Privacy Policy

Coldopen helps creators and small brands manage their own Instagram professional accounts: reading direct messages and comments, drafting replies with AI, and sending replies the account owner allows, including automatic replies when the owner turns them on within the safe-reply rules. This page explains what we store and why.

Coldopen is a product of ALTURA Society LLC. ALTURA Society LLC is the data controller for the personal data described on this page.

What we store

• Profile basics: your Instagram account ID, username, and profile picture link.
• Access tokens: the token Instagram gives us when you connect. It is readable only by our server, never by a browser or phone.
• Messages: direct messages sent to and from your connected account, with the sender's Instagram ID and username.
• Comments: comments on your own posts, with the commenter's Instagram ID and username.
• Your account: the email you sign in with, your brand settings, and the drafts you create.
• People you choose to contact: the Instagram usernames, notes and draft openers you save in your People list. Only you can see them, and you can delete any person at any time.

Public posts we use to find leads

To suggest people who publicly asked for what a user built or sells, Coldopen reads public posts from Reddit, Hacker News, Product Hunt and X. We only read what anyone can see without signing in.

• What we collect: the public post text, the poster's public handle, a link to the post, and the date it was posted.
• Why: to show a user people who asked for something like what they offer, with a fit score and a drafted first message. Nothing goes to these people until the user approves it; then the user sends it, or the user's own Coldopen Helper sends it from the user's browser when the user has Autopilot on.
• How long we keep it: leads that are not acted on are deleted after 90 days. Leads a user saves stay in that user's People list until the user deletes them or closes their account.
• Asking to be removed: email support@usecoldopen.com with your handle and the site, and we will delete what we hold about you and add you to a do not suggest list within 30 days.

Why

• To show you your Instagram inbox and comments in one place.
• To draft replies in your brand's voice for you to review, or send safe replies automatically when you turn that setting on. Automatic replies stay within the safe-reply rules. Sensitive messages (complaints, billing, money, legal, health, spam) and first messages are held for you.
• To send the single private reply someone asked for when they comment a keyword you published.
• To show you reply rates and other stats about your own account.

Coldopen Helper (Chrome extension) permissions

• instagram.com: the Helper opens the chat with the person you approved, fills your approved message into the message box, and confirms the chat and the text match.
• Sending: when Autopilot ("Coldopen sends for me") is on for that account, the Helper presses Instagram's send button for approved messages only, paced and capped, never from 11pm to 8am your time, and never for held conversations. When Autopilot is off, it only fills the box and you press Enter. It stops that account for 24 hours on any Instagram warning, failed send, captcha or login screen. Turn Autopilot off any time in Settings, from the phone app, or with Stop Autopilot on the Helper's pill.
• Storage: a device ID, a short-lived sign-in key and the run state, kept in the extension. Your Instagram password is never read or stored.
• coldopen.com tabs: to receive the next approved message and report what was sent.

How long

• Messages and comments are kept while your account is connected, so your inbox history works.
• When you disconnect in Settings or remove Coldopen in Instagram, your token is deleted right away.
• When you or Meta request deletion, your account record, token, messages, and comments are deleted immediately. Backups roll off within 30 days.

Who we share it with

We do not sell your data or show ads. Only these service providers process data on our behalf:

• Supabase: database and hosting, via Lovable Cloud.
• Lovable: app hosting.
• OpenAI: drafting replies.
• Sentry: error reports with personal details removed, and short screen recordings of some sessions with all text and typing hidden, used only to fix bugs.

Requests from public authorities

ALTURA Society LLC reviews every request for user data from a public authority to confirm it is legal before responding. We disclose only the minimum data necessary. We document every request, our response and the reasoning behind it.

Security

Data is encrypted at rest and in transit. Every row is scoped to the account owner, and tokens are never exposed to the browser.

Your choices

You can disconnect at any time. To delete your data, follow the steps on our data deletion page.

Contact

Contact Coldopen at support@usecoldopen.com.