Privacy Policy

Last Updated: August 12, 2026

At Insight Social ("we", "our", or "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Chrome browser extension, our website at insightsocial.app, and related services (together, the "Service").

Insight Social is a multi-platform social media data extraction tool. It currently supports nine platforms: Facebook, Twitter/X, LinkedIn, Threads, Instagram, TikTok, YouTube, Reddit, and Pinterest. All scraping runs locally inside your own browser session — we never log in on your behalf and never see your platform credentials.

1. Information We Collect

A. Account Information

When you sign in to use the extension or the web portal, we collect the following via our authentication provider (Google Sign-In, brokered by Supabase Auth):

• Email Address: To identify your account, send transactional messages, and bind your subscription.
• Name & Profile Picture: As provided by Google, to display your profile inside the extension and portal.
• Google User ID: The opaque identifier returned by Google OAuth, used only to link your sign-ins together.

B. Scraped Public Content

The core service lets you extract publicly visible content from supported platforms — only content you can already see in your own browser. Depending on the source you choose to scrape, the data may include:

• Post & video content: text, captions, media URLs, timestamps, hashtags, and engagement counts (likes, comments, shares, views, reactions, retweets).
• Author metadata: public profile name, handle/username, profile picture URL, follower counts, and bio text where visible on the source page.
• Comments and replies: when you explicitly scrape a comment thread or post detail.
• Source context: the group, page, hashtag, search query, or feed you scraped from, plus the URL.

Scraped content is associated with your Insight Social account so you can re-open it from any device.

C. Subscription, Usage & Referral Data

• Subscription state: plan tier (Free, Pro Monthly, Pro Yearly), billing period, status, period start/end, and the export credit allowance associated with your plan.
• Export records: a record each time you export data — the session it came from, the data type, the platform, and the number of rows — so we can enforce the export credit allowance for your plan (Free includes 500 export credits / month; Pro includes 10,000 export credits / month). Scraping and viewing your results are not metered.
• Scrape session metadata: session ID, platform, source type and URL, number of items scraped, status (running, completed, stopped, failed), and whether the run was triggered manually or by a saved schedule.
• Schedules: if you configure scheduled scrapes, we store the cron expression, timezone, target source, and enabled state. Schedules fire from your browser via the extension; we do not run scrapers on your behalf when your browser is closed.
• Referrals: your referral code, who you invited, and who invited you.

D. Technical Data

• Authentication tokens: access and refresh tokens issued by Supabase Auth, stored in your browser's extension storage and used to authorize API calls back to our service.
• Local extension data: the extension uses your browser's IndexedDB to buffer scraped rows before upload, persist incomplete sessions, and remember your last view. This data lives on your device.
• Anonymous analytics: aggregate page views and feature usage on the website via Google Analytics. No scraped content is sent to analytics.

E. Google Sheets Connection (optional)

Exporting to Google Sheets is an optional feature. Nothing below is collected unless you choose Export → Google Sheetsand grant access on Google's consent screen. If you never connect, we hold none of it.

• OAuth tokens: the access and refresh token Google issues for the Sheets connection, plus the email address of the Google account you connected (so the portal can show you which account is linked).
• Spreadsheet details you provide: the ID of the spreadsheet you selected, and the tab you chose — stored so the export form can pre-fill next time.

Section 5B describes exactly what we read from and write to your spreadsheet, and how to revoke the connection.

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To extract content you request from supported platforms and return it to you as structured data (in-portal views, CSV / Excel / JSON export, and — if you connect it — export into a Google Sheet you choose).
• Account & Subscription Management: To verify your identity, enforce plan limits, and deduct export credits as you export data.
• Cross-Device Sync: So that a session started in one browser can be opened in another browser where you're signed in to the same account.
• Service Improvement: To analyze aggregate usage and improve reliability, performance, and platform coverage.
• Customer Support: To respond to your questions, debug issues you report, and contact you about material changes to the Service.

We do not sell your data. We do not use scraped content to train AI models. We do not share your data with advertisers.

3. Data Storage and Security

Local-first extraction, cloud-backed storage. Scraping happens locally inside your browser using your already-authenticated session with each social platform. As pages are parsed, the extension buffers rows in your browser's IndexedDB, then securely uploads them to our backend over HTTPS.

Server-side, your data is stored in:

• Supabase (PostgreSQL): account information, subscription state, scrape session metadata, schedules, and referrals.
• ClickHouse: the scraped content itself (posts, videos, comments, profile rows), partitioned by user and session.

Data is transmitted over TLS, stored on managed infrastructure, and scoped to your account. Access is restricted to authorized personnel for support and operational purposes.

Data Retention

We retain scraped data and account data for as long as your account is active so you can return to it later. You can delete an individual scrape session from the portal at any time. Google Sheets connection data has its own, shorter lifecycle — see Section 5B. To delete your entire account and all associated data, email support@insightsocial.app from the address on file and we will remove your records within 30 days, except where retention is required for tax, billing, or legal reasons.

4. Third-Party Services

To operate the Service, we rely on the following providers:

• Supabase: authentication (Google OAuth) and PostgreSQL hosting.
• ClickHouse: analytics-grade storage for scraped rows.
• Cloudflare: DNS, TLS termination, and CDN for our website and API.
• Polar.sh: subscription and one-time payment processing. Card details are entered on Polar's checkout and never reach our servers.
• Resend: delivery of transactional email (welcome and account messages).
• Google: sign-in identity, anonymous website analytics, and — only if you connect it — the Google Sheets API for exports (Section 5).

We do not transfer Google user data, scraped content, or your personal information to advertisers, data brokers, or any party that would use it for their own purposes.

Each provider processes data under its own privacy policy. We choose providers that we believe offer reasonable, industry-standard security.

5. Google API Services User Data Policy

Insight Social uses two independent Google integrations: sign-in, which everyone uses, and Google Sheets export, which is optional and off until you connect it. This section describes both.

A. Google Sign-In

We receive your email address, name, profile picture, and Google user ID, and use them solely to create your Insight Social account and authenticate you to it. Nothing else in your Google account is requested or accessible through sign-in.

B. Google Sheets Export

Scopes we request. Two, and only when you start the connect flow:

• .../auth/drive.file — per-file access. It covers only the individual spreadsheets you select in Google's file picker, plus any spreadsheet our app creates for you, and nothing else in your Drive.
• .../auth/userinfo.email — to display which Google account is connected, so you can tell whether you linked the right one.

What we access.You choose a destination spreadsheet in Google's own file picker, or have us create a new one. For that spreadsheet only, we read its title, the list of its tab names, and the first (header) row of the tab you select, so we can align columns. We then write the rows currently shown in your results view into that tab, creating the tab if it does not exist. We do not read any other cell, and we do not touch any other file.

We cannot browse your Drive. The drive.file scope grants access one file at a time, at the moment you select it. We have no permission — and no technical ability — to list, browse, open, or search the other files in your Google Drive. Access to a file you picked persists so that repeat exports work without re-selecting; you can withdraw it at any time from your Google account permissions page.

How we use it. Solely to perform the export you asked for. Spreadsheet contents are not read for analytics, profiling, advertising, or any other purpose.

Transfer.Google user data obtained through these scopes, and the OAuth tokens behind them, are never sold, and are never shared with advertisers, data brokers, or any other third party. They are used only by Insight Social's own servers to serve your request.

Protection. Refresh tokens are stored server-side only and are never sent to the extension or exposed in the browser. The database row holding them is protected by row-level security scoped to your account, and all traffic to Google's APIs runs over TLS. The one exception is Google's file picker: because it runs in your browser, we hand the page a short-lived access token limited to the drive.file scope, used only to display the picker and for the duration of that dialog. It is never persisted in the browser.

Retention and deletion. We keep the tokens and your last export destination only while the connection is active. Clicking Disconnect in the portal revokes the token with Google and deletes both records immediately; you can also revoke access at any time from your Google account permissions page. Deleting your Insight Social account removes them as well.

Limited Use.Insight Social's use and transfer of information received from Google APIs to any other app adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. In particular, we do not use data obtained from Google Workspace APIs to develop, improve, or train generalized or non-personalized AI or machine-learning models, and we do not transfer that data to any third party that would do so. Insight Social's AI features operate exclusively on the social content you scraped; they receive no data from your Google account.

6. Your Rights & Choices

• Access: view your scraped sessions and current subscription state from the portal at any time.
• Export: download any session as CSV, Excel, or JSON directly from the portal, or send it to a Google Sheet you own.
• Disconnect Google Sheets: revoke the Sheets connection at any time from the export modal; this revokes the token with Google and deletes it on our side (Section 5B).
• Delete: remove individual scrape sessions from the portal, or request full account deletion at support@insightsocial.app.
• Cancel: cancel a paid subscription at any time from the billing portal; cancellation takes effect at the end of the current period.
• Sign out: signing out of the extension clears your session tokens from this device.

7. Additional Rights for EEA, UK, and Switzerland Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (and the equivalent UK and Swiss laws) grants you the following rights with respect to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct data that is inaccurate or incomplete.
• Right to erasure ("right to be forgotten") — ask us to delete your personal data, subject to lawful retention requirements.
• Right to restriction of processing — ask us to pause processing while a dispute is resolved.
• Right to object — object to processing we carry out on the basis of our legitimate interests.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to lodge a complaint with your national data protection authority.

The legal bases on which we rely, depending on the activity, are: your consent (marketing communications and optional analytics), the performance of our contract with you (providing the Service you signed up for), our legitimate interests (operating, securing, and improving the Service), and legal obligations (tax, accounting, fraud prevention).

To exercise any of these rights, email privacy@insightsocial.app. We will respond within 30 days. There is no charge for the first request in any 12-month period.

8. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) grants you the rights described below.

Personal information we have collected in the past 12 months

• Identifiers — name, email address, Google user ID.
• Commercial information — subscription tier, export credit usage, referral activity.
• Internet or other electronic network activity — your interactions with our website and extension.
• Geolocation data — approximate location derived from IP address.

We collect this information directly from you, from your authentication provider (Google), and from our service providers (listed in Section 4). We use it for the business purposes described in Section 2 and share it only with the service providers in Section 4.

Your California rights

• Right to know what personal information we have collected, used, disclosed, and shared.
• Right to delete personal information we have collected about you.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of your personal information.
• Right to limit the use of sensitive personal information (we do not collect sensitive PI as defined by the CPRA).
• Right to non-discrimination for exercising any of these rights.

"Sale" and "sharing" of personal information: we do not sell personal information for money. We may "share" limited identifiers (such as a hashed user ID and page-view events) with Google Analytics for cross-context behavioral analytics. You can opt out of this sharing using the Google Analytics Opt-out Browser Add-on.

To exercise these rights, email privacy@insightsocial.app with the subject line "California Privacy Request." We verify your identity using the email address on your account and respond within 45 days (with one 45-day extension where reasonably necessary). We do not knowingly sell or share the personal information of minors under 16.

9. Platform Terms & Responsible Use

You are responsible for using Insight Social in compliance with the terms of service of each social platform you scrape, and with applicable law (including data protection laws such as GDPR and CCPA where they apply to you). Insight Social is a tool; you decide what to extract and how to use it. You agree not to use the Service to harvest personal data for harassment, stalking, mass unsolicited contact, or any unlawful purpose.

10. Children's Privacy

Insight Social is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any new version on this page and update the "Last Updated" date. Material changes will be highlighted on the website. Continued use of the Service after a change constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Privacy & data requests: privacy@insightsocial.app
General support: support@insightsocial.app
Website: https://www.insightsocial.app