Who we are
ReelDrop is operated by 10517933 Canada Ltd. (operating as reeldrop.io), a Canadian corporation. ReelDrop is an Instagram content scheduling and AI creation tool that helps creators plan, generate, and publish reels, posts, stories, and carousels from one workspace.
This policy explains what personal information we collect when you use reeldrop.io (the “service”), how we use it, who we share it with, and the rights you have over it. By using the service you agree to the practices described here.
Information we collect
Account information (via Clerk)
We use Clerk for authentication. When you sign up we receive your name, email address, profile image, and a Clerk-issued user identifier. We do not see or store your password.
Instagram and Meta data (via OAuth)
When you connect an Instagram account we receive, via the Meta/Instagram Graph API: your Instagram user ID, username, profile picture, an OAuth access token, the token expiry, and metadata about media you publish or schedule (caption, hashtags, scheduled time, publish status, container IDs, post insights you ask us to fetch).
Instagram messages (the Inbox)
Through the same messages permission your DM automations use, Instagram sends us the direct messages people send to your connected account and the messages your account sends. For each conversation we store the other person's Instagram-scoped ID, name, username and profile picture as Instagram provides them, the text of each message, and its attachments: photos, videos, voice messages, files, and the reels, posts and stories people share with you. We only receive messages from the time you connect; we do not import earlier conversations.
Instagram's own links to those attachments stop working within days, so for photos, videos, PDFs and voice messages we also keep a private copy in our AWS S3 storage. Photos are saved at a reduced size and quality. The copies are private to your workspace and are not served from a public address. We use these messages to show you your Inbox, to let you reply, and to run the automations you set up. We do not sell them or use them for advertising.
You can exclude a person from ReelDrop from their conversation in the Inbox. We then delete everything we hold from that conversation (their messages, our copies of their photos and files, and any AI reply history with them), cancel any follow-up message still waiting to go to them, and stop saving or answering their messages. Nothing is deleted from Instagram and the person is not told. To remember who to leave alone we keep a record of their Instagram-scoped ID and the name and username Instagram gave us, until you take them off the list in Settings, disconnect the Instagram account, or delete your ReelDrop account. A person can only be excluded once they have messaged you, so their first message is still received. To stop ReelDrop receiving direct messages altogether, turn off “Allow access to messages” under Connected Tools in the Instagram app.
Content you upload
Videos, images, captions, hashtags, cover frames, and audio metadata you create or upload to ReelDrop are stored in our AWS S3 buckets so we can transcode and publish them on your behalf.
AI inputs and outputs
When you use AI features (caption generation, hashtag suggestions, cover picking, carousel generation) we send the relevant prompt (and, for video features, the video itself) to Google Gemini. To generate images (carousel slides, reel covers and edits to them) we send the prompt, and any photo you chose for that image (such as your hook photo, your profile picture or a frame from your video), to OpenAI. The generated text or image is returned to you and stored alongside the related post.
If you turn on AI replies for a DM automation (a Creator feature), the text of the conversation with that person is also sent to Google Gemini to write each reply. We keep that conversation for 30 days.
Usage and device information
Our hosting providers automatically log basic technical data: IP address, browser type, operating system, referring page, and timestamps of requests. We use this for security, abuse prevention, and aggregate product analytics.
Cookies and similar technologies
We use a small number of cookies and similar storage mechanisms: a Clerk session cookie that keeps you signed in, a local-storage entry that remembers your theme preference, and a PostHog analytics cookie with a matching local-storage entry. The PostHog cookie holds a random identifier so we can count visits and see which pages and features get used. If you arrive through a creator's referral link, a short-lived cookie records that click so the referral can be credited. We do not record your screen or replay sessions, and we do not use third-party advertising cookies.
How we use your information
- To provide and operate the service (sign-in, scheduling, publishing).
- To publish content to your connected Instagram account on your instruction, via the Instagram Graph API.
- To show you the direct messages sent to your connected account and let you reply to them from the Inbox.
- To generate captions, hashtags, cover suggestions, and carousel slides via Google Gemini and OpenAI.
- To bill paid subscriptions, if you upgrade to a paid plan.
- To detect, prevent, and address fraud, abuse, security incidents, and violations of our terms.
- To communicate with you about the service (transactional emails, security notices, important changes).
- To comply with legal obligations and respond to lawful requests.
Third parties we share with
We do not sell your personal information. We share data only with vendors we need to operate the service:
- Clerk: authentication and user identity. Privacy policy.
- Amazon Web Services (S3): storage of your uploaded media and of the private copies of attachments people send to your Inbox. Privacy notice.
- Google Gemini: AI inference for captions, hashtags, and video understanding. Privacy policy.
- OpenAI: AI image generation for carousel slides, reel covers, and edits to them. Privacy policy.
- Meta Platforms (Instagram Graph API): publishing and reading content from your connected account, and receiving and sending its direct messages. Privacy policy.
- MongoDB Atlas: primary database hosting. Privacy policy.
- Vercel: application hosting and edge delivery. Privacy policy.
- Stripe: payment processing for paid plans. Stripe collects your card details directly; we never see or store your full card number. Privacy policy.
- PostHog: product analytics (page views and feature usage, tied to a random identifier and, once you sign in, to your account). Privacy policy.
- Loops and Amazon SES: sending product and transactional email to the address on your account. Loops privacy policy.
- Cloudflare: network security and traffic routing in front of our servers. Privacy policy.
AI assistants and the MCP connection
You can connect an AI assistant — Claude, ChatGPT, Meta Muse, or any client that speaks the Model Context Protocol — to your ReelDrop account. A connected assistant acts as you: it can do what you can do in ReelDrop, in the workspaces you belong to, and every request is checked against your workspace membership and plan exactly as it would be in the app.
- What the assistant can reach. Your workspaces, connected Instagram accounts, scheduled and published posts, analytics ReelDrop has fetched for you, your DM automations, the Instagram DM conversations in your inbox (including what the people who messaged you wrote), and the comments on your posts. It cannot reach your password, your Instagram credentials, or any other ReelDrop user's data.
- How it authenticates. Either by signing in with your ReelDrop account (OAuth), or with a personal access token you create in Settings. We store only a cryptographic hash of a token, never the token itself — a token shown to you once cannot be recovered by us or anyone else.
- What leaves ReelDrop. Only what the assistant asks for, in response to a request you made, returned to that assistant. We do not send your data to an assistant on our own initiative, and we do not use these requests to train models.
- Your control. Revoke a token, or disconnect an assistant, at any time in Settings → AI assistants. Revocation takes effect on the assistant's next request.
- The assistant's own handling. Once data reaches a third-party assistant it is governed by that provider's privacy policy, not this one.
Data retention
- Account data is retained while your account is active.
- Instagram access tokens are deleted when you disconnect the account or delete your ReelDrop account.
- Uploaded media is retained until you delete the related post or your account.
- Inbox message text is deleted 365 days after the message was sent.
- Inbox photos, videos, PDFs and voice messages (our private copies) are deleted 30 days after the message was sent, and the Inbox then shows them as no longer available.
- Inbox conversations (names, usernames, profile pictures, messages and saved copies) are deleted when you disconnect the Instagram account, when you remove ReelDrop from Instagram, when Meta sends us a data deletion request, and when you delete your ReelDrop account.
- People you exclude from the Inbox (their Instagram-scoped ID, name and username) are kept until you take them off the list, disconnect the Instagram account, or delete your ReelDrop account.
- AI DM reply conversations are deleted 30 days after the person's last message.
- AI prompt history is retained alongside the post it generated, and deleted when the post or account is deleted.
- AI assistant access tokens are stored as a hash and kept until you revoke them; a revoked token's record is retained so you can see it was revoked.
- Backups are purged on a rolling 30-day cycle.
- Billing records are retained for 7 years to comply with Canadian tax law.
Your rights
Depending on where you live, you have rights to access, correct, port, and delete your personal information, and to object to or restrict certain processing. These rights are recognised under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and equivalent laws.
See our data deletion page for instructions on disconnecting Instagram or deleting your ReelDrop account. For any other request, email us at piyush@reeldrop.io.
Children’s privacy
ReelDrop is not directed at children. We do not knowingly collect information from anyone under 13 (or under 16 in the European Economic Area). If you believe a child has provided us their information, contact us and we will delete it.
International transfers
We are based in Canada. Depending on the vendor, your information may be processed in Canada, the United States, or the European Union. Where required, we rely on standard contractual clauses or equivalent safeguards for cross-border transfers.
Security
We encrypt data in transit using TLS and at rest in AWS S3. Instagram access tokens are scoped to the permissions you authorise and are stored with restricted access. Authentication is handled by Clerk; we do not store your password. No system is perfectly secure, but we work to protect your information using industry-standard practices.
Cookies
We use a Clerk-managed session cookie (required to keep you signed in) and browser local storage for your theme preference. We also set a PostHog analytics cookie and a referral cookie, both described under “Cookies and similar technologies” above. You can clear all of these from your browser at any time; clearing the Clerk cookie signs you out.
Changes to this policy
We may update this policy from time to time. When we make material changes we will notify you by email, by an in-app banner, or by updating the “last updated” date below. Continued use of the service after a change means you accept the updated policy.
Contact us
For any privacy questions or requests, write to us at piyush@reeldrop.io.
Last updated: October 9, 2026