of its data after 30 days unless you reconnect.
• A Meta data-deletion request deletes the applicable Instagram data at once, or as soon as Meta confirms whose login the connection uses, and returns a confirmation code. This applies to the Instagram accounts connected with that Facebook login, including ones connected on someone else's behalf. If you sign in to DraftsReady with that Facebook login, this covers every Instagram in your account, and your whole DraftsReady account if Facebook is your only way to sign in.
• When you press Delete account, everything is deleted straight away — see below — except, sometimes, your Facebook user ID (next item), and the AI-chat consent and connection records described above.
• After Delete account we ask Facebook to withdraw the access you gave DraftsReady through your Facebook login, unless another Instagram connected to DraftsReady still uses that login. If that cannot be finished straight away, we keep your Facebook user ID, and nothing else about you, for at most 30 days and only to finish withdrawing it. It is removed sooner if you connect again or remove DraftsReady inside Facebook.
• When you disconnect an AI chat, it loses access at once. We keep the record of your consent as proof of what you agreed to; when you delete your account we remove the Instagram username and the IP fingerprint from it. Send codes are deleted after they expire, normally within 7 days. Records of a chat connection (which chat, when it was connected and used, no message content) stay after you disconnect it or delete your account and are deleted after about 30 days. Whatever a chat has already received stays in that chat's history under its provider's rules; you can delete it there.
• Early-access requests are kept until you ask us to delete them.
• Feedback you send from the demo without an account is kept for up to 365 days and then deleted. Feedback sent from inside a connected account goes when that account's data goes.
• A receipt of a deletion request survives the deletion, because Instagram asks us to be able to confirm that a request was carried out. It holds the confirmation code and the date, and a one-way fingerprint of the Instagram account id — not the id itself, and nothing else about you.

How to delete your data

Removing DraftsReady in Facebook disconnects the Instagram you connected with that Facebook login: its token is erased at once or as soon as Meta confirms whose login the connection uses, and its other data is deleted after 30 days unless you reconnect. A Meta data-deletion request deletes the applicable Instagram data at once, or as soon as Meta confirms whose login the connection uses, and returns a confirmation code. Delete account in the app deletes everything at once.

• Inside DraftsReady — open Settings or the account menu and choose Delete account. It immediately removes your DraftsReady account, email, sign-in methods, sessions, workspaces and all their Instagram accounts, tokens, posts, comments, Direct conversations and messages, Direct drafts, transcripts, attachment metadata and links, muted-chat records, draft versions, style rules, facts, send codes of connected AI chats and application database log entries, along with cached post thumbnails on disk. Our AI spending records stay, with your account replaced by a one-way fingerprint that names neither you nor your Instagram, so daily spending limits keep counting. Each subscription is cancelled when no connected Instagram remains in its workspace; Stripe may retain billing records it must keep. Technical diagnostic lines already written to Railway's hosting logs follow the log-retention period above. Account deletion is permanent and cannot be undone.
• Remove Facebook access — Facebook → Settings & privacy → Settings → Business integrations, or Apps and websites. This disconnects the Instagram you connected with that Facebook login. We erase its token at once or as soon as Meta confirms whose login the connection uses, and delete its remaining data after 30 days unless you reconnect.
• Meta data deletion — Ask Meta to delete your data. We delete the applicable Instagram data at once, or as soon as Meta confirms whose login the connection uses, and Meta gives you a confirmation code to check the status.
• By email — write to hello@draftsready.com and we will do it for you.

This applies to the Instagram accounts connected with that Facebook login, including ones connected on someone else's behalf.

If you sign in to DraftsReady with that Facebook login, this covers every Instagram in your account, and your whole DraftsReady account if Facebook is your only way to sign in.

Your rights

You can ask us what we hold about you, ask us to correct it, ask for a copy, and ask us to delete it. Write to hello@draftsready.com and we will answer within 30 days. Removing DraftsReady in Facebook disconnects the Instagram you connected with that login: we erase its token at once or as soon as Meta confirms whose login the connection uses, and delete its other data after 30 days unless you reconnect. A Meta data-deletion request deletes the applicable Instagram data at once, or as soon as Meta confirms whose login the connection uses, and returns a confirmation code. Delete account in the app deletes everything at once.

Security

Your Instagram access token is encrypted at rest and is never written to a log. Traffic to and from DraftsReady is encrypted in transit. Each account's data is reachable only through that account's own signed-in session. We keep what we hold to the minimum the job needs, and we do not send your data to anyone beyond the providers listed above and an AI chat you choose to connect.

Children

DraftsReady is for Instagram professional accounts and is not directed at children under 13. We do not knowingly collect data from them.

Changes and contact

If this policy changes, we will update the date at the top of this page and, if the change is significant, tell you inside the app. Questions, corrections and deletion requests go to hello@draftsready.com.