Commentless Privacy Policy
The short version: you share an Instagram post with Commentless, one of our own Instagram accounts does what the creator asked, and the creator's reply is copied into your private inbox in the app. You sign in anonymously: we never ask for your name, email, phone number, or your Instagram account or password. We store the links you share, the resources sent back to you and a notification token, so that the app can work. Our staff see the post links you share, but not who you are. Creators only ever see a Commentless account. There are no ads, no analytics and no tracking, and we never sell data. You can delete one request or everything at any time in the app.
1. Who we are
Commentless is made by [Developer name] ("we", "us"). We are responsible for the data described in this policy. You can reach us at support@commentless.app.
Commentless is not affiliated with, endorsed by or sponsored by Instagram or Meta.
2. What Commentless does
Many Instagram creators offer a free resource (a GitHub repository, a PDF, a template, a guide) to anyone who comments a keyword, likes the post or follows them. Commentless gets those resources for you without you engaging publicly:
- On Instagram, you tap Share on the post or reel and pick Commentless (or paste the post's link into the app).
- We read what the creator asks for: a comment keyword, a like, a follow.
- A member of our staff uses one of Commentless's own Instagram accounts to do it, by hand, in the Instagram app. That account, not yours, publicly likes, follows or comments on the creator's post, as the creator asks.
- The creator sends the resource to our account in a direct message. We copy it into your private inbox in the app and send you a notification.
If someone has already got the resource for the same post through Commentless, we can deliver it to you straight away.
Creators decide whether to reply. Most do, but some requests may not succeed. Commentless works with Instagram posts and reels today. The app is free, has no ads and no in-app purchases, and is available in English, Hindi and Urdu.
3. Signing in: anonymous only
When you start the app, it signs you in with Firebase Anonymous Authentication. This creates a random user ID (for example Xy12…). It is not linked to your name, email address, phone number, Google account or Instagram account, and you never create a password.
- We never ask for, receive or use your Instagram account, username or password.
- We never give creators your name, email address or phone number. If a creator asks for personal details like an email address, the request ends as unsuccessful, because we never give them on your behalf.
4. Data we store on our servers
Everything below is linked only to your random user ID, and our database rules let only your copy of the app read it.
| Data | Why | How long |
|---|---|---|
| The links you share (the Instagram post or reel URL), plus any other text the share includes (Instagram usually sends only the link) | To know which post you want a resource from | Until you delete the request or all your data |
| The keyword you type, if you choose to ("Know the keyword? (optional)") | To help us go faster | Same as above |
| Request details added by us: the request status (for example "Waiting for the creator's reply"), the creator's public Instagram handle, a short excerpt of the post caption, what our account did (liked, followed, commented "LINK"), and dates | To show you the progress of each request | Same as above |
| Resources the creator sends to our account in reply: links, message text, and files such as PDFs, images or videos, copied into your private inbox (files go into your own private storage folder) | To deliver what the creator promised | Until you delete the request or all your data |
| Your inbox choices: which items you saved and the folder names you set | To organise your inbox | Until you change them or delete your data |
| A Firebase Cloud Messaging (FCM) token for your device | To send you notifications about your requests | Until you delete all your data (tokens that stop working are removed automatically) |
| Your app language (English, Hindi or Urdu) | To remember your language choice for the service | Until you delete all your data |
5. Data processed automatically for security
Like most online services, Firebase (run by Google) processes some technical data when the app connects: your IP address, device and app information (such as the app version and the type of device), and a Firebase Installation ID used to deliver notifications. This is used to run the service, deliver notifications, keep sign-in secure and prevent abuse. We do not use it to work out your location and we do not use it for advertising. Technical logs on our servers may contain your random user ID and are deleted automatically, normally within 30 days.
6. Data on your phone
The app also keeps a small amount of data in its private storage on your phone: whether you have seen the introduction, your language choice, and copies of your requests and inbox so the app opens quickly (and, before the service is connected, requests waiting to be sent). Other apps cannot read it.
Uninstalling the app, or using Android's Clear storage for it, removes this data from your phone. It does not delete the copies on our servers (see section 12). Commentless does not take part in Android's automatic app backup.
7. Who can see your data
- You. Your requests and inbox are private to you.
- Commentless staff (operators). To act on a request, our staff see the post link you shared and any keyword you typed. They do not see your Instagram account, your name or anything else about you beyond a random ID, and they do not see your inbox.
- Creators and other Instagram users. They only ever see a Commentless account liking, following or commenting. They never see your account, your name or that you asked.
- Google (Firebase). Google processes the data in sections 4 and 5 on our behalf as our service provider (see section 9).
- Meta (Instagram). Creators' replies reach our own Instagram accounts, and we receive them through Meta's official Instagram Messaging API. To identify a post, we may send the post's public link to Meta's official oEmbed service. We never send Meta anything about you.
- Nobody else. We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers. We would only disclose data if the law required it.
8. Shared post records
Because a creator's resource usually belongs to the post rather than to one person, we keep one record for each post that anyone has shared, so we only engage once and later users can get the resource instantly. A post record contains: the post link, the creator's public handle and caption, what our account did, the keywords users typed for that post, the creator's reply (links, text and files), and the list of requests currently waiting for that post.
While your request is waiting, that list contains your random user ID and request ID. When your request finishes or you delete it, you are removed from the list. Post records do not store your identity, so they stay after you delete your data and are used to serve other people who share the same post. The messages creators send to our accounts are kept in the same way.
9. Where data is stored and how it is protected
- Our database, server functions and file storage run on Google Cloud (Firebase) in the asia-south1 (Mumbai, India) region, which may be outside your country. Firebase Authentication and Firebase Cloud Messaging are global Google services and may process data in other locations.
- Google processes this data as our service provider under the Firebase terms and data processing terms, and may not use it for its own purposes such as advertising.
- Data is encrypted in transit (HTTPS/TLS) and at rest.
- Our database rules let only your copy of the app read your requests and inbox. Staff accounts can only act through checked server functions, and the access tokens for our Instagram accounts cannot be read by any app or person through the database.
No system is perfectly secure, but we keep the data we hold small on purpose.
10. Notifications
If you allow notifications (Android asks for permission), we notify you when a request moves forward, when the creator replies, when your resource is ready, and when a request could not be completed. We do not send marketing notifications. You can turn notifications off in Android settings or in the app under Settings → Notifications.
11. What we don't do
- No advertising and no advertising ID.
- No analytics, tracking or crash-reporting tools.
- No access to your location, contacts, camera, microphone, photos or files on your phone.
- No Instagram login, and no actions on your Instagram account. Ever.
- We do not sell personal data.
12. How long we keep data, and deleting it
We keep your requests, inbox, files, notification token and anonymous account until you delete them. You can delete your data in the app at any time:
- Delete one request: open the request in the Requests tab and tap Delete request. This removes the request and its items in your inbox from Commentless. Files that came with it are removed from your storage folder too.
- Delete everything: go to Settings → Delete all my data. This deletes all your requests, your inbox, the files stored for you, your notification token and language setting, and your anonymous account from our servers, and removes you from any post you were waiting for. It cannot be undone.
Uninstalling is not enough. Uninstalling the app removes the data on your phone, but not the copies on our servers, and after uninstalling you can no longer reach your anonymous account in the app. So use Settings → Delete all my data before you uninstall.
Deleting by email. You can also email support@commentless.app and ask us to delete your data, including if you no longer have the app. Because you sign in anonymously, we cannot look you up by name or email, so please include the post links you shared and roughly when you shared them. We will find and delete the matching requests, inbox items, files and anonymous account within 30 days and confirm by email.
What stays after deletion. Shared post records (section 8) stay, because they do not contain your identity. Technical logs are deleted automatically, normally within 30 days. Backups kept by Google for the service are overwritten on Google's normal schedule.
13. Children
Commentless is not directed at children and is not meant for anyone under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has used Commentless, contact us at support@commentless.app and we will delete their data.
14. Your rights
Depending on where you live (for example under the GDPR in the EEA or UK, India's Digital Personal Data Protection Act, or in California), you may have rights to access, correct, delete or object to the processing of your data, to withdraw consent, and to complain to your local data protection authority. You can see your requests and inbox in the app at any time and delete them there. For anything else, email support@commentless.app.
Where the GDPR applies, we process your data to provide the service you ask for (Art. 6(1)(b) GDPR), and we process technical data for security and abuse prevention based on our legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).
15. Creators
If you are a creator and our account messaged with you: we receive the messages you send to our Instagram accounts through Meta's official API, together with your public Instagram handle, and use them only to deliver the resource you offered to the Commentless users who asked for that post. To have your messages or post record removed, email support@commentless.app.
16. Changes to this policy
If we change how Commentless handles data, we will update this page and its effective date. If a change is significant, for example collecting a new type of data, we will also tell you in the app before it takes effect.
17. Contact
[Developer name]
Email: support@commentless.app
Policy: https://commentless.app/privacy