Privacy Policy

This policy explains what DraftsReady does with your information. It is written to be read, not skimmed. If anything is unclear, write to hello@draftsready.com.

DraftsReady is operated by YouFact LLC, 224 W 35th St, Ste 500, New York, NY 10001, United States, the controller of the data described here.

What DraftsReady does

DraftsReady connects to your Instagram professional account with your permission. It reads your posts and the comments under them, and writes a suggested reply for each comment. A reply is published only when you press Send. DraftsReady never posts anything on its own, and it never sends a reply you have not seen.

What we ask Instagram for

We ask for exactly two permissions and nothing else:

• instagram_business_basic — your account's name, username, profile picture and your recent posts, so the app can show you which post a comment belongs to.
• instagram_business_manage_comments — the comments on your posts, and the ability to publish the reply you approve.

We do not ask for direct messages, follower lists, insights, advertising or the ability to publish posts. Information we receive from Instagram in this way is referred to below as Meta Platform Data, and we use it only as described in this policy and as permitted by Meta's Platform Terms.

What we store

When you connect an Instagram account, we store:

• Your Instagram account id, username, display name and profile picture address.
• An access token, encrypted at rest. We never see or store your Instagram password.
• Your recent posts: caption, link, media type, timestamp, and a cached copy of the thumbnail image.
• The comments on those posts: the text, the commenter's Instagram username, the timestamp, and which comment a reply belongs to.
• The drafts we write for you, each saved version of a draft as you edit it, and the reply that was finally sent.
• The style rules and facts you enter or approve, and examples of your own past replies that the app uses to learn your voice.
• Counts of drafts written and model usage, used for limits and billing.
• A log of failures (for example, a reply Instagram refused), so we can tell you what went wrong.
• Your sign-in session, and any feedback you send us from inside the app.

If you request early access, we also store the handle, email address and answers you give in that form.

People who comment on your posts

To draft a reply we necessarily hold the comment itself: its text, the commenter's public Instagram username and the time it was posted. We use it for one purpose only — writing the reply you will approve — and we never use it to build a profile of that person, to contact them anywhere else, or for advertising. It is deleted together with the rest of your data, on the schedule below. If somebody who commented on your posts wants their comment removed from our copy sooner, they can write to hello@draftsready.com and we will delete it.

What we do not store

• Passwords. Instagram authenticates you; we never see the password.
• Payment details. There is no payment yet, so we collect none.
• Direct messages, follower lists, or the audience data Instagram calls insights.
• Anything from an Instagram account that has not connected to DraftsReady, other than the public comments left on the posts of an account that has.

Who we send it to

We share your data only with the service providers that run DraftsReady, and only for that purpose:

• OpenAI — AI processing: drafting suggested replies and turning dictation into text. OpenAI does not use data sent through its API to train its models.
• Railway — hosting of the application and its database, in the United States.
• Meta — Instagram itself: reading your posts and comments and publishing the replies you approve.
• Google — our support mailbox, if you write to us.

That is the whole list. We use no advertising networks and no analytics that identify a person. We do not sell your data, and we do not share it with anyone else.

How long we keep it

• While your account is connected, we keep the data above.
• When you disconnect, we immediately stop reading your account and erase the stored access token. The rest is deleted 30 days later, so that reconnecting within a month does not lose your style settings.
• When you press Delete account, everything is deleted straight away — see below.
• Early-access requests are kept until you ask us to delete them.
• Feedback you send from the demo without an account is kept for up to 365 days and then deleted. Feedback sent from inside a connected account goes when that account's data goes.
• A receipt of a deletion request survives the deletion, because Instagram asks us to be able to confirm that a request was carried out. It holds the confirmation code and the date, and a one-way fingerprint of the Instagram account id — not the id itself, and nothing else about you.

How to delete your data

Three ways, all of which work:

• Inside DraftsReady — the Delete account button in the account menu. It removes the account, the token, every post, comment, draft, draft version, style rule, fact, usage record and log entry we hold for you, along with the cached thumbnails on disk. It is immediate, permanent and cannot be undone.
• Inside Instagram — Settings → Apps and websites → DraftsReady → Remove. Instagram notifies us the moment you do. We immediately destroy your access token and stop reading your account, and we delete everything else within 30 days. The reason for the pause is that reconnecting within a month brings your style rules and settings back instead of starting you over. If you would rather not wait, use the Delete account button or write to us, and it goes at once.
• By email — write to hello@draftsready.com and we will do it for you.

Your rights

You can ask us what we hold about you, ask us to correct it, ask for a copy, and ask us to delete it. Write to hello@draftsready.com and we will answer within 30 days. You can withdraw Instagram's permission at any time from inside Instagram, under Settings → Apps and websites; DraftsReady stops reading your account the moment you do.

Security

Your Instagram access token is encrypted at rest and is never written to a log. Traffic to and from DraftsReady is encrypted in transit. Each account's data is reachable only through that account's own signed-in session. We keep what we hold to the minimum the job needs, and we do not copy your data anywhere else.

Children

DraftsReady is for Instagram professional accounts and is not directed at children under 13. We do not knowingly collect data from them.

Changes and contact

If this policy changes, we will update the date at the top of this page and, if the change is significant, tell you inside the app. Questions, corrections and deletion requests go to hello@draftsready.com.