pingback

Privacy Policy

Last updated: October 6, 2026

Pingback lets owners of Instagram professional accounts send a direct message automatically to people who comment on their posts and reels. This policy explains what data Pingback handles, why, who else sees it, how long we keep it, and what you can do about it. It covers the website, the dashboard and the Pingback mobile apps.

Who we are

Pingback is run by Pingback (“we”, “us”). For people who sign up to Pingback, we’re the data controller. Questions, requests or complaints: hello@trypingback.com.

For the people who comment on our customers’ posts, we act on behalf of the Instagram account owner who connected Pingback: they decide which comments get a DM and what it says, and we process the comment only to do that for them. If you commented on someone’s post and have a question, you can ask them or email us, and we’ll help either way.

What we collect

When you sign in

  • Your email address, and one-time sign-in codes (stored hashed, for 10 minutes)
  • For each signed-in session: the IP address and browser or device (user agent) it was started from, kept until the session ends
  • Short-lived counters of sign-in attempts, to stop abuse

When you connect an Instagram account

  • The account’s Instagram ID, username and a link to its profile picture
  • The access token Instagram issues so Pingback can act for the account, stored encrypted, and when it expires
  • The rules you create: trigger words, how they match, the DM text, the public reply text, and which post or reel a rule is for
  • Your posts, reels and captions, fetched from Instagram when you pick one for a rule. They’re shown to you, not stored

When someone comments on a connected account

Instagram sends us each new comment on the connected account’s posts and reels. We store, for every comment, including ones that match no rule:

  • The comment’s text and ID, and the post or reel it was on
  • The commenter’s Instagram ID and username
  • What Pingback did: the DM and public reply it sent, or why it didn’t send one, and when

When you pay

Paid plans bought on the web are sold by Dodo Payments, the merchant of record, which collects your card, billing address and tax details under its own privacy policy. Plans bought in the mobile app are sold by Apple or Google, and we hear about them through RevenueCat. We never see your full card number. We keep only what we need to run your plan: your customer and subscription IDs with Dodo, Apple or Google, your plan, billing period, status, price and renewal date, and how many activities you’ve used each month.

How you use Pingback

We record the main things you do in Pingback, such as signing up, connecting or disconnecting an Instagram account, creating, pausing or deleting a rule, each DM your rules send or fail to send, and changes to your plan, with the time, whether it happened on the website or in the app, and your Pingback user ID. We send these, with your email address and plan, to our analytics provider, Mixpanel. They never include comments, messages, commenters or Instagram usernames: accounts and rules are named only by our own IDs.

On the website, if you allow analytics, we also record which pages you visit, the site or campaign that brought you, your browser and device type, and an approximate location worked out from your IP address. This stores an ID in your browser (see Cookies). In the mobile app, if you allow analytics, we record which screens you use, when you open the app, the steps of buying a plan, the app version, your device model and operating system, and an approximate location, with an ID stored on your phone. You can turn it off under Accounts in the app. If you don’t allow it, or your browser sends Global Privacy Control, none of this is collected. We don’t use advertising trackers.

Why we use it

  • To provide Pingback (performing our contract with you): signing you in, matching comments to your rules, sending your DMs and public replies through Instagram’s API, showing you your activity, counting activities against your plan, and emailing you about your account, such as when an Instagram account needs reconnecting.
  • To keep it safe and working (our legitimate interests): preventing abuse and fraud, securing sessions, and finding and fixing errors.
  • For commenters’ data (the account owner’s legitimate interest in answering comments on their own posts, which the commenter asked for by commenting): only to send the DM and reply the owner set up and to show the owner what happened.
  • To understand and improve Pingback: seeing which features people use, where they get stuck, and how many stay. For what you do in Pingback, that’s our legitimate interest in improving the service you signed up for; for pages you visit on the website and screens you use in the app, it’s your consent, which you can withdraw at any time.
  • To meet legal obligations, such as answering lawful requests.

We don’t sell data or use it for advertising. We use analytics only to improve Pingback, and never to build profiles of commenters.

Instagram Platform Data

Data we get from Instagram is used only to provide Pingback to the account owner who connected it, as described here, and in line with Meta’s Platform Terms and Developer Policies. We don’t sell it, license it, use it for advertising, or share it except with the service providers below, who process it for us.

Who else gets data

We use these service providers, who process data only on our instructions:

  • Vercel hosts the website and app, and so handles every request, including IP addresses.
  • Neon hosts our database, which holds everything listed above.
  • Inngest runs our job queue, which carries comment text, commenter IDs and usernames while DMs are sent.
  • Resend sends our emails, so it gets your email address and the email itself.
  • Dodo Payments sells web plans as merchant of record, and gets your email address along with the payment details you give it.
  • RevenueCat, Apple and Google handle purchases in the mobile app. RevenueCat gets your Pingback user ID and your purchase history from the store.
  • Meta (Instagram) provides the API Pingback works through: it sends us comments, and receives the DMs and replies your rules send.
  • Mixpanel provides our product analytics, and gets what’s described under “How you use Pingback”: your Pingback user ID, email address, plan and the things you do in Pingback, and, if you allow it, the pages you visit on the website and the screens you use in the app. It gets no Instagram data.
  • Sentry, when error reporting is on, gets reports of errors, which can include the page, browser and account involved.

We may also disclose data if the law requires it, or to a buyer if Pingback is sold, who would have to keep this policy’s promises.

How long we keep it

  • Comments that matched no rule: deleted after 30 days.
  • Other activity (comments that got a DM, and what was sent): deleted after 12 months.
  • Signed-in sessions: until you sign out or they expire, after 30 days at most.
  • Disconnecting an Instagram account in Pingback, or asking Meta to delete the data Pingback has from it, deletes its access token, rules and activity immediately.
  • Removing Pingback in Instagram’s settings deletes the account’s access token straight away and stops all processing of its comments. Its rules and activity stay, so you can reconnect, until you disconnect it or delete your Pingback account.
  • Deleting your Pingback account deletes everything we hold about you, straight away, including your profile in Mixpanel. The analytics events recorded before then stay, under an ID that no longer leads to you or your email. Billing records kept by Dodo Payments, Apple and Google, as merchants and payment processors, stay with them under their own legal obligations.

Everything else is kept while your account is open. Deleted data can stay in our database provider’s encrypted backups for a short time before they roll over.

Your rights

Depending on where you live, you can ask us to give you a copy of your data (including in a format you can take elsewhere), correct it, delete it, restrict how we use it, or object to how we use it. You can do a lot of this yourself: edit or delete rules, disconnect accounts, and delete your whole account (see Data deletion). For anything else, email hello@trypingback.com from the address you sign in with. We reply within 30 days. We may ask you to confirm it’s you before acting.

Commenters can make the same requests about their comments. Email us with your Instagram username and we’ll handle it, telling the account owner where needed.

California residents

We don’t sell or share personal information, as the CCPA defines those terms, and never have. We collect the categories listed above (identifiers such as email, IP address and Instagram IDs; commercial information about your plan; and the content of comments and messages) for the purposes above. You have the right to know, access, correct and delete your personal information, and we won’t treat you differently for using those rights.

International transfers

Our providers store and process data in the United States and other countries, which may have different data protection laws from yours. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

Security

Data is sent over encrypted connections, Instagram access tokens are encrypted at rest, and access to our systems is limited to what running Pingback needs. No system is perfectly secure, but if a breach affects your data we’ll tell you and the authorities as the law requires.

Children

Pingback is not for anyone under 16, and we don’t knowingly let them sign up. If you think a child has an account, email us and we’ll delete it.

Cookies

Pingback needs a few cookies to work: one that keeps you signed in, one that remembers which Instagram account the dashboard shows, and short-lived ones that protect connecting Instagram from forged requests. Your browser also remembers whether you allowed analytics, so we don’t ask again.

Analytics is the only optional storage, and we ask before using it. If you allow it, Mixpanel’s script stores a random ID in your browser’s local storage to tell your visits apart. There are no advertising cookies. You can change your choice at any time:

Complaints

If you’re unhappy with how we handle your data, please tell us first at hello@trypingback.com. You also have the right to complain to the data protection authority where you live or work.

Changes to this policy

We’ll update this policy when Pingback changes, and change the date at the top. If a change matters, we’ll tell you by email or in the app before it takes effect.