Privacy policy

What Hold That does

Hold That is an early-stage service for Instagram Reels and posts shared in DMs, public Threads posts, public TikTok videos, direct image or video shares that pass security checks, and text notes. It keeps the source, available transcript, summary, tags, notebooks, and related notes together.

What Instagram shares with Hold That

When you message @holdthatreel, Meta sends us the information needed to deliver and answer that message. Depending on what you send and what Instagram makes available, we may receive and store:

• Your Instagram-scoped account identifier.
• Your message text, replies, quick-reply choices, message identifiers, timestamps, and delivery metadata.
• Reel or post URLs, attachment information, media identifiers, captions, creator handles, poster images, and available image or video files associated with what you send.

We do not receive your Instagram password, contacts, entire Saved tab, full account history, or private conversations with other accounts. We receive the conversation and media you choose to send to @holdthatreel, plus information Instagram exposes for those specific items.

We treat every attachment as untrusted. Unsupported files—including PDFs, documents, archives, executables, HTML, and unknown formats—are recorded only as sanitized quarantine metadata. We do not open, render, parse, preserve their download link, or send them to AI. Direct image and video shares must come from an approved Meta media host, remain within strict size limits, and match an allowed file signature. Accepted images are decoded and re-encoded before storage or analysis; the original signed download URL is then removed.

Other information we collect

As you use the service, we may also store:

• Notes you send, notebook names, and automatically suggested tags.
• Feedback you submit in a DM or through the signed-in website.
• Generated transcripts, summaries, and takeaways.
• Hashed, short-lived sign-in tokens and your most recent login time.
• A stable Hold That account identifier plus provider-scoped Instagram, Threads, TikTok, or email identifiers when you choose to connect those accounts. We require provider verification before joining identities and do not store social-account passwords in this identity record.
• Names, scopes, expiry dates, last-used times, and one-way hashes for MCP/API tokens you create. The plaintext token is shown once and is not stored.
• A keyed, one-way referral-abuse fingerprint when a referral reward is redeemed. It does not contain your raw Instagram identifier.
• Subscription status, plan, billing period, and Stripe customer identifiers.
• Settings and consent choices, including AI, language, transcript, proactive-message, and Terms acceptance preferences.
• Limited website, webhook, processing, cost, and error logs used for reliability, measurement, fraud prevention, and security.

Instagram message delivery is handled by Meta, and your private sign-in link is sent only through your Instagram chat with us.

Payment details are collected and processed by Stripe. Hold That does not receive or store your full card number, bank account, or tax ID.

How we use information

We use this information to receive and preserve saved items; retrieve available media; generate requested transcripts, summaries, translations, titles, tags, and notebooks; show your private library; return results through Instagram; maintain your settings; process payments; resolve verified platform identities to one private Notebook and subscription; prevent abuse; measure whether the product works; review feedback; troubleshoot failures; and improve reliability and usability. We do not sell personal information or use the content of your private library for third-party advertising.

AI choices

When AI enrichment is on, content you submit and available context may be processed through Vercel's AI Gateway by AI providers, currently including OpenAI with Google available for failover. We use those services to create the features you requested, not to make automated decisions about eligibility, employment, credit, housing, or insurance.

Turn AI enrichment off at Settings or send AI OFF. New items will still be saved with their original link and available source details, without AI summaries, transcripts, translations, or smart filing.

Proactive Instagram messages

Transactional messages—such as a reply you requested or confirmation that an item is ready—are part of providing the service by default. You can turn save confirmations off for silent saving at Settings or by sending SILENT ON; explicit commands will still answer. Proactive reminders, recommendations, and product updates are optional and off by default for new accounts. You can change this choice at Settings or send MESSAGES ON or MESSAGES OFF in Instagram.

Service providers and disclosures

We use providers to run specific parts of Hold That, including:

• Meta and Instagram for account-scoped messaging and media access.
• Vercel for application hosting and AI routing.
• Supabase for database and media storage.
• OpenAI and Google for AI processing when AI enrichment is enabled.
• Bright Data or another configured media-retrieval provider when Instagram does not directly supply all slides or media.
• Stripe for checkout, subscriptions, and billing management.

These providers receive only the information needed for their role and process it under their own service and data-protection terms. We may also disclose information when required by law, to respond to a valid legal request, or to protect users, rights, safety, and the service.

Retention and security

Saved items, notes, notebooks, feedback, and generated content are retained according to your plan until you request deletion or the service is discontinued. The Free plan shows the most recent 30 days of Notebook history; paid plans include permanent Notebook history while the service operates. We may preserve inaccessible older Free-plan records for a limited period so an upgrade can restore them, but we do not promise indefinite recovery. Operational logs may be kept for shorter periods. A redeemed-referral fingerprint may be retained for up to 24 months solely to prevent the same account from repeatedly claiming an incentive after deletion; it is then automatically removed. Short-lived login tokens expire quickly, while an encrypted browser session may remain valid for up to 30 days unless you sign out or delete your data. We use access controls, signed webhook verification, server-only credentials, and scoped sessions, but no internet service can promise perfect security.

Access, correct, or delete your data

You can review and edit saved items, notes, tags, notebooks, and preferences in your private library. For an export, correction, or privacy question, message @holdthatreel from the relevant Instagram account so we can verify the request.

Send delete my data in an Instagram DM to @holdthatreel from the account whose data you want removed. We will use that message to verify the requesting account and delete its saved items, notes, notebooks, feedback, generated content, raw Instagram identifiers, and associated message records. If a referral reward was redeemed, the keyed one-way anti-abuse fingerprint described above may remain for up to 24 months. Requests are completed within 30 days.

Children

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has used the service, contact us so we can investigate and delete the information.

Changes to this policy

We may update this policy as the product changes. We will revise the effective date and provide reasonable notice before material changes take effect.

Contact

For privacy questions, message @holdthatreel on Instagram.