The short version
Ins Autopilot never asks for your Instagram password and never performs actions outside the tasks you configure. Instagram page content, profiles, follower lists, comments, Direct Messages, page URLs and session information are read and processed locally as needed for those tasks. This content is not uploaded to Ins Autopilot servers except when you explicitly choose our managed AI service and select content for a request. If you enable AI Draft and explicitly request a draft, your instructions and selected context go directly to your chosen provider when using your own API key, or through our backend to the managed provider when you select Ins Autopilot AI. Message excerpts are included only when you choose to include them (see AI Draft). A limited set of account, device, usage, license, billing and support data is sent securely to our services to enforce plan limits, deliver purchases, manage subscriptions and process refund requests. Optional tracked links also send the destination URL and an opaque contact reference to our servers and store open timestamps and counts.
Repost URLs, thumbnails, scan results, and cleanup history are processed and stored locally in your browser and are not uploaded to our servers. Our service receives only your Instagram numeric account ID and aggregate Cleanup attempt and verified-removal counts needed to enforce daily plan limits.
What we collect
- Instagram account identifiers — your numeric Instagram user ID and username, used to keep accounts separate, bind licenses and enforce plan quotas.
- Extension instance information — a randomly generated device ID and extension version, used to verify that billing and refund links are opened by the installed extension. This is not a hardware fingerprint.
- Usage records — timestamps and per-action counts for follows, unfollows, likes, comments and DMs, used to enforce plan limits, prevent duplicate counting and show account statistics.
- Installation authentication and Trial access — the extension creates an installation signing key locally and registers its public key with our backend. The private key is not uploaded. We store the public installation identifier, request IDs and hashes, request times, Trial grants, and the association between an installation, account ID, recipient ID and message Attempt. Signed delivery observations include a result source, correlation reference and observation time; they contain no message text. Installation authentication does not independently prove Instagram account ownership or delivery. We derive a hashed network IP key to limit new Trial grants and record rejection counts for abuse monitoring. New Trial access does not require registration or a Bot inbox/code. Previously created Enrollment associations and challenge audit records may remain as historical records; new Trial requests do not read the Bot inbox. Your Instagram password and authentication cookies are not sent by the extension to our backend.
- Outreach Trial records — if you use the one-time Outreach Trial, we store its state on our servers: when it started, when it ends, the stable numeric Instagram IDs of its confirmed and pending contacts, and daily reservation counts. The trial allows up to five unique confirmed contacts, with one confirmed Trial DM per contact. We use these records to enforce the one-time limits, prevent the same trial contact being counted twice and reconcile uncertain delivery results. The permanent Trial balance is keyed to your Instagram account identifier and is not reset by reinstalling or changing devices. Installation authentication and anti-abuse grant limits restrict access separately from the account balance. A randomly generated device ID is recorded as an anti-abuse signal for observation; it is not account ownership proof. We also record trial milestones and checkout or payment events to understand trial conversion. No message text is stored.
- License and billing records — license key and binding status plus Stripe customer, subscription, invoice, payment, charge and refund identifiers needed to deliver paid access, manage renewal and reconcile refunds. We never receive or store full card details.
- Email address — when you purchase a plan, recover a license or contact support.
- Refund and support information — the reason and optional note you submit, review status, approved amount and operational audit history needed to handle your request.
- Tracked-link click records — only if you create a tracked link yourself: we store the link's destination address, which license and Instagram account it belongs to, an opaque reference for the contact you attached it to, and the first and last time the link was opened plus a total count. See Tracked links below. Other people can also create records that involve you in a few limited cases: a customer paying through your referral link adds a reward entry to your account, an Ins Autopilot user sending you a Trial DM records your account's numeric ID as their trial contact, and our staff can add audit notes while handling your refund, application or support request.
What we never collect
- Your Instagram password — the extension runs inside the browser session where you are already logged in.
- Other accounts' profile content and your posts, stories, messages (DMs), comments and follower lists are not uploaded to our servers except for the Enrollment verification message processing described above, or when you explicitly select content for Ins Autopilot AI as described below. Your own account identifiers, numeric Outreach Trial contact IDs and optional tracked-link data are exceptions described above; optional AI Draft sends selected content directly to your chosen provider, or through our backend when you explicitly choose Ins Autopilot AI, as described below. The extension may read or process the minimum necessary Instagram page content locally to perform an action you requested.
- Browsing history outside the Instagram pages the extension operates on.
- Instagram authentication cookies or CSRF tokens on our servers. They remain on your device and are used only for requests to Instagram.
How data is stored
Preferences, target URLs, Safe List entries, filters, local action history, message templates and queues are stored locally in your browser via chrome.storage. Your relationship history — who you contacted, the outcome you recorded for each one, the source you attributed it to, and any follow-up you chose to schedule — is stored locally in your browser too, along with your saved AI provider address and key. Account, quota, license and short-lived access-token data is stored on Cloudflare Workers infrastructure. Billing and refund audit records are stored in our Cloudflare database. Data is transmitted over HTTPS and is not sold or used for advertising.
If you open this website from the extension with an Instagram account ID, the website remembers that numeric ID in this browser for up to seven days to help you return to checkout. Tabs keep separate account choices. A remembered ID does not prove who is logged in to Instagram: you must confirm the account before checkout. Choose “Use another account or an activation code” in the checkout dialog to clear the saved ID. We do not store Instagram passwords or session cookies for this feature.
Website analytics
This website uses Google Analytics 4 to count visits and see which pages are read. It is the only third-party measurement on insautopilot.com. It is provided by Google LLC and sets two first-party cookies — _ga and _ga_<container id> — which let it tell one browser apart from another. The measurement ID for this site is G-PLT8Z147BV.
We read the totals to decide what to write next and to notice pages that are broken. We do not use it for advertising or retargeting, we do not link it to Google Ads or Google Signals, and we do not sell this data. You can block these cookies in your browser settings or with a content blocker; the site works the same without them.
The extension itself sends nothing to Google Analytics. Only pages under insautopilot.com are measured.
AI Draft (optional, off by default)
AI Draft is an optional feature that stays switched off until you turn it on yourself. If you choose to bring your own API key, you choose an AI provider, type the address of its API and paste in your own API key. That address and key are kept locally in your browser via chrome.storage. Your API key is never sent to our servers and we have no way to read it.
When using your own API key and asking AI Draft to write something, the content you choose to include is sent directly from your browser to the AI provider you configured. It does not pass through Ins Autopilot servers, and we do not keep a copy of it. Depending on what you tick, that content may include excerpts of the Instagram page or of your Direct Messages for the item you are drafting. Nothing is sent unless you explicitly press the draft button for that item, and message content is included only when you tick the "include messages" option for that draft.
AI generates a draft only when you explicitly request it. You review the message and choose whether to send it. The generated text arrives in an editable box and stays a draft. Generating a draft never sends it to Instagram, adds a recipient to a queue or starts a follow-up. There is no background or scheduled AI generation. After reviewing the text, you can explicitly press Send DM or add it to a sending queue; a queue you start then sends under its configured limits and safety checks.
When using your own API key, because the request goes straight to your provider, it is that provider — not Ins Autopilot — that receives and processes the content, under its own terms of service and privacy policy. Please read them before you enable AI Draft, and only use a provider you are willing to send that content to. Requests are made over HTTPS, and the extension asks Chrome only for access to the exact API address you typed. If you later change provider or turn AI Draft off, access to the address you no longer use is released.
Ins Autopilot AI (optional server service): You may instead choose our managed AI service without supplying a personal API key. This requires separate consent in AI settings. When you explicitly request a draft or qualification suggestion, chosen instructions, context and any selected message excerpts pass through our backend at api.insautopilot.com to our configured AI provider. We use your signed account entitlement to check Pro access and a derived account reference to limit requests. Our application does not store prompts or generated results in its databases, analytics or application logs. The AI provider may process or retain submitted content under its own terms. The managed provider is Command Code (Langbase, Inc.), which routes requests to the selected model provider; see its privacy policy and terms. Provider retention applies; zero retention is not promised. Managed access requires verification of the subscription email. Verification emails are delivered using Resend. We temporarily process the submitted email and current account ID for access checks. The verification service stores code hashes valid for 10 minutes, up to 5 attempts per challenge, and access-session secret hashes valid for up to 30 days. Expired server verification and session records are cleaned within approximately one hour. It stores no prompts, generated results or provider keys. Browser access credentials stay locally until sign-out, turning AI off or browser data removal; expired credentials do not grant access. Service availability and request limits apply. A connection test sends only a fixed test prompt. Our provider API key stays on the backend; your personal API key is never sent to our backend.
For your own provider, Chrome's permission prompt and your consent inside the extension are two different things and both are required: Chrome asks before the extension may contact your provider's address, and AI Draft stays off until you have read the disclosure and ticked the box yourself. You can turn AI Draft off at any time; that removes the stored API key from your browser.
AI access security. HTTPS requests to our backend include network connection information such as the source IP address. For AI email verification and access checks, our application derives a hashed rate-limit key from the connecting IP address to prevent abuse; it does not send that address to the AI model or use it to determine your precise location. Cloudflare processes request metadata as our infrastructure provider. AI Qualification follows the same opt-in processing rules as AI Draft and returns suggestions for you to review; it does not apply fields or send messages by itself.
Tracked links (optional)
Ins Autopilot can create a tracked link for you. This only happens when you ask for one — you type the destination address yourself and press the create button. Nothing is rewritten automatically and links you paste without using that control are not tracked.
When you create one, the link we give you points at our backend and redirects to the destination you typed. This means that when someone opens that link, the request passes through Ins Autopilot before reaching the destination. At that moment we record that the link was opened: the time of the first open, the time of the most recent open, and a count of opens.
We use this for one thing only: conversion attribution inside your own dashboard — so the contact you attached the link to can show "link opened" next to "link sent". We do not receive, store or use the visitor's IP address, browser fingerprint, device identifiers or any cross-site tracking data, and we do not record anything about the destination page itself.
An open does not mean anything about the person. A recorded open is not a statement that they are interested, qualified, booked or won. Those remain facts you confirm yourself and record yourself; the extension never derives them from an open. A link can also be opened by a preview bot, by the recipient's mail or messaging client, or by anyone the message is forwarded to, and the record cannot tell those apart.
You can turn tracked links off at any time in the extension. With tracking off the extension behaves exactly as before — you can still send links, they are simply ordinary links and no open is recorded. Turning tracking off does not invent or alter any click data.
Click records are stored on our Cloudflare Workers infrastructure, transmitted over HTTPS, and are not sold, shared with advertisers or used for advertising. They are kept so that the attribution history in your dashboard stays correct; a record is removed when you ask us to remove it (see Contact). This version has no automatic expiry for click records.
Referral program (optional)
Referral participation is optional. When you explicitly load the referral panel, the extension sends the current Instagram account ID and existing device identifier to our backend to verify account access and create or retrieve a stable referral code. Loading your panel does not contact your Instagram followers. Copying or sharing a link is your choice. When someone subscribes after using your link or entering your code, we record a referral attribution: the referral code, the Stripe customer identifier of the person who paid, the related subscription and invoice references, and the reward terms that applied at the moment the attribution was created.
We use this to calculate a reward for the person who referred — a billing credit for regular accounts, or a commission for approved partners — and to answer questions about it later. Rewards are recorded as amounts in US cents together with their status. If a payment is refunded or disputed, the related reward is reversed or reduced; we keep the record of both the original reward and the reversal so the history stays accurate.
A friend’s server-signed referral credential is saved locally for the selected Instagram account until removed or expired. At checkout, it is sent in the request body to our backend for validation; it is not placed in the checkout URL. Partner applications send the contact email, channel URL, channel type and description you submit for manual review. Authorized administrators can view these applications and referral accounting records. Contact [email protected] to request correction or deletion; transaction and reward records may be retained where required for accounting, disputes or legal obligations.
What we do not collect for referrals: we do not read your browsing history, we do not fingerprint your browser, we do not look visitors up across sites, and we do not attach a referral to a person by guessing. The referral link only tells us which code was used. If you never subscribe, no reward is created and no payout exists.
If you apply to the partner program, we collect the contact email, channel URL, channel type and short description you type into the form. This is used only to review the application and to reply to you. Applications submitted from the website are not linked to an account until an operator verifies ownership; a form submission never changes your account status by itself.
Referral records are stored on our Cloudflare infrastructure and shared with Stripe only as the payment processor that holds the subscription and applies any billing credit. They are not sold or used for advertising. Referral and application records are kept while the program operates so that past rewards and payouts remain auditable; you can ask us to delete your application details at any time (see Contact), and we will keep only what is needed to satisfy tax and accounting obligations.
Data retention & deletion
Daily quota windows reset automatically. Operational logs have limited retention; purchase, billing and refund records may be retained for accounting, fraud prevention, dispute handling and legal obligations. To request access, correction or deletion, email [email protected]. We will remove data that we are not required to retain.
Third parties
The extension interfaces with Instagram pages in your own browser session. Cloudflare provides our application and storage infrastructure, Stripe processes payments, subscriptions and refunds, Resend delivers transactional license emails, and Google LLC provides the website analytics described above, processing that data as our service provider and also under its own privacy terms. Tencent Cloud (trtc.io) provides the live chat widget that is loaded on every page of this site, so the messages you send through that chat are processed by that provider. Each provider processes only the data needed for its service. We do not run advertising or retargeting trackers on this site and we do not sell personal data.
Chrome Web Store Limited Use
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data handled by the extension is used only to provide or improve its disclosed Instagram automation, licensing, billing, security and support functions.
Contact
Questions or requests: [email protected] · or use our WhatsApp live help.
Instagram is a trademark of Meta Platforms, Inc. Ins Autopilot is an independent product and is not affiliated with, endorsed by, or sponsored by Instagram or Meta Platforms, Inc.
