This Privacy Policy explains how the Pecan mobile application and its supporting backend service (together, “Pecan”, “we”, “us”, or “our”) collect, use, store, and share information when you use the app. Pecan lets Instagram creators automatically reply to comments on their posts and send links to commenters by direct message (DM).
By creating an account and connecting your Instagram account, you agree to the practices described in this policy.
Pecan is operated by the Pecan team (the “Developer”). For any privacy questions or requests, contact us at kshitij99hotshot@gmail.com.
When you choose “Continue with Instagram”, you authenticate through Instagram’s official OAuth flow. Instagram then provides us with, and we store, the following:
We do not receive or store your Instagram password.
For each post you choose to automate, we store the rule you configure:
To deliver auto-replies and DMs, we receive real-time event notifications (webhooks) from Instagram when someone comments on a post you have automated. From these events we process:
This data is used only to match your automation rules and to send the reply/DM at that moment. We do not build profiles of, or sell, commenter data.
Our backend logs basic request information (such as request method, path, and timestamps) for security, debugging, and reliability. These logs are not used to identify or track you for advertising.
Pecan offers a free trial and a paid subscription (“Pecan Pro”). To manage this, we store:
This information is obtained from RevenueCat, our subscription-management provider. We never receive or store your card number or other payment credentials — Apple, Google, and RevenueCat handle your payment details directly and do not share them with us.
We do not collect your email address, phone number, precise location, contacts, photos from your device, or payment information (card numbers, billing details) — subscriptions are purchased and billed entirely through the App Store or Play Store.
| Purpose | Data used |
|---|---|
| Authenticate you and keep you signed in | Instagram user ID, access token |
| Display your profile and your posts in the app | Username, profile picture, account type, media |
| Run your automations (auto-reply & auto-DM) | Automation rules, access token, incoming comment events |
| Maintain security and fix problems | Diagnostic logs |
We do not use your data for advertising and we do not sell your data.
Your data is stored in Google Firebase Realtime Database and processed on servers hosted by Fly.io. We share information only with the following service providers, strictly to operate Pecan:
| Provider | Role | Reference |
|---|---|---|
| Meta Platforms / Instagram | Source of your account & comment data; destination for the replies and DMs we send on your behalf | Instagram Privacy Policy |
| Google Firebase | Secure storage of accounts, tokens, and automation rules | Firebase Privacy |
| Fly.io | Application/server hosting | Fly.io Privacy |
| RevenueCat | Manages subscription/entitlement status; source of the payment/trial data described in Section 2e | RevenueCat Privacy |
We do not share your personal information with any other third parties except where required by law, to protect our rights, or in connection with a business transfer.
We retain your account information, access token, and automation rules for as long as your Pecan account is active. Incoming comment events are processed in real time and are not retained as a separate user profile. When you delete your account in the app, request deletion, or remove Pecan’s access from Instagram, we delete your stored profile, access token, login session, and automation rules. Diagnostic logs are retained for a limited period and then rotated out. If you delete your account, we retain a minimal record (your Instagram ID and prior trial dates) to prevent re-use of the free trial. This record does not include your profile, automations, or any other account data.
Depending on your location, you may have additional rights under laws such as the GDPR or CCPA (e.g. to object to or restrict processing). To exercise any right, contact us at the email above.
You can delete your account and all associated data — your profile information, Instagram access token, login session, and automation rules — in any of these ways:
Deletions triggered in the app or by removing Pecan from Instagram are processed immediately; email requests are processed within 30 days. Once deleted, your data cannot be recovered.
Deleting your account removes your Pecan data as described above, but does not cancel any active Pecan Pro subscription. Google Play subscriptions are cancelled automatically where possible; Apple subscriptions must be cancelled by you via Settings → [your name] → Subscriptions on your device, or via the link provided in the app.
Pecan is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
We use industry-standard measures to protect your data, including encrypted connections (HTTPS), access-controlled storage, and limited internal access. No method of transmission or storage is 100% secure, but we work to protect your information and respond promptly to any incident.
Your information may be processed and stored in countries other than your own (including where our hosting and storage providers operate). Where required, we rely on appropriate safeguards for such transfers.
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the app. Continued use of Pecan after changes take effect constitutes acceptance of the updated policy.
Questions or requests regarding this policy or your data: kshitij99hotshot@gmail.com