Privacy Policy

Valarcha · Last updated: 19 July 2026

Valarcha ("we", "us") provides Instagram account analytics and growth recommendations. This policy explains what data we access when you connect your Instagram professional account, how we use it, and how to delete it. By connecting your account you agree to this policy.

1. What we access

When you authorize Valarcha through Instagram, and only with the permissions you grant, we access:

• Profile basics — your Instagram user ID, username, account type, follower/following/media counts.
• Content & insights — your posts' metadata (type, caption, timestamp) and performance metrics (reach, likes, comments, saves, shares) used to compute analytics.
• An access token — issued by Instagram so we can retrieve the above on your behalf. It is stored encrypted at rest (AES-256-GCM) and is never displayed or shared.

We do not collect your Instagram password. We authenticate only through Instagram's official OAuth.

2. How we use it

• To calculate your account analytics (engagement rate, content performance, best posting times, growth trends).
• To generate personalized growth recommendations.
• With your explicit action, to schedule or publish content you create.

We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

3. Sharing

The only third party involved is Meta / Instagram, whose official Graph API we call to retrieve your data. Your data may be processed by our infrastructure provider (Amazon Web Services) solely to run the service.

4. Retention

We keep your connected-account record and derived analytics while your account is connected. If you remove Valarcha from your Instagram, we revoke and delete the stored access token and mark the account inactive.

5. Deleting your data

You can remove Valarcha at any time from Instagram → Settings → Apps and websites. To request full deletion of your data, see our Data Deletion instructions or email us. Instagram-initiated deletion requests are handled automatically via our data-deletion endpoint.

6. Security

Access tokens are encrypted at rest, transmitted only over HTTPS, and never logged. Access is restricted to the operator of this service.

7. Contact

Questions or requests: lijinlar@gmail.com.