Privacy policy

Hookline is a free tool made and run by alva (Santi Alva), an independent creator. “We” in this policy means them. Contact: alvaacompany@gmail.com.

• Your Hookline account: With an access code we store no personal details at all: no email, no phone, just the display name you pick. With email sign-up we store your email and a hashed password (never the password itself).
• Signed-in devices: For each device you sign in on, we keep its IP address, browser and device type, so you can see and sign out devices in Settings → Devices. These records expire after 30 days, or when the browser closes if you untick “Keep me signed in”.
• Your Instagram connection: When you connect a professional Instagram account through Meta's official login, we store its Instagram user ID, username and an access token. The token is encrypted (AES-256-GCM). We never see your Instagram password.
• Comments on your posts: To find comments that match your keywords, Hookline reads the recent comments on your own posts about once a minute. For every comment it reads, it keeps only the comment ID, so it never answers the same comment twice. For comments that match an automation, it also logs the commenter's username, the comment text, and what it did (reply posted, DM sent, or the error).
• Your settings: Your automations, DM defaults, safety limits, quiet hours (including your time zone), language and display preferences.
• Alert email (optional): If you add one in Settings → Alerts, we use it only to send those alerts and the daily recap you switched on.
• Connected AI apps (optional): If you connect an AI app (Claude, ChatGPT, Cursor and others), we store the app's name, a scrambled copy of its access key, and when it was last used.

Only to run Hookline for you:

• posting the public replies and sending the DMs your automations define, inside the limits you set;
• showing your Activity, Connection health and alerts;
• keeping your account secure (sessions, rate limits, abuse prevention).

We don't use your data or your followers' data for ads, profiling, selling, or training AI models. Hookline sends messages only through the automations you create, and reads only comments on your own posts.

Data that comes from Instagram is used only to provide the features above, in line with Meta's Platform Terms and Developer Policies. It isn't shared with anyone except the service providers listed below, who process it on our behalf.

If you commented on a Hookline user's post:your username and comment may be stored in that creator's activity log. Ask the creator, or email us, and we'll delete it.

When you press Allow on the “wants to connect to your Hookline” screen, that app can do exactly what the screen lists: see your accounts and posts, manage automations, read activity and run a comment check. It can't see your password or post to Instagram. What you then share inside that AI app is covered by that app's own privacy policy. Disconnect any app anytime in Settings → Connect your AI.

Only the ones Hookline needs: a sign-in cookie, and small preference cookies for language, the cursor sticker, motion and smooth scrolling. No advertising or analytics cookies, no trackers, no third-party scripts.

• Vercel: hosts the website and runs the app.
• Neon: hosts the database.
• Meta (Instagram): reading your comments, posting replies and sending DMs happens through Meta's official API.
• Resend: sends alert emails, only if you add an alert email (not switched on yet).
• Upstash: counts requests per IP address for a few minutes to stop abuse (not switched on yet).
• PayPal / Venmo: process donations if you choose to give. We never see card details.

Your account, settings and automations stay until you delete them. You can clear the activity log anytime (Settings → Your data). Device sessions expire after 30 days. Disconnecting an Instagram account deletes its token, automations and activity right away. Deleting your account deletes everything tied to it.

Everything travels over HTTPS. Instagram tokens are encrypted, passwords and AI-app keys are stored only as hashes, every request is checked so you can only ever reach your own data, and sign-ins and APIs are rate limited. No system is perfect: if you find a security problem, email alvaacompany@gmail.comand we'll fix it fast.

Wherever you live, you can:

• See and export: your activity, as a CSV file, in Settings → Your data;
• Correct: your name and settings anytime in Settings;
• Delete: your Instagram connection, your activity log, or your whole account yourself;
• Ask us: for anything else (a copy of your data, deletion of a comment you left on someone's post). We answer within 30 days.

See data deletion for the step-by-step.

We only hand over user data when the law requires it. For every request from a public authority we:

• Check it: review whether the request is legally valid;
• Challenge it: push back if it looks unlawful or broader than the law allows;
• Minimize it: disclose only the minimum data the request legally requires;
• Document it: keep a record of the request, our response and the legal reasoning.

Hookline has received no such requests to date.

Hookline is not meant for anyone under 16. Instagram itself requires users to be at least 13.

If this policy changes in a way that matters, we'll say so in the app before it takes effect. The date at the top always shows the latest version.