Privacy Policy — Moments Insight

1. What is Moments Insight?

Moments Insight (@vault.moment on Instagram) lets you DM a public Instagram Reel link to our Instagram Business account to get a private, secure vault link for it. We only act when you message us — we never initiate contact or collect data without your explicit action.

2. What Data We Collect

When you use our service, we collect the following data — all of which is user-initiated:

• Instagram Data (user-initiated only): Your Instagram username, App-Scoped User ID (ASID), and the message content (public Reel URL) you send to @vault.moment. We receive this via Instagram Graph API webhooks only when you send us a message.
• Account Data: If you open your claim link, we collect your Google login email (via Google OAuth) to create your private vault.
• Technical Data: We store an encrypted reference ID of the Reel and your claim token. We DO NOT store or download the raw video file.

We do not collect your Instagram password, private messages (other than the DM you send us), followers, following list, or any data you did not explicitly send to us.

3. How We Use Your Data

• To receive your DM and reply with a secure, expiring claim link within the 24-hour messaging window allowed by Meta.
• To create and secure your personal vault.
• To extract knowledge insights (transcriptions, summaries, knowledge cards) from the Reels you share.
• To prevent abuse and for debugging purposes.

We do not send promotional messages. We do not sell, rent, or share your data with third-party advertisers.

4. Third-Party Services

We use the following third-party services to operate:

• Instagram Graph API / Facebook Graph API (Meta) — for receiving DMs and sending replies via webhook
• Google OAuth — for vault login authentication
• Supabase — encrypted database with row-level security
• Vercel — hosting
• OpenAI — for transcription and insight extraction (we do not use your content to train AI models)

5. Data Retention

• Instagram message logs and claim tokens: auto-deleted after 30 days or after you claim your vault, whichever comes first.
• Vault account and insights: retained until you request deletion.
• Raw Reel video: Never stored. We only store an encrypted reference ID.

6. Your Rights & Data Deletion

You can request deletion of all your data at any time via the process described on our Data Deletion Instructions page. We will permanently delete all associated data within 7 business days.

We also support Meta's Data Deletion Callback. If you remove our app via Facebook/Instagram settings, Meta will send us a signed deletion request, which we handle automatically.

7. Children's Privacy

Our service is not intended for users under the age of 13. We do not knowingly collect data from children under 13. If we learn we have collected data from a child under 13, we will delete that data immediately.

8. Changes to This Policy

We may update this privacy policy from time to time. Continued use of the service after changes constitutes acceptance. We will notify users of significant changes via the service.

9. Contact Us

For privacy questions or data concerns, contact us at akirakurotsume@gmail.com